Two texts, two jobs
The AI Act, Regulation (EU) 2024/1689, sets obligations that rise with the risk a system carries. Some practices are banned outright. High-risk systems must meet a list of requirements before they reach the market. Other systems owe nothing more than transparency.
ISO/IEC 42001 does not say what is allowed. It describes an artificial intelligence management system, meaning the organisation that lets you hold those requirements over time. Policy, roles, risk and impact assessment, control of the life cycle, data governance, documentation, monitoring, improvement. The regulation sets the what, the standard supplies the how.
The timetable moved in July 2026
Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force three days later, defers the obligations attached to high-risk systems. Annex III systems, the standalone ones such as recruitment, credit and education, move from 2 August 2026 to 2 December 2027. Annex I systems, AI embedded in products that are already regulated, are now due on 2 August 2028.
The substance of the requirements was left alone. Only the application dates moved, because European standardisation was not ready.
What already applies
- The banned practices and the AI literacy duty, since 2 February 2025.
- The rules on general purpose AI models, since 2 August 2025.
- The transparency obligations of Article 50, since 2 August 2026.
Part of the regulation is therefore live today. The deferral covers high risk and nothing else.
A deferral is not a pause. It is the time you have to build what will be required, while your customers and your insurers are already asking their questions.
Why go through the standard
The regulation's requirements overlap heavily with what ISO/IEC 42001 asks for. Risk management, technical documentation, logging, human oversight, data quality. An organisation that puts a management system in place against the standard builds, in the same move, most of what the regulation will later demand.
There are two benefits. You work from a stable reference that does not move with the political calendar. And you end up with third party certification that you can put in front of a customer, where compliance with the regulation stays largely self-declared.
And European standardisation
The first harmonised standard under the AI Act was cited in the Official Journal on 19 October 2026. It is EN 18286, which covers the quality management system that Article 17 requires of providers of high-risk AI systems. Others will follow.
That citation matters, because a harmonised standard gives you a recognised route to showing conformity. It also gives you something concrete to require from your own suppliers today.
What we do
We audit AI management systems against ISO/IEC 42001 and we train your teams. Our courses cover the AI Act from the obligations side and the standard from the implementation side. One system, two uses.
Sources
- Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence.
- Regulation (EU) 2026/1744 of 8 July 2026 amending Regulation (EU) 2024/1689, published in the Official Journal on 24 July 2026.
- ISO/IEC 42001:2023, Artificial intelligence management systems.
- Publication of the reference to EN 18286 in the Official Journal of the EU, 19 October 2026.