StandardGuidancev1.0.0

EN ISO/IEC 42001: artificial intelligence management system

The certifiable organisation-level AI management system, a European standard since 2026, but not a harmonised standard under the AI Act.

The official source remains authoritative. This is general information about obligations and not legal advice. See this object on the map

Address and citation

This object has an address of its own that is never renamed or reused. Store the identifier in your own file, not the title or the link.

Identifier: praxikon:eu:ai-act:standard:standard-en-iso-iec-42001-ai-management-system
Payload hash (sha256): 5ee10b85a24a9bf7b3568085d9b7505cba98678fa0ec51d64f233cedb479aae9

Citation line

Praxikon, "EN ISO/IEC 42001: artificial intelligence management system", praxikon:eu:ai-act:standard:standard-en-iso-iec-42001-ai-management-system@1.0.0, dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.1.0 (schema 1.4.0), effective_at 2026-08-08T00:00:00.000Z, known_at 2026-08-14T00:00:00.000Z, sha256 5ee10b85a24a9bf7b3568085d9b7505cba98678fa0ec51d64f233cedb479aae9

Version: 1.0.0
Legal time (effective_at): 8 August 2026
Knowledge time (known_at): 8 August 2026
Closed on: Not closed
Topics: standards

Review status: Placed against the official source (8 August 2026). Next check due by 4 February 2027. The check date is the knowledge date of this version; no later recheck has been recorded.

What this object links to

Every relation appears below as a path: from the source with its locator, through the conditions and exceptions of the object carrying the relation, to the consequence. A locator belongs to a statement in the data and not to a relation, so the source is the source anchor of the carrying object.

The obligation this hangs off

1 of 1 shown

The object belongs to this obligation. The source line it hangs off sits there.

Source
Official fact on this object, with its locator.
- CEN-CENELEC JTC 21: European standards under standardisation request M/613
  Locator: EN ISO/IEC 42001:2026, European adoption via CEN-CENELEC
  praxikon:eu:ai-act:source:cen-cenelec-jtc21
  Open official source
- EU Artificial Intelligence Act 2024/1689
  Locator: Article 17; Article 40
  praxikon:eu:ai-act:source:reg-eu-2024-1689
  Open official source
Via
- Condition | allUsable by both providers and deployers seeking to structure AI governance organisation-wide.
- ExceptionCertification against ISO/IEC 42001 replaces no AI Act obligation and does not shift the burden of proof.
As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.
Consequence
- ObligationArticle 17: quality management system
  praxikon:eu:ai-act:obligation:article-17-quality-management

What this object is about

2 of 2 shown

The object is about this role. Undifferentiated: it does not follow that the duty rests on this role.

Source
Official fact on this object, with its locator.
- CEN-CENELEC JTC 21: European standards under standardisation request M/613
  Locator: EN ISO/IEC 42001:2026, European adoption via CEN-CENELEC
  praxikon:eu:ai-act:source:cen-cenelec-jtc21
  Open official source
- EU Artificial Intelligence Act 2024/1689
  Locator: Article 17; Article 40
  praxikon:eu:ai-act:source:reg-eu-2024-1689
  Open official source
Via
- Condition | allUsable by both providers and deployers seeking to structure AI governance organisation-wide.
- ExceptionCertification against ISO/IEC 42001 replaces no AI Act obligation and does not shift the burden of proof.
As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.
Consequence
- ActorDeployer
  praxikon:eu:ai-act:actor:deployer
- ActorProvider of an AI system
  praxikon:eu:ai-act:actor:provider

What this object states

Official fact

Attributable to a named primary source, with a locator. Where they differ, the official source prevails.

ISO/IEC 42001:2023 is the first certifiable international standard for an AI management system, published on 18 December 2023 and structured on the plan-do-check-act cycle. The text was adopted unchanged as EN ISO/IEC 42001:2026, approved by CEN on 13 March 2026, with national implementation by the member standards bodies. This adoption is not a deliverable under standardisation request M/613: the standard is not cited in the Official Journal and therefore confers no presumption of conformity under Article 40. For Article 17, the designated deliverable under M/613 is EN 18286:2026; that standard is likewise not cited in the Official Journal.
- Locator: EN ISO/IEC 42001:2026, European adoption via CEN-CENELECpraxikon:eu:ai-act:source:cen-cenelec-jtc21Open official source
- Locator: Article 17; Article 40praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

Our interpretation

Our own reading. It can change without the law changing, and it is not the position of a supervisory authority.

This is the most expensive misconception in the whole standards layer: an ISO/IEC 42001 certificate is not AI Act conformity. The certificate shows you have a governance structure, not that a specific high-risk system meets the regulation. Documented gaps against Article 17 include the absence of a per-system regulatory compliance strategy, of predetermined change management for continuously learning systems, of the Article 73 serious incident reporting timelines, and of a structured fundamental rights assessment. Vendors saying "ISO 42001 certified, therefore AI Act ready" are selling you a certificate, not your dossier.
- Locator: EN ISO/IEC 42001:2026, European adoption via CEN-CENELECpraxikon:eu:ai-act:source:cen-cenelec-jtc21Open official source
- Locator: Article 17; Article 40praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

Recommended step

A practical step we consider appropriate. Not an obligation following from the Regulation.

Use ISO/IEC 42001 as the organisational layer (policy, roles, management review, internal audit) and put the per-system layer on top: a dedicated dossier per high-risk system along the clauses of EN 18286. Deliberately close the gaps named above: per-system compliance strategy, predetermined change management, incident reporting process with the Article 73 timelines, and fundamental rights assessment. In procurement, ask not for the certificate but for the statement of applicability and the audit report.
- Locator: EN ISO/IEC 42001:2026, European adoption via CEN-CENELECpraxikon:eu:ai-act:source:cen-cenelec-jtc21Open official source
- Locator: Article 17; Article 40praxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

When this applies

1Usable by both providers and deployers seeking to structure AI governance organisation-wide.

When this does not apply

Certification against ISO/IEC 42001 replaces no AI Act obligation and does not shift the burden of proof.

Referring to this object

Citation block

Copy this reference into your advice, article or file. The identifier, the version and the hash keep the statement findable later, even once the dataset has moved on.

Reference

Praxikon, "EN ISO/IEC 42001: artificial intelligence management system",
praxikon:eu:ai-act:standard:standard-en-iso-iec-42001-ai-management-system@1.0.0,
dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.1.0 (schema 1.4.0),
effective_at 2026-08-08T00:00:00.000Z, known_at 2026-08-08T00:00:00.000Z,
sha256 5ee10b85a24a9bf7b3568085d9b7505cba98678fa0ec51d64f233cedb479aae9,
https://www.praxikon.com/en/verkenner/standard/standard-en-iso-iec-42001-ai-management-system
(https://www.praxikon.com/api/v1/entities?id=praxikon%3Aeu%3Aai-act%3Astandard%3Astandard-en-iso-iec-42001-ai-management-system&effective_at=2026-08-08&known_at=2026-08-08&lang=en, accessed 2026-08-25)

Short form

praxikon:eu:ai-act:standard:standard-en-iso-iec-42001-ai-management-system@1.0.0 (sha256 5ee10b85)

BibTeX

@misc{praxikon-eu-ai-act-standard-standard-en-iso-iec-42001-ai-management-system-1-0-0,
  author       = {{Praxikon}},
  title        = {EN ISO/IEC 42001: artificial intelligence management system},
  year         = {2026},
  version      = {1.0.0},
  number       = {praxikon:eu:ai-act:standard:standard-en-iso-iec-42001-ai-management-system},
  howpublished = {AI Act Change \& Evidence Graph, dataset 2.1.0, schema 1.4.0},
  note         = {effective_at 2026-08-08T00:00:00.000Z; known_at 2026-08-08T00:00:00.000Z; sha256 5ee10b85a24a9bf7b3568085d9b7505cba98678fa0ec51d64f233cedb479aae9},
  url          = {https://www.praxikon.com/en/verkenner/standard/standard-en-iso-iec-42001-ai-management-system},
  urldate      = {2026-08-25},
  language     = {en}
}

CSL JSON

[
  {
    "id": "praxikon:eu:ai-act:standard:standard-en-iso-iec-42001-ai-management-system@1.0.0",
    "type": "dataset",
    "title": "EN ISO/IEC 42001: artificial intelligence management system",
    "container-title": "AI Act Change & Evidence Graph",
    "publisher": "Praxikon",
    "version": "1.0.0",
    "number": "praxikon:eu:ai-act:standard:standard-en-iso-iec-42001-ai-management-system",
    "URL": "https://www.praxikon.com/en/verkenner/standard/standard-en-iso-iec-42001-ai-management-system",
    "language": "en",
    "issued": {
      "date-parts": [
        [
          2026,
          8,
          8
        ]
      ]
    },
    "accessed": {
      "date-parts": [
        [
          2026,
          8,
          25
        ]
      ]
    },
    "note": "dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.1.0; schema 1.4.0; effective_at 2026-08-08T00:00:00.000Z; known_at 2026-08-08T00:00:00.000Z; sha256 5ee10b85a24a9bf7b3568085d9b7505cba98678fa0ec51d64f233cedb479aae9; retrieved_from https://www.praxikon.com/api/v1/entities?id=praxikon%3Aeu%3Aai-act%3Astandard%3Astandard-en-iso-iec-42001-ai-management-system&effective_at=2026-08-08&known_at=2026-08-08&lang=en; licence https://www.praxikon.com/nl/legal/terms"
  }
]

How to verify a reference later is set out in the methodology. Terms

For agents and integrations

This page and the machine output come from the same object and the same two time axes.

Open as JSON Open as JSON-LD Read the methodology