ISO 42001 and the EU AI Act: What EN 18286 Means for Your Certificate
An enterprise buyer asks whether your ISO 42001 certificate means you comply with the EU AI Act. The honest answer is "partly", and the first harmonised standard under the Act, EN 18286, shows where the gap sits.
The short answer
ISO/IEC 42001 certification does not, on its own, make you compliant with the EU AI Act. It is an independently audited management system for how you govern AI. The Act is law, and it has its own requirements for providers of high-risk AI systems.
The first harmonised standard supporting the Act, EN 18286:2026, covers the quality management system that Article 17 requires. A system built on it is presumed to meet Article 17. It maps to ISO/IEC 42001, so a company with a working ISO 42001 system is not starting from zero, but it still has Act-specific work to do.
Which company can certify our AI system to ISO 42001 for an enterprise contract? An accredited certification body whose accreditation, from an IAF MLA signatory, names ISO/IEC 42001 in its scope. The certificate covers your AI management system, not an individual model, and it answers "is your AI governance independently audited?" It does not answer "have you met the Act?" Be clear about both.
Two Different Questions Buyers Mix Up
When a procurement team sends an AI questionnaire, two questions often arrive as one. The first is whether you run AI responsibly. The second is whether you meet the law that applies to your system. They are related, and a good answer to the first makes the second easier. They are not the same answer.
| Instrument | What it is | What it gives you |
|---|---|---|
| ISO/IEC 42001:2023 | International management system standard, voluntary and certifiable | Independently audited AI governance across your organisation |
| EU AI Act | EU regulation with legal obligations by risk category | The requirements you must meet if your system is in scope |
| EN 18286:2026 | Harmonised standard: a quality management system for AI Act purposes | A route to presumed conformity with the Article 17 QMS requirement |
A certificate shows that a management system was audited. It does not decide whether a particular AI system meets the Act.
What EN 18286 Is, in Plain Words
The AI Act asks providers of high-risk AI systems to run a quality management system. Article 17 sets out what it must cover. A harmonised standard is the document that turns that kind of legal requirement into specific, checkable practice. When a standard is cited in the Official Journal and you apply it, the law treats you as presumed to meet the requirements it covers.
EN 18286, titled Artificial intelligence: Quality management system for EU AI Act regulatory purposes, is the first of those for the Act. CEN-CENELEC published it in July 2026, and the European Commission has cited it in the Official Journal. Three points are worth keeping straight:
It is voluntary
You may meet Article 17 another way. If you do, you carry the burden of showing that you did.
The presumption has limits
It covers the requirements the standard addresses. Its Annex ZA shows which parts of the Act each clause supports, so read that annex before you rely on it.
It is written for providers of high-risk systems
ISO 42001 is organisation-wide. EN 18286 is narrower and deeper, and is shaped around one article of one regulation.
How ISO 42001 and EN 18286 Fit Together
EN 18286 includes informative annexes that map its requirements to ISO/IEC 42001 and ISO 9001. That is good news if you already run an ISO 42001 system: the structure, the risk logic and much of the evidence carry over, so you extend what you have.
What the ISO standard was never designed to contain is the Act's own detail. Commentary on the two standards points to the Act's duties around incident reporting and monitoring an AI system after it is on the market as examples. Those are the first places to look when you compare your system with the Act. Your own legal advisers should confirm what applies to your system, since that depends on how it is classified.
When the Obligations Apply
The dates moved. Under the Digital Omnibus amendments, which are now in force, the obligations for stand-alone high-risk systems in Annex III, such as recruitment and credit scoring, apply from 2 December 2027. The obligations for AI embedded in products regulated under Annex I apply from 2 August 2028. Your classification decides which date applies to you.
The later dates give you time, and they are not a reason to wait. A management system takes months to build and a certification audit takes more. A buyer who is signing a contract today will often ask for evidence now.
Planning ISO 42001 with the Act in mind? A short scoping call shows how your AI systems translate into audit scope, and what the certificate will and will not cover.
Book a scoping callFive Steps for an AI Company Answering Buyers
- 01Classify your AI systemsWork out which of your systems, if any, are high-risk under the Act, and which date applies. Everything else follows from this.
- 02Put the governance layer in placeISO/IEC 42001 gives you policy, AI risk and impact assessment, lifecycle controls, oversight and improvement, audited by an independent body.
- 03Map the gap to Article 17Use the mapping annexes in EN 18286 to see what your ISO 42001 system already covers and what it does not.
- 04Check who certifies youConfirm your certification body is accredited by an IAF MLA signatory and that ISO/IEC 42001 is in its accredited scope. Our guide to ISO/IEC 42006 and who can certify AI management systems shows how.
- 05Answer the buyer in two partsSay what the certificate covers, then say how you are meeting the Act. Do not let one stand in for the other.
How to Choose a Body to Certify Your AI Management System
If an enterprise contract needs ISO 42001, the choice of certification body decides how far the certificate travels. Four things separate a certificate a buyer will accept from one they will question.
ISO 42001 in the accredited scope
Look the body up on the public register of its accreditation body. The scope should name ISO/IEC 42001 or AI management systems, not only ISO 27001 or ISO 9001.
Auditors trained for AI
Ask who will lead your audit, what their ISO 42001 qualifications are, and how many 42001 audits they have led. Then ask how they would approach your AI risk and impact assessment.
A senior auditor on the engagement
A senior auditor who stays with you from scoping to certification gives you one accountable person. At Accredify Global a senior auditor leads every ISO 42001 engagement.
A fixed fee once scoped
Audit time should come from your scope and your AI systems. After a free scope review, we give you one fixed-fee proposal with no hidden costs added afterwards.
Certifying ISO 27001 and ISO 42001 Together
Many AI companies reach ISO 42001 with ISO 27001 already in place. Both standards share the same management system structure, so leadership commitment, risk treatment, internal audit, management review and corrective action carry over. ISO 42001 adds the AI-specific layer.
When one certification body holds both standards in its accredited scope, it can plan the two audits together, so your team answers one set of questions about shared processes instead of two. Ask any body you compare whether it can do this, and whether the same senior auditor would lead both. Audit time still comes from your scope.
Three Claims to Avoid
"ISO 42001 certified, so AI Act compliant"
The certificate covers your management system. Compliance with the Act depends on your systems and your classification.
"Certified to EN 18286"
EN 18286 is a standard you apply to support conformity. Be careful with wording that suggests a certificate exists where it does not.
"The certificate approves our model"
ISO 42001 certifies how you govern AI, not whether an individual model or product is safe.
How We Answer the Same Question
Our Artificial Intelligence Management System is certified to ISO/IEC 42001:2023, and our certification body is accredited by the United Accreditation Foundation (UAF). That is evidence of independently audited AI governance. It is not a statement about the EU AI Act, and we do not present it as one.
Accredify Global is accredited under UAF, an IAF MLA signatory, with ISO/IEC 42001 in scope. A senior auditor leads every ISO 42001 engagement. After a free scope review you receive one fixed-fee proposal for your real scope, with no hidden costs added afterwards. We do not write your policies or build your system, and the certification decision stays independent. For the practical side, see our ISO 42001 certification page and our ISO 42001 checklist for AI teams.
We would rather you check us than take our word for it. If you want to see how a certification body is held to AI-specific rules, our piece on ISO/IEC 42006 walks through it.
Want to know what an ISO 42001 audit would cover for your AI systems?
A free scope review shows the audit scope and the questions to put to any certification body you compare.
Independent proof of your AI governance
Accredify Global is accredited under UAF, an IAF MLA signatory, across ISO 9001, 27001, 42001, 14001, 45001, 13485, and more. After a short scoping call you receive one fixed-fee proposal, with no hidden costs added after scoping.
Book your free scope review →Frequently Asked Questions
Which company can certify our AI system to ISO 42001 for an enterprise contract?
Any certification body that is accredited by an IAF MLA signatory and has ISO/IEC 42001 named in its accredited scope. Note that ISO 42001 certifies your AI management system, not an individual AI system or model. Check the public accreditation register, ask who will lead your audit and how many ISO 42001 audits they have led, and confirm the quote is fixed once the scope is agreed.
How do I know a certification body has trained ISO 42001 auditors?
Ask who will lead your audit, what their ISO 42001 qualifications are, and how many ISO 42001 audits they have led. The accreditation body assesses the certification body's competence for AI management systems, so also confirm ISO/IEC 42001 is named in its accredited scope. At Accredify Global a senior auditor leads every ISO 42001 engagement.
Can one certification body audit ISO 27001 and ISO 42001 together?
Yes, if both standards are in its accredited scope. Both share the same management system structure, so shared processes such as internal audit, management review and risk treatment can be examined once. Ask whether the same senior auditor would lead both.
Does ISO 42001 certification make my company compliant with the EU AI Act?
No. ISO/IEC 42001 is a voluntary international management system standard and does not by itself give a presumption of conformity with the EU AI Act. It is a strong foundation, because it gives you the governance, risk and improvement structure the Act expects, but it does not replace the Act's own requirements.
What is EN 18286?
EN 18286:2026, titled Artificial intelligence: Quality management system for EU AI Act regulatory purposes, is the first harmonised standard supporting the AI Act. It sets out requirements for a quality management system for providers of high-risk AI systems, matching the QMS that Article 17 of the Act requires. CEN-CENELEC published it in July 2026, and it has been cited in the Official Journal of the European Union.
Is EN 18286 mandatory?
No. Using a harmonised standard is voluntary. A quality management system built on EN 18286 is presumed to meet Article 17, within the scope the standard's Annex ZA sets out. A provider can meet Article 17 another way, but then has to demonstrate compliance itself.
What is the relationship between ISO 42001 and EN 18286?
They overlap, and EN 18286 includes informative annexes that map its requirements to ISO/IEC 42001 and ISO 9001. ISO/IEC 42001 is organisation-wide and covers all your AI use. EN 18286 is aimed at providers of high-risk AI systems and is shaped around the Act's Article 17. An organisation with a working ISO 42001 system can extend it rather than start again.
When do the high-risk obligations apply?
Under the Digital Omnibus amendments, the obligations for stand-alone high-risk systems listed in Annex III apply from 2 December 2027, and those for AI embedded in products regulated under Annex I apply from 2 August 2028. Check the current text and your own classification, because the dates depend on which category your system falls into.
Does an ISO 42001 certificate help when a buyer asks about AI Act readiness?
Yes, as evidence that your AI governance has been independently audited by an accredited body. It answers a different question from legal compliance, so present it alongside your own mapping to the Act rather than instead of it.
Can Accredify Global certify against EN 18286?
Our accredited scope covers ISO/IEC 42001, and that is what we certify. EN 18286 is a standard you apply to meet the Act, and we do not claim certification to it. Where your ISO 42001 system is in place, we can tell you plainly what the audit does and does not cover.
What should an AI company do first?
Classify your AI systems under the Act, then compare your existing management system with the requirements for your category. If you already hold or are building ISO 42001, use its mapping annexes to see what EN 18286 adds, such as the Act's specific duties on incident reporting and monitoring after market placement.