ISO/IEC 42001 is the international standard that defines an artificial intelligence management system (AIMS); the EU AI Act is the European Union law that imposes obligations by risk level. One is voluntary and systemic; the other is mandatory and legal. Implementing the AIMS is the practical route to demonstrating AI Act compliance.
Both arise from the same problem — organizations began building and operating AI systems faster than governance could keep up — but they answer it in different ways. The standard provides a method to govern AI responsibly over time; the law establishes what is mandatory for anyone placing AI systems on the European market. Understanding where one ends and the other begins is what prevents building two parallel programs when a single well-structured one satisfies both.
What is ISO/IEC 42001 and what is an AIMS?
ISO/IEC 42001 is the first international management-system standard dedicated to artificial intelligence. It does not certify that a model is "safe" or "ethical" — it certifies that a system exists to identify the risks of using and developing AI, decide what to do about them, and keep those decisions alive across the systems' life cycle.
An AIMS (Artificial Intelligence Management System) follows the same high-level structure as the other ISO management-system standards — the same logic as ISO/IEC 27001 for information security. That means clauses on context, leadership, planning, support, operation, performance evaluation, and improvement, organized around a plan-do-check-act cycle. Anyone already running an ISMS recognizes the format immediately, and much of the governance structure can be reused.
What 42001 adds is the AI-specific content. The standard's Annex A brings control objectives and controls aimed at the questions AI systems raise: responsible-use policies, roles and responsibilities, data management across the life cycle, assessment of the systems' impact on people and groups, transparency, human oversight, and management of AI suppliers. The organization selects the applicable controls from its risk assessment — it is not a mandatory checklist to tick item by item.
The core idea: 42001 governs how you develop, procure, and operate AI, not an isolated system. It covers the model bought from a third party, the agent built in-house, and the data pipeline feeding both, under one set of management rules.
What obligations does the EU AI Act impose, and on whom?
The EU AI Act — Regulation (EU) 2024/1689 — is a law with extraterritorial reach: it applies to anyone who develops, distributes, or uses AI systems whose output is used in the European Union, regardless of where the company is based. A Brazilian organization offering an AI product to European clients falls within scope. It classifies systems by risk level and imposes obligations proportional to each level:
-
Unacceptable risk — prohibited practices. Some AI uses are banned as incompatible with fundamental rights, such as certain social-scoring and behavioral-manipulation systems. No compliance is possible: the use is prohibited.
-
High risk — the regulatory core. Systems used in sensitive contexts (such as safety components, hiring, credit, or essential services) must meet strict requirements: a risk-management system, data governance, technical documentation, event logging, transparency for the user, effective human oversight, and robustness, accuracy, and cybersecurity. Before entering the market, they undergo conformity assessment.
-
Limited risk — transparency obligations. Systems that interact with people (chatbots), generate synthetic content, or produce deepfakes must make clear that the content or interaction is AI-generated.
-
Minimal risk — most applications. No specific obligations beyond general good practice.
There is also a dedicated layer for general-purpose AI models (GPAI): obligations for technical documentation, information for those integrating the model, and respect for copyright, with additional requirements for models presenting systemic risk. The regulation applies in phases: prohibitions take effect first, followed by GPAI obligations, and finally the requirements for high-risk systems. Non-compliance exposes the organization to significant administrative fines, calculated as a percentage of global turnover.
How do ISO/IEC 42001 and the EU AI Act relate?
The relationship is one of means and end. The AI Act says what is mandatory; ISO/IEC 42001 provides a recognized method for how to get there and sustain it over time. The AI Act's requirements for high-risk systems — risk management, data governance, documentation, logs, human oversight, robustness — map directly to the AIMS controls. A well-implemented management system produces the evidence the law requires.
| Criterion | ISO/IEC 42001 | EU AI Act |
|---|---|---|
| Nature | Voluntary technical standard, certifiable | Mandatory, directly applicable law |
| Reach | Any organization developing or using AI | AI systems with effect on the EU market |
| Focus | How to govern AI (management system) | What is allowed and required (risk-based obligations) |
| Structure | Management cycle + Annex A controls | Risk classification + requirements per class |
| Consequence | Certificate from an accredited body | Administrative fines and market restriction |
| Practical role | Means to demonstrate governance and compliance | Regulatory end to be met |
The right reading is not to choose one over the other. For those with European market exposure, the AI Act is non-negotiable; 42001 is the most efficient way to put the house in order to meet it — and it serves equally those not under the AI Act who need to demonstrate AI governance to clients, sector regulators, or partners. The same caveat as any management standard applies: 42001 certification is not, on its own, a presumption of legal compliance with the AI Act. It structures and evidences governance; the legal classification requires analyzing the specific requirements applicable to each system.
What is the practical path to compliance?
Achieving compliance means turning principles into a system that operates and produces evidence. The steps below serve both to implement 42001 and to meet the AI Act, because they address the same points.
-
Inventory and classify the AI systems. No governance starts without knowing what exists. Catalog every AI system — developed, procured, and embedded in third-party products — and classify each by AI Act risk level. This inventory defines the AIMS scope and reveals where the heaviest obligations lie.
-
Define governance, policy, and roles. Establish the responsible-AI policy, the committee or people accountable for governance, and responsibilities across the life cycle. This is the standard's leadership requirement and the foundation for the human oversight the AI Act demands.
-
Assess risks and impacts. Conduct a risk assessment of each system and, for the highest-impact ones, an impact assessment on affected people and groups. Data governance enters here: origin, quality, and representativeness of the data used to train and operate the systems.
-
Implement the AIMS controls. Put the selected controls into operation — data management, transparency, human oversight, robustness and cybersecurity of the AI systems, supplier management. Testing the technical resilience of models and agents against abuse is part of this stage.
-
Document and evidence. Produce the technical documentation, event logs, and instructions for use that the law requires for high-risk systems and that the standard asks for as evidence. Missing documentation is the most common non-conformity, and the most expensive to fix at the last minute.
-
Monitor, audit, and improve. Measure control performance, run the internal audit, handle incidents and non-conformities, and take the results to management review. This is the cycle that keeps the system alive and ready for a certification audit or an inspection.
The steps are not strictly sequential. Inventory, risk assessment, and controls form a core that feeds back on itself as new AI systems reach production.
How long does it take, and what determines the effort?
There is no standard timeline. The time to comply depends on how many AI systems the organization operates, how many fall into the higher-risk categories, and how much governance already exists — not on the sector alone.
The main effort and cost drivers are the size and diversity of the AI portfolio (more systems and more suppliers expand the inventory and risk assessment), the number of high-risk systems in scope (which concentrate the AI Act's heaviest requirements), the maturity of existing data governance, and the distance between current and required documentation. Describing these drivers is more honest than promising a number: they are what determine how many months the project takes.
How Berghem does it
Berghem structures compliance from the inventory and risk classification of the AI systems, not from a generic model. We start by mapping what the organization develops, procures, and operates, place each system within the AI Act, and measure the real distance between current governance and the 42001 requirements — so the treatment plan attacks the gaps that matter, in the order that reduces the most risk.
From there, we support the AI policy, the risk and impact assessments, the implementation of the AIMS controls, and the technical documentation, leaving the system ready for audit and able to demonstrate compliance. The detail of the approach and deliverables is on our page for AI governance consulting under ISO/IEC 42001.
Because governance without technical verification is just paper, we connect the 42001 track to tests that produce the robustness evidence the AI Act requires — AI agent security and Red Team exercises — and to the same organization's other compliance fronts, such as LGPD compliance, ISO/IEC 27001, and the NIS2 directive. As an information security company in São Paulo, we tune scope, depth, and timeline to each operation's risk profile.
Frequently asked questions
Does ISO 42001 replace EU AI Act compliance?
No. 42001 is a voluntary management standard and the AI Act is mandatory law. Certifying to 42001 structures and evidences AI governance, which greatly eases meeting the AI Act's obligations, but it is not, on its own, a legal presumption of compliance. The legal classification of each system remains necessary.
My company is outside the European Union. Does the AI Act apply to me?
It may. The regulation has extraterritorial reach: if your AI system's output is used in the EU, or if you offer the system to European users, you fall within scope, regardless of where the company is based. A Brazilian organization with AI products aimed at the European market needs to assess its classification.
We already have ISO 27001. How much of it carries over to ISO 42001?
A lot. The two standards share the same management-system structure, so leadership, risk management, internal audit, and management review are reusable. What 42001 adds is the AI-specific content: governance of training data, impact assessment, transparency, and human oversight. Integrating the two systems is usually more efficient than running them in parallel.