Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
Who needs ISO 42001 and when is it worth pursuing?
Last verifiedNobody is legally required to adopt ISO 42001 — it is voluntary. Pursue it when contracts, buyers, or risk posture warrant a certifiable AIMS. EU AI Act duties are separate law. Not legal advice.
Applicability guide, last verified 10 September 2026 against ISO/IEC 42001:2023 scope and Regulation (EU) 2024/1689 for adjacency only. Does not determine that the Act or standard applies to YOU. Not legal advice.
Decision tree — do we need 42001 now?
| Question | If yes, consider | Kind of text |
|---|---|---|
| Does a customer or RFP require accredited ISO 42001? | Plan certification path — contractual driver | Commercial requirement — verify clause text |
| Do we develop or deploy AI at scale with societal impact? | AIMS may reduce audit friction — voluntary standard | Best practice / risk management |
| Are we subject to EU AI Act duties? | Separate legal track — see EU AI Act cluster | Legal requirement — only if Act applies |
| Do we already run ISO 27001? | Integrate AIMS — see vs ISO 27001 page | Best practice — reuse Annex SL machinery |
Legal requirement vs market driver vs best practice
- Legal requirement: ISO 42001 itself is not named in Union product law as a universal duty. Regulation (EU) 2024/1689 is separate — counsel applies it to YOUR facts.
- Market / contractual: procurement clauses increasingly name ISO 42001 or 'AI management system' — read the exact wording.
- Best practice: a certifiable AIMS can structure AI governance even without a certificate.
- EU AI Act adjacency: a certified AIMS may help operationalise documentation and risk management; it does not satisfy the Act by itself.
What to do now
- Search active contracts and RFPs for 'ISO 42001', 'AIMS', or 'AI management system'.
- Ask counsel whether EU AI Act Articles 2–3 may apply — use the EU AI Act overview, not this page.
- If only internal maturity is the goal, start with readiness checklist without engaging a CB.
Checklist
- ☐ Contractual ISO 42001 requirement identified?
- ☐ AI inventory shows systems in potential AIMS scope?
- ☐ Leadership aligned on certificate vs readiness-only?
- ☐ EU AI Act track separated from voluntary standard track?
Where this shows up in ShipReady Metrics
The AI inventory under Compliance → AI governance helps YOU see which systems might sit in an AIMS scope. It does not decide that ISO 42001 is required or that the EU AI Act applies.