ISO 42001 Consulting and Certification: Build an AI Management System, Meet the EU AI Act
The Digital Omnibus has been in force since 27 July 2026 – the obligations for high-risk AI have been pushed back to December 2027. Anyone who concludes they can sit back for a year and a half is misreading the regulation: the transparency obligations under Article 50 have applied since 2 August 2026 – with a transition period until 2 December 2026 for labeling AI-generated content (Art. 50(2)). We build the structure that lets you meet both – the EU AI Act and a certifiable AI management system under ISO 42001.
What is ISO 42001?
ISO/IEC 42001:2023 is the world's first certifiable standard for an AI management system (Artificial Intelligence Management System, AIMS). Published in December 2023, it describes how an organization systematically governs, evaluates and documents the use and development of artificial intelligence.
It follows the same high-level structure as ISO 27001: clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement. The standard is supplemented by four annexes:
| Part | Content |
|---|---|
| Clauses 4–10 | Management system requirements (same structure as ISO 27001 / ISO 9001) |
| Annex A | 38 controls in 9 objective areas – the actual control framework |
| Annex B | Implementation guidance for each control |
| Annex C | Catalog of potential AI objectives and risk sources |
| Annex D | Use across individual industries and domains |
If you already run an ISMS under ISO 27001, there is no need to reinvent the wheel: leadership, risk management, document control, internal audits and management review can largely be reused. What is new are the AI-specific topics – the AI System Impact Assessment, data quality and data provenance, human oversight, transparency toward affected persons and the governance of third-party models.
ISO 42001 and the EU AI Act: how they connect
The EU AI Act is law; ISO 42001 is voluntary. Yet the two interlock: Article 17 of the AI Act requires providers of high-risk AI to operate a quality management system with risk management, data governance, technical documentation, record-keeping and post-market monitoring. ISO 42001 delivers exactly these building blocks in auditable form.
Important – and often misrepresented
ISO 42001 is not a harmonized standard under the EU AI Act. A certification does not create a presumption of conformity and does not replace a conformity assessment. It is strong evidence of governance maturity – toward customers, regulators and in vendor risk management – but not a legal free pass. Anyone who promises you otherwise is selling you a risk.
Deadlines after the Digital Omnibus (as of July 2026)
| Obligation | Applies from |
|---|---|
| Prohibited AI practices (Art. 5) | already applies, subject to penalties since August 2025 |
| New prohibitions (AI-generated abuse material, non-consensual intimate deepfakes) | from 2 December 2026 |
| AI literacy of staff (Art. 4) | applies since February 2025 (softened by the Omnibus: obligation to take measures to promote AI literacy) |
| Obligations for general-purpose AI models / GPAI (Art. 53) | applies since August 2025, enforcement from August 2026 |
| Transparency obligations (Art. 50) | applies since 2 August 2026 (labeling of AI-generated content, para. 2: transition period until 2 December 2026) |
| High-risk AI under Annex III (stand-alone systems) | 2 December 2027 (postponed) |
| High-risk AI under Annex I (embedded in products) | 2 August 2028 (postponed) |
The Digital Omnibus also brings relief for smaller companies: the SME relief now also extends to small mid-caps (fewer than 750 employees and no more than €150 million in revenue or €129 million in total assets) – including simplified technical documentation, more proportionate QMS requirements and adjusted fine caps. The substantive requirements remain unchanged – what has moved is the deadline, not the obligation.
Who needs ISO 42001 consulting?
- Software and SaaS providers shipping AI features – the AI questionnaire arrives in enterprise procurement at the latest, often before any legal deadline. If you also serve US customers, you usually need a SOC 2 report in parallel.
- Companies using AI broadly in-house – in recruiting, credit checks, production. High-risk use cases often emerge here unnoticed.
- Providers of high-risk systems under Annex III – personnel selection, creditworthiness, critical infrastructure, education. For them, a management system is effectively the only option.
- Organizations already certified to ISO 27001 – for them, ISO 42001 is the smallest step to the next proof of compliance, because the foundation is in place.
What we deliver
| Service | What you get |
|---|---|
| AI inventory & applicability analysis | Systematic inventory of all AI systems you use and develop, role clarification (provider or deployer) and risk classification under the EU AI Act |
| ISO 42001 gap analysis | Review against clauses 4–10 and the 38 Annex A controls, prioritized action list with effort and timeline |
| Building the AIMS | AI policy, roles and responsibilities, risk and impact analysis, data governance, supplier management, document control |
| Integration into your existing ISMS | One management system instead of two: shared risk methodology, joint audits, joint management review |
| Certification support | Internal audit, management review, selection of the certification body, support through Stage 1 and Stage 2 |
Our team includes a trained ISO 42001 Lead Auditor. Add to that the perspective you only gain from audit practice: since 2025 we have seen AI systems in almost every audit scope – in HR tools, in development environments, in customer portals, usually without management being aware of it. That is why we know exactly where AI governance falls apart in reality, not just what the standard requires.
Underneath sits our management system practice from ISO 27001 and TISAX® projects with more than 50 clients, including our own ISO 27001 certification. This combination is exactly what matters for ISO 42001: the AI-specific controls are new, the management system underneath is not.
Process: from applicability to certificate
- AI inventory (2–3 weeks): Which AI systems do you use, which do you develop yourself, which do you buy in? Without this inventory, every further statement is speculation.
- Classification under the EU AI Act (1–2 weeks): Prohibited, high-risk, subject to transparency obligations or non-critical – per system and per role.
- ISO 42001 gap analysis (2–4 weeks): Target-versus-actual comparison against the standard and Annex A; the result is a prioritized action list.
- Build & implementation (3–6 months): Policy, processes, impact analyses, documentation, training.
- Proof of effectiveness (2–3 months): The system must be in operation before the audit – records, internal audit, management review.
- Certification audit: Stage 1 (documentation) and Stage 2 (implementation), followed by a three-year cycle with annual surveillance audits – just like ISO 27001.
Realistic total time to certification readiness: 6–12 months. With an existing ISO 27001 ISMS, closer to the lower end; without management system experience, closer to the upper end.
ISO 42001 certification: how the audit works
Certification is granted by an independent certification body – not by the consultant who built the system with you. We prepare you and accompany the audit; the assessment itself is done from the outside.
Stage 1 – document review: The auditors check whether the AI management system is fully described: scope, AI policy, AI inventory, risk assessment, AI impact assessments and the Statement of Applicability for the 38 Annex A controls. Gaps from Stage 1 must be closed by Stage 2.
Stage 2 – implementation review: Now what counts is evidence that the system is actually in operation – operational records, approved impact assessments, managed suppliers, completed training, internal audit and management review. Interviews with the people responsible for the AI systems are part of it.
Certificate and cycle: The certificate is valid for three years. In each of the two following years there is a surveillance audit, and in the third year recertification – the same rhythm as ISO 27001.
Audit duration: Since July 2025, the standard ISO/IEC 42006 has set the requirements for certification bodies auditing ISO 42001. Under it, audit time depends mainly on the number of people working with your AI systems and on the number, complexity and risk of the systems – not on headcount alone.
Check the accreditation: Not every certificate carries the same weight. A certificate is robust when it is issued by a body accredited for ISO 42001. In Germany, to our knowledge (as of October 2026), no certification body with DAkkS accreditation for ISO 42001 can be found in the register yet; accredited certificates currently come from bodies accredited by other national accreditation bodies in Europe. Ask to see the scope of accreditation before you sign – we help you choose the body.
How much does ISO 42001 cost?
| Service | Scope | Price |
|---|---|---|
| AI governance readiness check | AI inventory, AI Act classification, ISO 42001 gap analysis, action plan | Fixed price €4,900 |
| Building an AIMS (from scratch) | Complete AI management system up to certification readiness | from €28,000 |
| Building an AIMS (with an existing ISO 27001 ISMS) | Integration instead of a parallel system | from €18,000 |
All prices excl. VAT. Certification body fees are not included and are invoiced directly between you and the body.
Book a free initial consultation
45 minutes, no obligation – we clarify your role under the EU AI Act and your three next steps.
ISO 42001 vs. ISO 27001 – and why you might need both
| Criterion | ISO 42001 | ISO 27001 |
|---|---|---|
| What it protects | Responsible use of AI | Confidentiality, integrity, availability of information |
| Controls | 38 (Annex A) | 93 (Annex A) |
| Core risk | Wrong decisions, bias, lack of traceability | Data loss, unauthorized access, outages |
| Regulatory link | EU AI Act | NIS-2, GDPR, industry-specific requirements |
| Certification | 3 years, annual surveillance | 3 years, annual surveillance |
The two standards do not compete; they complement each other. ISO 27001 protects the data your AI works with. ISO 42001 governs what the AI does with that data. In practice, we bring both systems together under a shared risk methodology – that halves the audit effort and prevents contradictory documentation.
Common mistakes when getting started with ISO 42001
- No AI inventory: Almost every company uses more AI than management knows – embedded in HR tools, CRM systems and development environments. Without an inventory, any classification is worthless.
- Role determined incorrectly: Providers and deployers have different obligations. If you substantially modify a purchased model or ship it under your own name, you become a provider yourself – often unintentionally.
- Certificate confused with conformity: ISO 42001 is not a harmonized standard. A certificate does not replace the conformity assessment for high-risk AI.
- Parallel system built: A second management system alongside the ISMS permanently doubles maintenance and audit effort.
- Waiting for 2027: The transparency obligations have applied since August 2026, and enterprise customers are already asking about AI governance today – regardless of any deadline.
Are you ready for ISO 42001? Quick check
- AI inventory in place: All AI systems you use and develop are recorded, including embedded features in third-party software
- Role clarified: For each system, it is determined whether you are the provider or the deployer
- Risk classification done: Every system is classified under the EU AI Act
- AI policy adopted: Management has set down guardrails for AI use in writing
- Responsibilities assigned: It is clear who evaluates and approves AI risks
- Impact assessments performed: Impact assessments are available for critical systems
- Data governance documented: The provenance, quality and permissibility of training and input data are evidenced
- Human oversight defined: It is specified who reviews results and can override them
- Transparency ensured: Users can tell when they are interacting with AI or seeing AI-generated content (Art. 50)
- Suppliers managed: Model and API providers are integrated contractually and technically
- AI literacy demonstrated: Staff training has been delivered and documented (Art. 4)
This check as a PDF — with an explanation of every item and the current EU AI Act deadlines after the Digital Omnibus.
Next step
Most companies do not underestimate the standard – they underestimate their own AI inventory. In a 45-minute initial consultation, we clarify which of your systems fall within scope at all, which role you take under the EU AI Act and whether ISO 42001 is the right path for you – or whether lean AI governance is enough for now.
Frequently asked questions about ISO 42001 consulting
Is ISO 42001 mandatory?
No. ISO 42001 is a voluntary standard. What is mandatory are the requirements of the EU AI Act. ISO 42001 is the practical framework for meeting these requirements in a structured, verifiable way.
Does ISO 42001 automatically make me compliant with the EU AI Act?
No. ISO 42001 is currently not a harmonized standard under the AI Act and does not create a presumption of conformity. It covers a large part of the required governance, but replaces neither the conformity assessment nor the technical documentation for high-risk systems.
We are already certified to ISO 27001. How much additional effort is involved?
Considerably less than most expect. Leadership, risk management, document control, internal audit and management review can be reused. The additional effort is concentrated on the AI-specific controls: impact assessment, data governance, human oversight and transparency.
How long does ISO 42001 certification take?
Realistically 6–12 months to certification readiness. What matters is less the size of the company than whether a management system already exists and how many AI systems fall within scope.
Does the EU AI Act apply to us if we only buy AI?
Yes. Deployers have obligations too – in particular AI literacy, transparency toward affected persons and human oversight. If you substantially modify a purchased system or offer it under your own name, you additionally become a provider yourself.
Who is allowed to certify to ISO 42001?
Only an independent certification body. A certificate is robust if the body is accredited for ISO 42001; since July 2025, the requirements for such bodies have been set by the standard ISO/IEC 42006. A consultant who helped build the system may not certify the same company.
Are there accredited certification bodies for ISO 42001 in Germany?
To our knowledge (as of October 2026), no body with DAkkS accreditation for ISO 42001 can be found in the register yet. Accredited certificates are available from bodies accredited by other European accreditation bodies. Check the scope of accreditation before you sign.
How long is an ISO 42001 certificate valid?
Three years. In each of the two following years there is a surveillance audit, followed by recertification.
What has changed with the Digital Omnibus?
The Digital Omnibus, which entered into force on 27 July 2026, postpones the obligations for stand-alone high-risk AI to 2 December 2027 and for AI embedded in products to 2 August 2028. It also introduces relief for small and medium-sized enterprises. The transparency obligations under Article 50 remain at 2 August 2026, and obligations already in effect are unaffected.