No. ISO/IEC 42001 certification covers an organization’s AI management system (AIMS) within a defined scope; it does not by itself establish that a particular AI system complies with the EU AI Act. The Act’s 2027 and 2028 dates apply to specified provisions for two high-risk classification routes.
Treat an AIMS certificate as evidence about the organization’s management system. Assess each AI system against the duties that apply to its classification and the organization’s role.
What ISO/IEC 42001 certification covers
ISO/IEC 42001:2023 is a voluntary, certifiable standard for an AI management system. The certificate concerns the organization’s AIMS within its defined scope, not approval of each AI product or a finding that every system meets the EU AI Act. FinTech Global describes the standard’s scope this way.
The standard can help structure work on risk management, data governance and human oversight, areas that FinTech Global says overlap with the Act. But that analysis also distinguishes an AIMS from system-specific regulatory procedures, including conformity assessment, CE marking, registration in the EU database, technical documentation under Annex IV and serious-incident reporting deadlines.
FinTech Global and Legal247 say ISO/IEC 42001 itself does not provide the Article 40 presumption of conformity associated with harmonised standards. Certification therefore does not substitute for assessing the legal duties that apply to a particular system.
Which high-risk systems have 2027 and 2028 dates?
Regulation (EU) 2026/1744 sets different application dates for specified high-risk systems. In both cases, the dates cover Chapter III, Sections 1–3, of the EU AI Act. The amending regulation sets out the routes and dates; the European Commission’s consolidated Article 113 presents the application timetable.
| High-risk classification route | Provisions covered | Apply from |
| Article 6(2) and Annex III | Chapter III, Sections 1–3 | December 2, 2027 |
| Article 6(1) and Annex I | Chapter III, Sections 1–3 | August 2, 2028 |
These dates do not postpone every EU AI Act duty. Article 113 sets separate application dates for other provisions, including AI-literacy requirements that applied from February 2, 2025, and the Act’s general application date of August 2, 2026.
How an AIMS can help with system-level work
An organization can use its AIMS to organize governance practices that are relevant to AI regulation. FinTech Global reports that ISO/IEC 42001 includes an AI system impact assessment addressing effects on individuals, groups and society, with reassessments at planned intervals and after significant changes. It also reports that Annex A contains 38 controls across nine objectives, with a Statement of Applicability recording which controls apply or are excluded and the reasons for exclusions.
For a particular system, identify its applicable high-risk classification route and the organization’s role, then assess the duties that follow from those facts. The scope of an ISO/IEC 42001 certificate answers a separate question: which parts of the organization’s AI management system were certified.
