ISO/IEC 42001: why you should set up an AI management system now, precisely because the AI Act has been postponed

Since the Digital Omnibus on AI entered into force on 27 July 2026, the high-risk obligations of the AI Act apply only from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). That feels like plenty of time. Yet this is precisely the moment to set up an AI management system. Not because the law already requires it, but because you now have the time to do it properly. The standard for this has existed since December 2023: ISO/IEC 42001.

In this article you will read what ISO/IEC 42001 is, who it is useful for, how it relates to the AI Act and ISO 27001, and how to start pragmatically.

What is ISO/IEC 42001?

ISO/IEC 42001:2023 is the first international, certifiable management system standard for artificial intelligence. The standard describes how an organisation establishes, implements, maintains and improves an AI management system (AIMS). It is about the organisation around AI, not about the technology itself: policy, roles, risks, life cycle and oversight.

Anyone familiar with ISO 27001 or ISO 9001 will recognise the structure immediately. ISO/IEC 42001 follows the Harmonized Structure, with the same clauses 4 to 10: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. The standard also contains two annexes:

Annex A with 38 controls in 9 objective areas, including AI policy, roles and responsibilities, resources, impact assessment, life cycle management, data, information for interested parties, use of AI systems and third-party relationships.

Annex B with implementation guidance for those controls.

The essence in five points

1.AI policy: what may your organisation do and not do with AI, and who decides?

2.Risk and impact assessment: in addition to the usual risk analysis, the standard requires an AI impact assessment, focused on the consequences for individuals and society.

3.Roles and responsibilities: who owns which AI system and who provides oversight?

4.Life cycle management: from design and procurement to use, monitoring and decommissioning.

5.Transparency and third parties: what do you tell users, and how do you control AI that you procure from suppliers?

Who is ISO/IEC 42001 useful for?

The standard is not only intended for companies that build AI models themselves. In practice, three groups benefit most:

Providers of AI solutions, such as software companies and SaaS vendors, who want to show customers and regulators that their AI is developed and maintained in a controlled way.

Organisations that use AI intensively, for example in HR, customer contact, financial assessment or healthcare, where the impact on people is significant.

Organisations with an existing ISO 27001 management system that want to add AI governance without building a second, separate system.

Certification is optional. Many organisations first use the standard as a framework and let certification depend on what customers and tenders require.

The relationship with the AI Act

The key difference: the AI Act is law, ISO/IEC 42001 is a voluntary standard. A certificate therefore does not automatically mean that you comply with the AI Act. The harmonised European standards that do provide that presumption of conformity are still under development at CEN-CENELEC (JTC 21).

Nevertheless, ISO/IEC 42001 covers a large part of the governance requirements of the AI Act: risk management, documentation, human oversight, data governance and transparency. Those who set up the management system now will have a working structure by the end of 2027 into which only the specific high-risk requirements still need to be fitted.

And do not forget: part of the AI Act already applies. The transparency obligations (Article 50) have been in force since 2 August 2026, and the AI literacy obligation (Article 4) since February 2025. Both topics appear in ISO/IEC 42001 as controls. You can read more about the new timeline in our article on the Digital Omnibus.

The relationship with ISO 27001

Because both standards follow the same structure, they combine well into one integrated management system. Many controls overlap: access management, logging, supplier management, incident handling and awareness. You do not need to set these up again. You extend them with the AI-specific elements: the impact assessment, the AI register and the controls for the life cycle of AI systems.

A pragmatic approach in six steps

1.AI inventory. Record which AI systems you develop, procure or use, including AI embedded in existing software. Note the owner, purpose and supplier.

2.Scope and policy. Determine which parts of the organisation and which AI systems fall under the management system, and establish an AI policy.

3.Risk and impact assessment. Assess, per system, the risks to the organisation and the impact on individuals and society.

4.Select and integrate controls. Select the relevant controls from Annex A and link them, where possible, to your existing ISO 27001 controls.

5.Awareness and AI literacy. Train employees who work with AI and record who has completed which training.

6.Measure and improve. Monitor effectiveness, carry out internal audits and improve where necessary. Certification is the optional final step.

How uComply helps

In uComply you do not set up ISO/IEC 42001 as a separate project, but as an additional standard alongside your existing management system.

ISO/IEC 42001 as a second or third standard: activate the standard in the same environment as ISO 27001. You link existing controls to multiple standard requirements; the gap analysis immediately shows which Annex A controls are already covered and where work remains.

AI register: record AI systems with owner and risk classification and link the identified risks per system. The inventory thus immediately forms the basis for the risk and impact assessment.

ISO/IEC 42001 Content Pack: ready-made controls, risk analysis templates and policy documents for AI governance as a starting point.

Flightdeck: the dashboard shows progress per standard, so you can see how far your AI management system has come alongside your other standards.

Responsible AI in practice: the uComply Bot runs entirely within your own Microsoft 365 tenant, only has access to your own compliance data and is available to internal users only. This is how we ourselves apply what ISO/IEC 42001 asks of organisations.

Summary

The postponement of the high-risk obligations to 2 December 2027 gives organisations time. ISO/IEC 42001 offers a certifiable and familiar framework to make good use of that time: the same structure as ISO 27001, supplemented with AI-specific controls such as the impact assessment and the AI register. Those who start now will have a working management system by the end of 2027 instead of a pile of loose documents.

Would you like to see how to link ISO/IEC 42001 to your existing ISO 27001 environment? Book a free demo or view our pricing.