Tracker · updated as this changes
ISO/IEC 42001 and AI laws: what certification covers.
ISO/IEC 42001 is a management system standard, not a law. Much of what is published about it still describes the AI rules as they stood in 2024. Two of the biggest have since changed: Colorado replaced its AI Act in May 2026, and the EU moved its high-risk deadlines in July 2026. Here is where each rule stands, and what certification does and does not do against it.
Last verified October 14, 2026 · Not legal advice
Where each rule stands
| Rule | Status | How ISO/IEC 42001 relates |
|---|---|---|
| ISO/IEC 42001:2023 | Published December 18, 2023. First edition, still current; no amendment published. | The certifiable standard for an AI management system. |
| EU AI Act (Regulation (EU) 2024/1689) | In force since August 1, 2024. Prohibited practices apply from February 2, 2025; general-purpose AI model obligations from August 2, 2025; most transparency obligations from August 2, 2026. After the 2026 Digital Omnibus, high-risk obligations start December 2, 2027, for Annex III uses and August 2, 2028, for AI in regulated products. | Not a harmonized standard under the Act. Certification gives no presumption of conformity, but builds much of the management structure the Act expects. |
| EU harmonized standards | CEN and CENELEC published EN 18286:2026, a quality management system standard supporting the Act's Article 17, in July 2026. As far as we can find, it had not yet been cited in the Official Journal as of October 14, 2026, which is the step that creates a presumption of conformity. | The route to a presumption of conformity runs through cited harmonized standards such as EN 18286, not through ISO/IEC 42001 certification. |
| NIST AI Risk Management Framework | Version 1.0 released January 26, 2023; a generative AI profile followed on July 26, 2024. NIST says the framework is being revised under the White House AI Action Plan. | A voluntary framework, not certifiable. Complements ISO/IEC 42001 well. |
| Texas Responsible AI Governance Act | In force since January 1, 2026. A business is protected from liability in some cases if it finds a violation itself, for example through internal review or testing, and substantially complies with NIST's AI framework or another nationally or internationally recognized AI risk management framework. | Does not name ISO/IEC 42001. Whether your program qualifies is a question for counsel. |
| Colorado | The 2024 AI Act (SB 24-205), which never took effect, was repealed and replaced by SB 26-189, signed May 14, 2026, and effective January 1, 2027. The new law drops the mandatory risk management program and focuses on notices and human review for automated decisions. | The old law's reference to ISO/IEC 42001 is gone. Pages that still describe it as a Colorado safe harbor are out of date. |
| Federal | A December 11, 2025, executive order sets out a national AI policy framework and directs a task force to challenge state AI laws. An executive order cannot by itself overturn state law. | No federal requirement for ISO/IEC 42001. State laws still apply. |
| Certification bodies | ISO/IEC 42006, published July 7, 2025, sets extra requirements for bodies that certify AI management systems. ANAB has accredited certification bodies for ISO/IEC 42001 since 2024. | Choose an accredited certification body, and ask which accreditation covers its certificates. |
What certification proves, and what it does not
It proves
- You have an AI policy, defined roles, and an inventory of the AI systems in scope.
- You assess AI risks to the organization and AI impacts on people before systems go live.
- You have decided which of the 38 Annex A controls apply, and an independent auditor has seen them working.
- You audit and review the system yourself, and fix what you find.
It does not prove
- That you comply with any particular law, including the EU AI Act.
- That any specific AI system is accurate, fair or safe.
- That a customer's own AI requirements are met, unless you scoped the system to meet them.
That gap is not a weakness of the standard. It is what a management system is: the way you make and evidence decisions, which is exactly what customers and regulators ask to see. If you want to build one, see our ISO 42001 consulting. If you already hold ISO 27001, it extends the system you have.
Common questions
Does ISO/IEC 42001 certification make us compliant with the EU AI Act?
No. ISO/IEC 42001 has not been cited in the EU's Official Journal as a harmonized standard under the AI Act, so certification does not create a presumption of conformity with the Act. It does build much of the management structure the Act expects, including risk management, documentation and human oversight, which makes a legal compliance program easier to run and to evidence.
Does any US law require ISO/IEC 42001?
Not as of October 14, 2026, as far as we can find. Colorado's 2024 AI Act named ISO/IEC 42001 as one of the frameworks a risk management program could follow, but that law was repealed and replaced in May 2026 by a narrower law that drops the mandatory risk management program. Texas's AI law protects a business from liability in some cases if it finds a violation itself and substantially complies with NIST's AI framework or another nationally or internationally recognized AI risk management framework; it does not name ISO/IEC 42001. Whether a particular program qualifies is a question for your counsel.
Then why would a US company certify to ISO/IEC 42001?
Mostly because customers ask. Enterprise procurement, security reviews and supplier assessments increasingly ask how a vendor governs AI, and an accredited certificate answers that in a form buyers recognize. It also gives you a working system for deciding which AI uses are acceptable, which is useful whatever the law ends up requiring.
Is the 2023 edition still current?
Yes. ISO/IEC 42001:2023 is the first and current edition, and no amendment had been published as of October 14, 2026. Related standards continue to arrive: ISO/IEC 42005 on AI system impact assessment in 2025, and ISO/IEC 42006 on the bodies that certify AI management systems in July 2025.
Is this legal advice?
No. This page summarizes what published sources say about each rule and how the standard relates to it. We are management system consultants, not lawyers. For decisions about whether a specific law applies to you, talk to your counsel.
Sources
- IEC webstore, ISO/IEC 42001:2023 — publication date, edition, scope.
- ISO, ISO/IEC 42006:2025 — requirements for bodies certifying AI management systems.
- Orrick, July 29, 2026 — the Digital Omnibus changes to EU AI Act dates.
- Law & Technology, July 2026 — why ISO/IEC 42001 certification is not a presumption of conformity.
- CEN-CENELEC, July 2026 — publication of EN 18286.
- NIST, AI Risk Management Framework — release dates and revision status.
- Future of Privacy Forum, March 2026 — how US laws reference the NIST AI RMF and ISO/IEC 42001.
- Texas Legislature, HB 149 (enrolled) — the Texas Responsible Artificial Intelligence Governance Act, Sec. 552.105(e).
- Finnegan, May 26, 2026 — Colorado SB 26-189.
- Baker Botts, January 2026 — the December 2025 executive order.
If any of this has moved since we last checked, tell us and we will correct it the same day.