EU AI Act vs ISO 42001: do you need both?

It's the question every AI-building team asks once both land on the radar: is the EU AI Act the same as ISO 42001, and do we need both? Short answer — they're different things that reinforce each other, and doing them together is far less work than doing them apart.

Different instruments, same instincts

The EU AI Act is a regulation: binding law, risk-tiered obligations, conformity assessments and real penalties. ISO/IEC 42001 is a voluntary, certifiable management-system standard (an AIMS) — you build a governance system for AI and an accredited body certifies it. One is compulsory where it applies; the other is a credential you choose. But both push the same instincts: know your AI systems, assess their impact, put human oversight and risk management around them, and keep evidence you're doing so.

Where they overlap — and where they don't

ISO 42001's Annex A controls (AI policy, roles, impact assessment, lifecycle, data, third parties) map cleanly onto a large slice of the Act's governance expectations — Articles 9, 10, 14 and 17 especially. What ISO 42001 doesn't give you are the Act's hard legal specifics: the prohibited-practice screen, conformity assessment, CE marking, EU-database registration and the Fundamental Rights Impact Assessment. So ISO 42001 is a strong foundation, not a substitute.

Do the work once

The practical answer: if you're serious about AI governance, ISO 42001 is a great way to build the management system, and the EU AI Act is the law you then have to meet on top. Compliance One cross-maps the two, so the controls and evidence you produce for one count toward the other — you capture a piece of evidence once and it satisfies every framework it maps to. That's the whole point of running them on one platform instead of two projects.