ISO 42001, the EU AI Act and the work between them

Teams considering AI governance often encounter several frameworks at once. A customer asks about ISO/IEC 42001. A product lead asks whether the EU AI Act applies. An engineer asks which tests are needed before release.

These questions are related, but one answer will not settle all of them.

What the management system contributes

ISO/IEC 42001 sets requirements for an AI management system. It provides a structure for establishing, maintaining and improving the organisation’s approach to AI. ISO/IEC 42001.

In practical work, the organisation needs to establish who is responsible, what is within scope and how decisions and improvements are managed. The system must fit the business well enough that people can operate it after the initial project.

Certification, where pursued, concerns the assessed management-system scope. It should not be presented as a universal product-safety badge or an automatic answer to every legal obligation.

What legal assessment contributes

Legal requirements depend on the activity and circumstances. For the EU AI Act, that includes the system’s purpose, relevant role and territorial scope. Data protection, product rules and sector requirements may raise separate questions.

A governance programme needs a way to identify those obligations and keep them current. It also needs to distinguish a legal conclusion from an assumption awaiting review.

That distinction makes the work easier to manage. Teams can see which tasks address a specific obligation and which are chosen controls or improvements.

What technical evidence contributes

An organisation may have a clear process and still need evidence that a particular system performs suitably for its intended use. Evaluation examines that question.

For a document assistant, the evidence might concern unsupported answers, source traceability and access boundaries. For an embedded system, it may include operating conditions, delayed results and behaviour when sensors or communications fail.

The test needs to match the claim. A model benchmark cannot on its own establish the suitability of the entire application, just as a process document cannot demonstrate a result that has not been measured.

Connect the records around one system

Consider an illustrative internal assistant. Its use-case record describes what staff may do with it. The applicability assessment identifies the relevant obligations. The evaluation record shows what was tested. The release decision states the permitted use and its conditions.

The management system gives those records owners, a review process and a way to address changes or problems. The connections matter more than the number of separate documents.

If a supplier introduces a different model, the organisation should be able to find the affected assessment and evaluation without starting from scratch.

Build on information security

Many organisations already have information-security processes for access, suppliers, incidents and changes. ISO/IEC 27001 concerns information-security management; those processes can provide a useful foundation, but AI-specific questions still need attention. ISO/IEC 27001.

For example, an application may protect data from unauthorised access while still producing unreliable outputs. Security evidence and task-performance evidence address different concerns. Both can matter to the same release decision.

Review existing processes before adding new ones. Decide what can be shared, what needs extending and what needs a distinct record.

Choose the next step for a reason

If the organisation has no clear view of AI use, begin with the uses and owners. If a customer needs assurance about one product, begin with that product’s evidence. If several teams need a consistent operating approach, management-system development may be the right organising project.

Certification can be a useful objective when it serves an identified need. It should sit within a programme that also produces better decisions and maintainable controls.

The practical test is whether the organisation can explain what it is doing, show the evidence relevant to a particular use and respond when circumstances change.

Next step: Read UK and EU AI governance: a working map, or discuss a focused governance review with Beeston Labs.