For most of the last decade, AI governance meant a page of ethical principles nobody outside the legal team read. That era is over. Applied AI governance now means translating binding law and auditable management systems into day-to-day software development, procurement, and risk-monitoring pipelines — with real financial exposure for getting it wrong.
Two frameworks are particularly relevant to organizations operating in the EU: the EU AI Act, which is binding law, and ISO/IEC 42001, a voluntary, certifiable standard for establishing and operating an Artificial Intelligence Management System (AIMS). Understanding how they divide labor — one as the rulebook, one as the engine — is a useful starting point for moving from "we have an AI policy" to "we have a repeatable system for managing AI risks and demonstrating how we do it."
The EU AI Act: The Rulebook
The EU AI Act is binding EU law with significant international reach. Its scope is broader and more specific than simply "if your AI affects EU citizens, you comply": among other things, it applies to providers placing AI systems or GPAI models on the EU market, EU-based deployers, certain providers and deployers outside the EU where AI output is used in the Union, and other actors including importers, distributors, and relevant product manufacturers.
The Act follows a risk-based structure, with rules addressing prohibited AI practices, high-risk AI systems, transparency obligations for certain AI systems, and general-purpose AI models.
Unacceptable Risk (Prohibited Practices). The Act prohibits specified AI practices under Article 5. The prohibitions began applying on 2 February 2025, while enforcement powers for the applicable provisions began on 2 August 2026.
Among the prohibited practices are:
- AI systems using subliminal techniques or purposefully manipulative or deceptive techniques that materially distort behaviour and cause, or are reasonably likely to cause, significant harm
- AI systems exploiting vulnerabilities linked to age, disability, or a specific social or economic situation in ways that materially distort behaviour and cause, or are reasonably likely to cause, significant harm
- Certain emotion-recognition systems used in workplaces and educational institutions
- Certain biometric categorisation practices and real-time remote biometric identification in publicly accessible spaces for law enforcement, subject to tightly defined exceptions and safeguards
- AI systems used for certain prohibited social-scoring and predictive-policing practices
From 2 December 2026, additional prohibitions cover AI systems that generate or manipulate certain non-consensual intimate material and child sexual abuse material.
The important distinction is that not every system performing a superficially similar function is automatically prohibited: the legal definitions, purpose, context, safeguards, and specific exceptions matter.
High Risk (Heavily Regulated). High-risk AI systems include certain systems used in areas such as employment, education, critical infrastructure, biometrics, and access to essential services. Depending on the category, the Act imposes requirements around risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness, and cybersecurity.
Following the 2026 AI Omnibus (see also the Commission's implementation timeline, the rules for high-risk systems in the relevant Annex III use cases apply from 2 December 2027, while high-risk AI embedded in regulated products covered by the relevant Annex I provisions has an extended transition until 2 August 2028. That additional runway does not remove the prohibitions that are already applicable.
Transparency Obligations. Certain AI systems are subject to Article 50 transparency requirements. From 2 August 2026, providers of systems that directly interact with people generally have to ensure people are informed that they are interacting with AI, subject to the Act's conditions and exceptions. Other obligations cover machine-readable marking of certain AI-generated content and disclosure of deepfakes, certain AI-generated public-interest text, and exposure to emotion-recognition or biometric-categorisation systems.
General-Purpose AI (GPAI). GPAI models are regulated under a separate set of provisions covering matters such as technical documentation, information for downstream providers, copyright policies, and — for models presenting systemic risk — additional evaluation, risk assessment, incident reporting, and cybersecurity obligations. The GPAI rules became applicable on 2 August 2025.
Non-compliance with the Article 5 prohibitions can attract administrative fines of up to €35,000,000 or, for an undertaking, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher. That maximum percentage is higher than GDPR's maximum percentage-based fine — though the two regimes differ in scope, enforcement structure, and penalty provisions, and the €35M/7% figure is specific to Article 5 violations, not a blanket figure for any AI Act non-compliance.
ISO/IEC 42001: The Engine
Where the EU AI Act establishes binding legal requirements, ISO/IEC 42001 provides a certifiable management-system framework for governing AI-related risks and opportunities.
The standard specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS). It is designed to give organizations a structured way to establish policies, objectives, processes, controls, and continual-improvement mechanisms around the responsible development, provision, and use of AI.
The framework can support areas such as:
- AI Policy & Objectives — establishing organizational policies, objectives, responsibilities, and governance mechanisms for AI
- Risk & Impact Management — identifying, assessing, treating, and monitoring AI-related risks and opportunities
- Lifecycle Governance — establishing controls and processes that can apply across the lifecycle of AI systems
- Data and System Controls — addressing relevant data, technical, operational, transparency, and accountability considerations
- Continual Improvement — monitoring the management system, auditing it, addressing nonconformities, and improving it over time
Critically, ISO/IEC 42001 is voluntary and does not itself prohibit AI practices or create legal obligations. It provides a management-system framework through which an organization can identify applicable legal and regulatory requirements and build processes for managing them. It is also, as of this writing, not a harmonized standard under the EU AI Act — meaning certification against it does not by itself create a legal presumption of conformity with the Act.
Certification is also scoped: an ISO/IEC 42001 certificate demonstrates that an independent certification body has assessed the organization's AIMS within a defined certification scope; it does not automatically certify every AI system the organization operates or establish that the organization complies with every applicable law.
Law vs. Standard: The Direct Comparison
Consider these as parallel tracks rather than competing rules:
- The EU AI Act is binding EU legislation. It establishes legal prohibitions, requirements, transparency obligations, governance mechanisms, and enforcement measures for actors and systems within its scope.
- ISO/IEC 42001 is a voluntary, certifiable management-system standard. It provides a structured way for an organization to establish, operate, audit, and continually improve its AI governance processes.
The two are not interchangeable. ISO/IEC 42001 certification does not itself constitute compliance with the EU AI Act, but its governance processes and evidence can support an organization's broader compliance program. Some AI Act obligations are highly specific — applicable high-risk systems may require conformity assessment, technical documentation, logging, human oversight, and other controls that cannot simply be replaced by an ISO certificate.
The practical relationship is complementary rather than equivalent: the Act defines binding requirements, while ISO/IEC 42001 can provide management infrastructure for organizing and demonstrating how an organization governs AI risks.
Why Companies Are Certifying Now
The honest question many leaders ask is: if ISO/IEC 42001 is voluntary and doesn't itself carry legal force, why are companies certifying against it in 2026?
The market evidence points to a few practical, and more modest, drivers than the "guaranteed competitive edge" framing sometimes used to sell certification services.
It's increasingly relevant to procurement and due diligence. Enterprise buyers and customers are asking vendors for independently verifiable evidence of AI governance, and ISO/IEC 42001 certification can provide one standardized form of that evidence. That does not make certification a universal procurement requirement, but it can become a useful differentiator or due-diligence artifact in some buying processes.
It can support AI Act readiness. ISO/IEC 42001 does not satisfy EU AI Act obligations by itself, but the management processes, risk assessments, governance records, responsibilities, and evidence developed within an AIMS can support an organization's wider compliance program and reduce unnecessary duplication. The key word is support: specific AI Act requirements still need to be addressed directly.
Certification provides independent evidence. An organization can describe its AI governance internally, but certification adds an independent assessment against the standard within a defined scope. For customers and procurement teams, that can make governance claims easier to evaluate.
It can reduce procurement friction where customers already ask for formal governance evidence — though the commercial impact varies by market, buyer, product, and certification scope, and it does not follow automatically that certification shortens sales cycles across the board.
This is why major technology vendors — AWS (the first major cloud provider to certify, November 2024, covering Amazon Bedrock, Amazon Q Business, Amazon Textract, and Amazon Transcribe), Microsoft (Azure AI Foundry Models and Microsoft Security Copilot, with Microsoft 365 Copilot certified separately), Pega (Pega Cloud, Pega GenAI, and predictive/adaptive analytics capabilities, announced February 2026), and others including Oracle and Salesforce — have each achieved ISO/IEC 42001 certification for defined scopes of their own products. The pattern is now broad enough across major vendors that independently assessed AI governance is becoming a standard commercial artifact, even though none of it is legally mandated.
A related, distinct development worth noting: alongside organizational certification, individual professional certification in AI governance is also emerging as its own category. Bodies such as the Global AI Certification Council now offer practitioner-level credentials — AI governance, ISO/IEC 42001 implementation, and AI law and compliance among them — aimed at the people who build and audit these management systems, rather than at the organizations themselves. That is a different thing from a company earning ISO/IEC 42001 certification for a product or service, but it points in the same direction: AI governance is becoming a defined professional discipline, not just a policy document.
What Applied Governance Looks Like Day to Day
Mature organizations don't need to treat the Act and the standard as separate compliance tracks. A practical governance program can map legal requirements and organizational risks onto an ISO/IEC 42001 management system, while keeping the specific legal requirements of the AI Act visible.
In practice, the Act sets what must be met where it applies, and the management system makes it repeatable and auditable. The four outcomes in the diagram are where that shows up most visibly; the building blocks below are how an organization gets there. Data governance and human oversight are explicit AI Act requirements for high-risk systems, so scale them to the risk tier rather than applying them uniformly.
Concrete building blocks can include:
- An AI Registry/Inventory — a living record of AI systems in use, their purpose, relevant regulatory classification, ownership, and lifecycle status
- Risk Triage — systematic classification against Article 5, Article 50, Annex III, GPAI, and other applicable requirements as new systems come online
- AI Impact and Risk Assessments — documented evaluation of potential risks before deployment, including Fundamental Rights Impact Assessments where the AI Act specifically requires them
- Continuous Monitoring — ongoing oversight after deployment, with post-market monitoring and other monitoring obligations applied where the Act specifically requires them
- Evidence and Documentation — maintaining the records needed to demonstrate governance decisions, controls, assessments, testing, monitoring, and remediation
The distinction matters. An enterprise-wide AI inventory or generic algorithmic impact assessment can be sensible governance practices, but neither should be presented as a universal requirement imposed by the AI Act — they're good practice, not a legal mandate in every case.
The Takeaway
The EU AI Act establishes the legal requirements; ISO/IEC 42001 can provide an operational management structure for governing AI risks and demonstrating how an organization manages them.
For operations and program leaders, the practical move isn't choosing between "compliance" and "certification." It's building one coherent AI governance function that maps applicable legal obligations into repeatable operational processes — and uses independent certification where it creates meaningful value.
The rulebook and the engine do different jobs. The value comes from making sure they work together.
---
A note on sources: this piece reflects my own synthesis and point of view on applied AI governance, not legal advice. The legal scope, risk categories, dates, and penalty figures referenced above are drawn directly from the official text of Regulation (EU) 2024/1689, the European Commission's AI Act page, and the vendor and standards-body sources linked throughout, and are cited accordingly. Where a statement is my own interpretation or recommendation rather than a direct statement of law or standard, I've tried to make that distinction clear. If you are making compliance decisions for your organization, please consult qualified legal counsel.