ISO/IEC 42001 to EU AI Act mapping: a clause-by-article crosswalk

ISO/IEC 42001:2023, published in December 2023, specifies requirements for an artificial intelligence management system (AIMS). It follows the standard ISO management-system structure (Clauses 4-10) and is designed to coexist with ISO 9001 quality, ISO 27001 information security, and ISO 27701 privacy management systems. The standard's Annex A defines nine control objectives and 38 specific controls covering AI policies, internal organisation, resources, impact assessment, lifecycle, data management, third-party use, and end-user information [1].

The standard does not prescribe technical AI methods. It prescribes the management system that surrounds the AI work: how an organisation sets policy, allocates roles, identifies AI risks, manages data, controls the lifecycle, communicates with users, and improves over time. The certification is awarded by an accredited certification body and attests that the management system meets the standard's requirements.

For AI Act preparation, ISO 42001 matters because the Act's organisational obligations - quality management system under Article 17, data governance under Article 10, post-market monitoring under Article 72, transparency under Article 13 - all map to ISO 42001 clauses or controls. A vendor that holds 42001 certification has built the management system the Act expects. The Act's product-level obligations - per-system conformity assessment, technical documentation, registration in the EU database - are still separate work the standard does not certify.

The standard follows the standard ISO Harmonized Structure. Clause 4: Context. Understand the organisation and stakeholders, scope of the AIMS. Clause 5: Leadership. Top-management commitment, AI policy, roles and responsibilities. Clause 6: Planning. Actions to address risks and opportunities, AI objectives, AI impact assessment. Clause 7: Support. Resources, competence, awareness, communication, documented information.

Clause 8: Operation. Operational planning and control, AI risk treatment, AI system impact assessment, third-party relationships. Clause 9: Performance evaluation. Monitoring, measurement, analysis, internal audit, management review. Clause 10: Improvement. Nonconformity, corrective action, continual improvement.

Annex A contains the nine control objectives: A.2 policies related to AI, A.3 internal organisation, A.4 resources, A.5 assessing impacts, A.6 AI lifecycle, A.7 data, A.8 information for interested parties, A.9 use, A.10 third-party and customer relationships [2]. Each objective has 2-7 specific controls.

ISO 42001 Clause 6.1 requires the organisation to identify AI risks, analyse them, evaluate them, and plan actions to address them. Clause 6.1.4 specifically requires an AI system impact assessment that considers the system's potential consequences for individuals, groups, and society. This maps directly to AI Act Article 9, which requires a risk-management system established and documented across the lifecycle, identifying and analysing known and reasonably foreseeable risks, estimating and evaluating risks under intended use and reasonably foreseeable misuse, and adopting risk-management measures.

The 42001 impact assessment, when scoped to a specific high-risk system, can serve as the documentation backbone for the Article 9 risk-management file. The same applies to AI Act Article 27's fundamental rights impact assessment for deployers - 42001 Clause 6.1.4 plus Annex A.5.2 (AI system impact assessment) gives the procedural structure, with the FRIA's specific content layered on top [3].

ISO 42001 Annex A.7 covers the data lifecycle. A.7.2 requires data for AI systems to be acquired, prepared, and managed in alignment with the AI policy and intended purpose. A.7.3 requires data quality management. A.7.4 requires the provenance of data to be documented. A.7.5 requires data preparation methods to be documented. A.7.6 covers protection of personal data within the AIMS, coordinated with the privacy management system.

AI Act Article 10 requires training, validation, and testing data sets to be subject to data governance and management practices appropriate to the intended purpose, addressing relevant design choices, data collection processes and origin, data preparation operations such as annotation, labelling, cleaning, updating, enrichment, aggregation, formulation of assumptions, examination in view of possible biases, identification of data gaps or shortcomings, appropriate measures to detect, prevent, and mitigate possible biases.

The mapping is direct: A.7.2 covers the design-choice and origin work, A.7.3 covers preparation and quality, A.7.4 covers provenance, A.7.5 covers labelling and cleaning, and the bias-evaluation work needs an additional control or procedure beyond what 42001 explicitly requires. Most certified organisations layer a separate bias-evaluation procedure on top of A.7 to close this gap.

AI Act Article 14 requires high-risk systems to be designed and developed in such a way that they can be effectively overseen by natural persons during the period in which they are in use. The oversight measures must enable individuals to understand the relevant capacities and limitations of the system, remain aware of automation bias, correctly interpret the system's output, decide not to use the output or override it, and intervene or stop the system through a stop button or similar procedure.

ISO 42001 covers the management-system side of this through Clause 5.3 (roles and responsibilities), Annex A.3.2 (AI roles and responsibilities), Annex A.4.5 (computational resources), and Annex A.6.1.4 (system documentation). The architectural design of human-oversight controls - which decisions the model makes, which the human makes, what the override paths are - is engineering work that 42001 does not specify directly but expects to be covered under Annex A.6 (AI lifecycle). A vendor with 42001 certification has documented who has oversight authority; a vendor with AI Act Article 14 readiness has designed the system so that authority is operationally meaningful.

ISO 42001 Clause 9.1 requires the organisation to determine what needs to be monitored and measured, the methods, the frequency, the analysis, and the evaluation of results. Clause 9.2 requires internal audits at planned intervals. Clause 9.3 requires management review with specific inputs including changes in the external context, performance information, audit results, and improvement opportunities.

AI Act Article 72 requires providers of high-risk systems to establish and document a post-market monitoring system that actively and systematically collects, documents, and analyses relevant data on the system's performance throughout its lifetime. The post-market monitoring plan must enable the provider to evaluate continuous compliance with the requirements of Chapter III, Section 2. Article 73 adds the serious-incident reporting deadlines: 15 days for general serious incidents, 10 days for cases involving death, 2 days for incidents involving widespread infringement.

The mapping: Clause 9.1 plus a system-specific monitoring plan covers most of Article 72. The serious-incident reporting workflow under Article 73 needs an explicit procedure that 42001 does not prescribe in detail but expects to find under Clause 10.2 (corrective action). Most certified organisations operationalise Article 73 as a named procedure with a deadlined escalation path and a designated authority interface [4].

ISO 42001 Annex A.6 covers the AI lifecycle. A.6.1.1 requires the AI lifecycle to be defined and documented. A.6.1.2 covers system documentation throughout the lifecycle. A.6.1.3 covers the AI development, deployment, and operation processes. A.6.1.4 covers system documentation. A.6.2 covers AI system requirements and design.

AI Act Article 11 requires technical documentation drawn up before the system is placed on the market and kept up to date. Annex IV specifies the nine sections: general description, detailed description of elements and development process, monitoring and control, performance metrics, risk management, data and data governance, change management, harmonised standards applied, EU declaration of conformity. The 42001 lifecycle documentation under A.6.1 covers the procedural work for sections 1-4 and 7. Annex IV sections 5 (risk management), 6 (data governance), 8 (standards applied), and 9 (declaration plus post-market monitoring plan) need additional system-specific files that 42001 expects to find under the broader management system.

For procurement, the practical question is whether the vendor can produce the Annex IV pack as a deliverable - templated, customised to the buyer's workload, retained for 10 years. A 42001-certified vendor has the infrastructure to do this. A non-certified vendor can still produce the pack but the procurement risk is higher because there is no third-party attestation that the management system is in place.

Three categories. Per-system conformity assessment. The AI Act requires a documented conformity assessment for each high-risk system before it goes to market, ending in an EU declaration of conformity, CE marking, and registration in the EU database. ISO 42001 certifies the management system, not individual products. The conformity assessment is separate, system-specific work. Prohibited-practice analysis. Article 5 prohibits eight categories of AI practice with criminal-grade penalties. ISO 42001 does not enumerate these prohibitions. Organisations need a specific control or procedure that screens new AI systems against Article 5 before they enter the lifecycle.

Specific transparency obligations under Article 50. ISO 42001 Annex A.8 covers information for interested parties at the management-system level, but the Article 50 requirements for chatbot disclosure, AI-generated content marking, deepfake labelling, and emotion-recognition disclosure to exposed individuals are specific UX-level obligations that need engineering implementation. The standard expects the management system to ensure these are addressed but does not prescribe the detailed implementation.

For the broader AI Act context, see EU AI Act overview, risk classification, and conformity assessment. For the underlying methodology that integrates 42001 work into delivery, see TRACE.