Does ISO 42001 certification mean we comply with the EU AI Act?

No. ISO/IEC 42001 is an AI management system standard that independent certification bodies can certify against, but it is not a harmonised standard under the EU AI Act, so certification gives no presumption of conformity under Article 40(1). As of October 2026 the only AI Act harmonised standard cited in the Official Journal is EN 18286:2026 (AI quality management system, supporting Article 17; Commission Implementing Decision (EU) 2026/2274, in force since 14 October 2026).

How high are EU AI Act fines?

Breaching the Article 5 prohibitions: up to EUR 35 million or 7% of total worldwide annual turnover for the preceding financial year; breaching obligations of providers, deployers, importers, distributors and others, including Article 50 transparency: up to EUR 15 million or 3%; supplying incorrect information in reply to a request: up to EUR 7.5 million or 1%; in each case whichever is higher. For SMEs, each fine is capped at whichever of the two is lower (Article 99).

If AI causes harm, does the EU AI Act require compensation?

The EU AI Act itself has no civil-liability rules; breaching duties such as human oversight leads to administrative fines. The European Commission has withdrawn its proposed AI Liability Directive (withdrawal published in the Official Journal on 6 October 2025); damage caused by AI is mainly handled under the new Product Liability Directive (EU) 2024/2853, which covers software and AI systems and applies to products placed on the market from 9 December 2026, and under national tort law.

How long does EU AI Act consulting take?

It depends on the number of AI systems and their risk levels; the experience listed on Winners Consulting's service page is usually 6 to 9 months for high-risk AI compliance, and 9 to 12 months when combined with ISO 42001 certification.

How to choose an EU AI Act consultant in Taiwan: eight criteria

Direct answer: the first question to ask an EU AI Act consultant is "what risk level does each of my AI systems fall into, and am I its provider or its deployer?" The EU AI Act (Regulation (EU) 2024/1689) sets obligations by risk: the AI practices prohibited by Article 5(1), points (a) to (h), apply from 2 February 2025 (the Digital Omnibus adds two more points, applying from 2 December 2026); providers of high-risk AI systems must meet requirements on risk management, data governance, technical documentation, record-keeping, human oversight and accuracy, and complete a conformity assessment; and Article 50 sets transparency obligations for AI that interacts with people, for synthetic content and for deep fakes, applying from 2 August 2026. A Taiwanese company with no establishment in the EU is still in scope if it places an AI system on the EU market or if the output of its AI system is used in the EU (Article 2(1)). Next, check that the consultant knows the latest dates: the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) moved the high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products; and that they can explain that ISO/IEC 42001 is not a harmonised standard under the EU AI Act, so certification does not mean legal compliance.

Four roles

Role	Who	Main obligations
Provider	Develops an AI system or general-purpose AI model and places it on the market or puts it into service under its own name	High-risk: Articles 9 to 17, conformity assessment, EU declaration of conformity, CE marking, registration
Deployer	Uses an AI system in the course of its business	High-risk: use according to the instructions, assign competent people to human oversight, keep logs for at least 6 months; certain deployers must carry out a fundamental rights impact assessment
Importer, distributor	Brings a non-EU provider's AI system into, or makes it available on, the EU market	Check that the provider has met its obligations and that marking and documentation are complete
Authorised representative	Representative in the EU appointed by written mandate by a non-EU provider of high-risk AI	Carries out the tasks in the EU mandated by the provider (Article 22)

Eight criteria

Criterion	Question you can ask any consultant
Determining roles	In each AI system, am I the provider, deployer, importer or distributor? On what basis?
Risk classification	Does my system fall under the Article 5 prohibitions, high-risk under Annex I or Annex III, Article 50 transparency, or the Article 6(3) exemption? An Annex III system that profiles natural persons is always high-risk; how is the decision recorded?
Application dates	Which date applies to my system? Annex III systems: 2 December 2027; Annex I Section A products: 2 August 2028; Annex I Section B products such as vehicles, civil aviation and machinery are handled through sector legislation under the amended Article 2(2). Can you tell them apart?
High-risk obligations	What evidence is needed for risk management, data governance, technical documentation, record-keeping, human oversight, and accuracy and robustness?
Conformity assessment route	Does my system go through internal control (Annex VI) or need a notified body (Annex VII)? Do I need an EU authorised representative and registration in the EU database?
Fundamental rights impact assessment	Article 27 requires it only of bodies governed by public law, private entities providing public services, and deployers of credit-scoring or life and health insurance pricing systems. Am I one of them? Can it cross-refer to a data protection impact assessment under GDPR Article 35?
Relationship with ISO/IEC 42001	Which organisational requirements can ISO/IEC 42001 carry, and which legal obligations can it not replace? How does a provider's quality management system map to the harmonised standard already published?
Who leads, and is work subcontracted	Who actually runs the engagement, with what qualifications? Will any of it be subcontracted?

When you may not need a consultant

If your AI systems are not placed on the EU market and their output is not used in the EU, the EU AI Act usually does not apply. If you only use general-purpose generative AI tools for purposes that are not high-risk, the main work is AI literacy measures under Article 4 (amended in July 2026 to "take measures to support the development of AI literacy", with no specific level guaranteed) and internal rules on Article 50 transparency; when you need a judgment on legal liability, consult a lawyer.

How Winners Consulting addresses these criteria

What follows is Winners Consulting's own description. Test us with the questions above, just as you test other consultants.

Roles and risk classification: inventory AI systems across the organisation, determine roles and risk levels, and record the reasoning in the AI system inventory
Three core documents: an AI system inventory; an AI risk and impact assessment (one document that covers Article 9 risk management, the Article 27 fundamental rights impact assessment and the ISO/IEC 42001 risk and impact assessment); and an EU AI Act obligation matrix (each obligation by role, with owner, evidence and due date), with the legal source cited in every column
Classify before spending: plan the most cost-effective route by risk level; an Article 6(3) exemption needs a written assessment and registration, not a verbal judgment
ISO 42001 and the AI Act on one track: use an ISO 42001 management system as the organisational governance backbone and close the gaps article by article against Articles 9 to 17 of the AI Act, shared across AI systems
Technical documentation and conformity assessment: prepare technical documentation and arrange conformity assessment and registration in the EU database
Post-market monitoring: set up post-market monitoring and serious incident reporting, merged into the existing security incident process
Who leads: vice-president and director-level consultants run the whole engagement; nothing is subcontracted

Compliance needs all three; a consultant's value is integration

CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.

Dimension	The question it answers	Typical gap when only this part is done
Process (management system)	Who is responsible, what is done, when, where the evidence is, how it improves	Tools are in place but nobody runs them on schedule, so there are no records at audit time
Security technology	How controls are designed and how their effectiveness is verified	Documents are complete but the systems do not actually do what they describe
Legal compliance	Which regulation applies, which role you hold, the deadlines and penalties	Controls are built against the wrong regulation or role, so obligations are not covered

Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.