ISO 42001 and the EU AI Act for CTOs: what does AI product development need?

What does a CTO decide first: are we the provider or the deployer of each AI system?

A Taiwanese company with no establishment in the EU is still in scope if it places an AI system on the EU market or the system's output is used in the EU (Article 2(1)). For the risk tier, determine whether the system falls under the Article 5 prohibitions, Annex I or Annex III high-risk, Article 50 transparency, or can be excluded under Article 6(3); an exclusion requires a written assessment and registration, not a verbal decision. Determining role and tier is a legal judgement, to be confirmed case by case by legal counsel.

What technical documentation and test evidence does R&D prepare for high-risk AI?

High-risk AI providers must meet requirements on risk management, data governance, technical documentation, record-keeping, human oversight, accuracy and robustness. Test evidence must be traceable; common gaps and what needs to be shown:

The actual testing is done by your engineering team or a third-party test lab; the consultant designs the acceptance requirements and reviews whether the evidence supports the conclusion.

AI product launch timing: which dates and compliance steps go into the R&D plan?

Legal dates (Digital Omnibus, Regulation (EU) 2026/1744, in force from 27 July 2026):

• Article 5 prohibited AI practices: apply from 2 February 2025.
• Article 50 transparency obligations: apply from 2 August 2026.
• Annex III high-risk systems: apply from 2 December 2027.
• Annex I (Section A) products: apply from 2 August 2028.

Compliance steps as listed on the service page (high-risk AI compliance usually 6–9 months, 9–12 months with ISO 42001 certification): AI system inventory and risk classification (1 month) → FRIA and gap analysis (1–2 months) → ISO 42001 management system (2–4 months) → technical documentation (1–2 months) → conformity assessment and EU AI database registration (1–2 months) → post-market monitoring. Annex III systems must be registered in the EU database before being placed on the market.

After every model update, how does R&D show the AI system is still compliant?

Passing acceptance at first launch does not mean the system is still fit for use next month. An AI system's lifecycle includes updates, monitoring and retirement, and the controls must stay effective through every change:

After launch, set up post-market monitoring and a serious incident reporting procedure, which can be merged into the existing security incident process. If a supplier does not announce updates, rely on version detection and contract terms.

Our product has both connectivity and AI: can CRA and AI Act technical documentation be combined?

Partly. When a product is within the CRA and is also a high-risk AI system under the AI Act, Article 12 of the CRA builds a bridge: if the product meets the CRA Annex I essential requirements and the CRA EU declaration of conformity states that the level of cybersecurity protection required by Article 15 of the AI Act is achieved, it is presumed to meet the cybersecurity requirements of AI Act Article 15.

But accuracy and robustness are outside this bridge and must still be handled under the AI Act; the conformity assessment in principle follows AI Act Article 43, with exceptions for important and critical products. The R&D approach: one risk assessment, technical documentation and declaration of conformity cover the cybersecurity parts of both laws; AI risk classification, data governance, human oversight and accuracy validation are prepared separately.

A customer asks for ISO 42001 certification: can it replace EU AI Act compliance?

No. ISO/IEC 42001 is an AI management system standard that independent certification bodies can certify, but it is not a harmonised standard under the EU AI Act, and certification gives no presumption of conformity; conformity assessment, EU database registration, an authorised representative and Article 50 transparency are legal procedures a certificate cannot replace. As of October 2026, the only AI Act harmonised standard published in the Official Journal is EN 18286:2026 (AI quality management system, supporting Article 17).

For 42001 itself (as listed on the service page): certificates are issued by certification bodies accredited under ISO/IEC 42006, on a three-year cycle with annual surveillance audits; organisations with ISO 27001 usually reach certification in 4–6 months, about 6–9 months from scratch. Your consultant and the certification body that issues the certificate should be two different firms.

How does Winners Consulting help a CTO with ISO 42001 and the EU AI Act?

Vice-president and director-level consultants personally lead the work end to end, never outsourced, so ISO 42001 and the EU AI Act share one set of documents and evidence instead of two parallel systems:

• AI system risk classification diagnosis: clarify where each AI product sits in the four-tier risk framework, then plan the compliance route by risk tier.
• Three core documents: an AI system register, an AI risk and impact assessment, and an EU AI Act obligation matrix (each obligation by role, with owner, evidence and due date).
• Technical documentation and conformity assessment: produce the technical documentation, arrange the conformity assessment and EU database registration, and set up post-market monitoring and serious incident reporting.
• FRIA: FRIA support, and help for providers in preparing the information deployers need to complete their assessment.
• Division of roles: Winners Consulting is a consultant and does not certify.

Go deeper: EU AI Act consulting, ISO 42001 implementation, Choosing an EU AI Act consultant, RAG and model testing evidence, What a CTO builds into the R&D process. Request a free mechanism diagnosis