Direct answer: ISO/IEC 42001 is an organisational AI management system standard; the EU AI Act (Regulation (EU) 2024/1689) is law, and the two must be handled separately. If you put your own name or trademark on a third-party AI system, make a substantial modification to a high-risk system, or change a system's intended purpose so that it becomes high-risk, Article 25(1) treats you as a provider with the provider's obligations. On official sources as of October 2026: the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026) moved high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products; the only AI Act harmonised standard published in the Official Journal is EN 18286:2026 (AI quality management system, supporting Article 17; Commission Implementing Decision (EU) 2026/2274, in force 14 October 2026), and its presumption of conformity covers only the requirements it addresses. ISO/IEC 42001 is not a harmonised standard, and certification alone creates no presumption of conformity.
Three common misstatements
| Statement | Correct understanding |
|---|---|
| "ISO 42001 certification means AI Act compliance" | No. ISO 42001 can carry organisational governance, but high-risk obligations, conformity assessment and registration must still be completed under the law |
| "All high-risk obligations apply in 2026" | After amendment, Annex III systems apply from 2 December 2027 and Annex I products from 2 August 2028; Article 50 transparency obligations apply from 2 August 2026 |
| "No harmonised standard has been published" | EN 18286:2026 has been published, supporting the Article 17 quality management system, but it does not cover every obligation |
What to determine when re-purposing or re-branding
| Question | Why it matters |
|---|---|
| Do you put your own name or trademark on it? | Article 25(1)(a): you may be treated as the provider (unless contracts allocate the obligations otherwise) |
| Have you made a substantial modification? | Article 25(1)(b) |
| Have you changed the intended purpose so it becomes high-risk? | Article 25(1)(c); for example use in decisions on staff scheduling and performance must be checked against Annex III |
| What information and assistance can the original provider give? | Article 25(2) requires the original provider to cooperate, except where it has clearly specified that the system is not to be changed into a high-risk system |
What a consultant should deliver
- A record of role and risk classification for each AI system, listing open items where information is missing
- A mapping of ISO 42001 to AI Act obligations: what the management system carries and what must be done separately
- Review rules for external claims, keeping certificate scope and product compliance apart
- Final opinions on legal classification and liability from lawyers
How to accept the work
For any system, you can see the role determination, risk classification, applicable date and open items; marketing and sales claims are reviewed and never say "ISO 42001 equals AI Act compliance".
What cannot be guaranteed
Laws and guidance are still changing; determinations follow official sources on the day of checking, and liability in a specific case is for lawyers to decide.
Winners Consulting's approach
The following describes Winners Consulting's own approach. Please test us with the same questions above, and test other consultants too.
- Who leads: VP- and director-level consultants guide the whole engagement, without outsourcing
- Project rhythm (as listed on our service page): scope and inventory 2–4 weeks, risk and impact assessment 3–5 weeks, system build 6–10 weeks, audit and certification 4–8 weeks; organisations that already hold ISO 27001 usually reach certification in 4–6 months, from scratch about 6–9 months
- Division of roles: we build the system and the evidence chain; legal opinions come from partner lawyers; certification is carried out by a certification body accredited under ISO/IEC 42006, which we accompany but do not stand in for
- Completed work (anonymous, under a non-disclosure agreement): an industrial automation manufacturer built an AI system inventory, completed AI risk classification, established algorithm review and human oversight for high-risk uses, and obtained ISO 42001 certification
Related questions
- Does ISO 42001 certification mean compliance with the EU AI Act? No. ISO/IEC 42001 is not an AI Act harmonised standard and certification alone creates no presumption of conformity; as of October 2026, the only published harmonised standard is EN 18286:2026. How to choose an EU AI Act consultant in Taiwan
- If we sell someone else's AI system in the EU under our brand, do we become the provider? Possibly. Under Article 25(1), putting your name or trademark on it, making a substantial modification or changing the intended purpose so it becomes high-risk can each make you the provider. EU AI Act consulting
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.