"Our customers ask us for ISO 42001, and our AI screens candidates. Does that make us compliant with the AI Act?"
They are two standards for two questions. ISO/IEC 42001 sets out how an organisation governs its AI. EN 18286 sets out how a high-risk AI product is made. They are easier to understand together, and with a case.
ISO 42001 and EN 18286, question by question
- What for
- ISO/IEC 42001For processes: how the organisation governs all the AI it uses or develops.
- EN 18286For the product: the high-risk AI system placed on the market.
- Who for
- ISO/IEC 42001For those who deploy AI and those who produce it: any organisation that uses, develops or offers it, high-risk or not, in any market.
- EN 18286Only for those who produce it: the provider of a high-risk system, which is who Article 17 applies to.
- Shown to whom
- ISO/IEC 42001An accredited certification body. Customers, boards and tenders ask for the certificate.
- EN 18286The product's conformity assessment, carried out by the provider or by a notified body depending on the system.
- Since when
- ISO/IEC 42001In force since December 2023. Its European version, with the same text, since March 2026.
- EN 18286Published by CEN in July 2026 and cited in the OJEU on 14 October 2026. Article 17 applies to Annex III high-risk systems from 2 December 2027.
- Presumption of conformity
- ISO/IEC 42001None, even with an EN version: it was not prepared for the AI Act.
- EN 18286Cited in the OJEU since 14 October 2026. According to the AI Office, applying it gives presumption of conformity with what it covers of Article 17.
- What they share
- Both are management systems: policy, responsibilities, objectives, resources, documented information and management review. They are built once.
- How they fit together
- EN 18286 organises how the high-risk system is built; ISO 42001, how the organisation uses it in its processes. ISO 42001 is not a prerequisite for EN 18286: it can be built on another management system or as the first one.
A case: a full-stack HR company
An HR company does everything. It builds its own AI, uses it to select candidates and presents the candidates that come out of that process to its customers. The AI publishes job offers on its website and targets them at the right profiles, analyses incoming applications, filters them and ranks the candidates for each vacancy. For the candidates, it also runs a transparency portal.
As provider: its AI, under EN 18286
Placing targeted job advertisements, analysing and filtering applications and evaluating candidates is, almost word for word, the first employment use case in Annex III, point 4(a): high-risk AI. The company built it and puts it into service under its own name, so it is its provider, and Article 17 requires a quality management system for that product.
That is where EN 18286 comes in, built around the product rather than the organisation. It walks through what the system needs: design and development, verification and validation, data management, post-market monitoring, serious incident reporting and change control. For an employment system, the conformity assessment is the internal control of Annex VI: the company itself verifies that its quality management system meets Article 17, and the market surveillance authority can ask for the evidence.
As user: the selection, within ISO 42001
The same company uses its AI to decide which candidates it presents to each customer, so it is also its deployer. That use is an organisational process, and ISO 42001 is the standard that organises it: who oversees what the system proposes, what risks the selection carries for candidates and for the business, what happens when someone complains, and how the company checks that everything works as decided.
It is also what its customers look at. They receive candidates, they do not use the system, and they want to know that the process that selected them can be trusted. The ISO 42001 certificate shows them that.
For the candidates: a transparency portal
The candidates are the people affected. The portal tells them that an AI takes part in their selection, what it does and how to ask for a person to review their case. It answers the AI Act and ISO 42001 at once. As deployer, the company has to inform the people the system decides on or helps decide on (Article 26(11)), and Article 86 gives them a right to an explanation of decisions that significantly affect them. ISO 42001 covers it among its controls as information for interested parties.
What they share and how they fit together
The company builds one system for both standards. The final draft of EN 18286 submitted to formal vote (FprEN 18286, May 2026), which is the text we have read, also includes a table mapping it to ISO 42001 clause by clause. What changed between the enquiry draft and the published text is summarised here. The same goes for anyone who already runs their sector's quality system, such as ISO 13485 for medical devices: Article 17(3) lets them integrate what the AI Act asks into it, without running a parallel one.
The ISO 42001 certificate answers customers; the product's quality management system and its technical file answer the authority; the portal answers the candidates. None replaces the others.
One piece is left to fit: risk. In the draft's table, the risk part of the quality management system carries the note "Subject to use of a risk management system compliant with Article 9" (FprEN 18286, Annex ZA, Table ZA.1). The European standard for Article 9, prEN 18228, was not approved at enquiry and is back with its working group. In the meantime, the method is the ISO/IEC 23894 guidance.
What the citation gives, and where to start
Since 14 October 2026, EN 18286 has been cited in the Official Journal (Implementing Decision (EU) 2026/2274). It is the first harmonised standard under the AI Act. According to the AI Office, applying it gives presumption of conformity with what it covers of Article 17. EN ISO/IEC 42001:2026 is the 2023 ISO text adopted in Europe, and the EN prefix does not turn it into a route to presumption.
If you place a high-risk system on the market and already have ISO 42001, build EN 18286 on top of it, using the correspondence table as a guide. If you do not, you can start directly with EN 18286. What EN 18286 asks for and who it applies to.
The status of each requirement and its standard is in the high-risk pillar table.
Proof, not promises.
— Rodrigo
