The Certificate and the Shield: Where ISO/IEC 42001 Meets the EU AI Act, and Where It Stops
Abstract
A supplier holds a certificate, is proud of it, and attaches it to a customer's compliance questionnaire. The answer comes back in one line: that is not what we asked for. This whitepaper explains why, and what to do instead. ISO/IEC 42001 governs an organisation: how it decides what to build, who is accountable, how risks are assessed. The EU AI Act regulates systems, one at a time. Only one thing produces a presumption of conformity under Article 40, and a certificate is not it. The presumption attaches to conformity with a harmonised standard whose reference has been published in the Official Journal of the European Union, and at the time of writing no such standard has been cited for this Regulation. The paper separates three things that are routinely confused, a European standard, a harmonised standard and a cited standard; maps the overlap with the Regulation article by article; and explains why for high-risk systems in points 2 to 8 of Annex III no notified body is involved at all, so the only external scrutiny of a quality management system is the audit an organisation chooses to buy. Biometrics providers are in the opposite position today, for the same reason. It covers the dates as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, a ninety-day plan and a checklist. Twelve pages. Every claim carries its source, and the paper states plainly which of its facts has a shelf life and how to check it. Information, not legal advice.
