ISO/IEC 42001 and the EU AI Act: What small and mid-sized Companies Need to Know

Two years ago, AI governance was a theoretical concern for most small and mid-sized companies. Today it is a practical one. The EU AI Act is in force. ISO/IEC 42001 is published and organizations are pursuing certification. Customers are asking about AI governance in security questionnaires. Regulators are beginning to incorporate AI risk into existing frameworks.

If your organization uses AI systems in any meaningful way — and most do, even if only through embedded AI in SaaS tools — you need to understand what these frameworks require and where your obligations lie.

ISO/IEC 42001: The Management System Standard

ISO/IEC 42001, published in December 2023, is the first international standard for AI management systems. It follows the same high-level structure as ISO 27001 and ISO 9001 — a management system framework organized around Plan-Do-Check-Act — which means organizations already familiar with ISO management systems will find the structure recognizable.

The standard requires organizations to establish an AI management system (AIMS) that addresses the full lifecycle of AI systems: development, deployment, monitoring, and retirement. Key requirements include defining the organizational context for AI use, establishing AI policy and objectives, conducting AI risk assessments, implementing controls to address identified risks, and maintaining a continual improvement process.

Annex A of ISO 42001 provides a reference set of controls organized across six domains: AI policies, internal organization, resources for AI systems, assessing AI system impacts, AI system lifecycle, and relationships with interested parties. Organizations select applicable controls based on their risk assessment and document their selections in a Statement of Applicability.

The EU AI Act: Risk-Based Regulation

The EU AI Act takes a different approach. Rather than a voluntary management system standard, it is binding regulation with mandatory requirements scaled to the risk level of the AI system. It applies to any organization that places AI systems on the EU market or puts them into service in the EU — which includes many U.S. companies with European customers or operations.

The Act classifies AI systems into four risk categories. Unacceptable risk systems — such as social scoring by governments or real-time biometric surveillance in public spaces — are prohibited outright. High-risk systems — including AI used in employment decisions, credit scoring, healthcare, law enforcement, and critical infrastructure — face the most stringent requirements: conformity assessments, technical documentation, human oversight measures, and registration in an EU database.

Limited risk systems — such as chatbots — face transparency obligations: users must be informed they are interacting with an AI. Minimal risk systems — the vast majority of AI applications — face no specific obligations under the Act, though the European Commission encourages voluntary codes of conduct.

Where the Frameworks Overlap

Both frameworks share a common foundation: risk-based governance of AI systems. Both require organizations to identify and assess the risks posed by their AI systems, implement controls proportionate to those risks, maintain documentation, and establish oversight mechanisms. An organization building an AI governance program aligned to ISO 42001 will find that much of the work also addresses EU AI Act requirements for high-risk systems.

The key differences are scope and enforceability. ISO 42001 is voluntary and covers all AI systems regardless of risk level. The EU AI Act is mandatory for organizations in scope and focuses its most stringent requirements on high-risk systems. For organizations subject to both, ISO 42001 certification can serve as evidence of a systematic approach to AI governance that supports EU AI Act compliance.

Practical Steps for small and mid-sized Companies

Start with an AI inventory. You cannot govern what you cannot see. Catalog every AI system your organization uses or develops, including AI embedded in third-party SaaS tools. For each system, document its purpose, the data it processes, the decisions it influences, and the populations it affects.

Assess your EU AI Act exposure. If you have European customers or operations, determine whether any of your AI systems fall into the high-risk category. If they do, you need to understand the specific requirements that apply and begin building the compliance program.

Build governance infrastructure. Assign accountability for AI governance. Establish a review process for new AI deployments. Define your risk tolerance for AI systems. These governance foundations are required by both frameworks and are the right place to start regardless of which framework you are prioritizing.

For a direct comparison of ISO/IEC 42001 and the NIST AI RMF — including how to choose between them and what each requires in practice — see our blog post on [building an AI governance program: ISO/IEC 42001 and NIST AI RMF compared](/blog/building-an-ai-governance-program-iso-42001-nist-ai-rmf). And once your governance program is in place, our post on [how boards should think about AI security](/blog/how-boards-should-think-about-ai-security) covers how to bring leadership along with the right governance questions and reporting structure.