--- title: "ISO 42001 and the EU AI Act: What UK Companies Must Do" description: How ISO/IEC 42001 relates to the EU AI Act, when each applies to a UK company, and why a certified AI management system is the practical route. image: https://www.cybercontrols.io/hubfs/blog-iso-42001-eu-ai-act.jpg --- [Skip to content](https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do#main-content) [![Cybercontrols.io logo](https://www.cybercontrols.io/hs-fs/hubfs/cybercontrols-logo-white-bg-800.jpg?width=800&height=178&name=cybercontrols-logo-white-bg-800.jpg)Homepage](https://cybercontrols.io) - [Products](https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do#products) - [Services](https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do#services) - [Blog](https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do#blog) - [About](https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do#about) Get started - [Products](https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do#products) - [Services](https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do#services) - [Blog](https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do#blog) - [About](https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do#about) Get started ![Humanoid robot in thought, AI governance, blue duotone](https://www.cybercontrols.io/hs-fs/hubfs/blog-iso-42001-eu-ai-act.jpg?width=1200&height=630&name=blog-iso-42001-eu-ai-act.jpg) # ISO 42001 and the EU AI Act: What UK Companies Actually Need to Do ![Marius van Aswegen](https://www.cybercontrols.io/hs-fs/hubfs/marius-van-aswegen.jpg?width=48&height=48&name=marius-van-aswegen.jpg) Marius van Aswegen September 13, 2026 Two things happened in quick succession: the EU adopted the world's first comprehensive AI law, and ISO published the world's first certifiable AI management standard. They are frequently confused, sometimes deliberately by vendors. This article untangles them for UK companies, and explains when each one actually applies to you. ## Two different instruments The EU AI Act is law. It applies to providers and deployers of AI systems placed on the EU market or affecting people in the EU, wherever the company sits, which is why a UK firm selling AI-enabled software into Europe cannot ignore it. Its obligations scale with risk: prohibited practices at the top, strict duties for high-risk systems, transparency duties for others, and comparatively little for minimal-risk uses. [ISO/IEC 42001](https://www.cybercontrols.io/it-compliance/iso-42001-certification) is a standard. Nobody is obliged to adopt it. It defines an Artificial Intelligence Management System (AIMS): the governance, risk assessment, impact assessment and lifecycle controls an organisation wraps around its development and use of AI. Like [ISO 27001](https://www.cybercontrols.io/it-compliance/iso-27001-certification), it is certifiable by independent audit. ## Does the AI Act apply to you? For a UK company the honest questions are: do you place an AI system on the EU market, do your outputs get used in the EU, and does what you build or deploy fall into the Act's high-risk categories, such as AI used in recruitment, credit scoring, critical infrastructure or medical devices? If the answers are no, the Act may touch you only lightly. If any answer is yes, you have real obligations, with substantial penalties for getting the serious ones wrong, and your EU customers will increasingly ask you to evidence compliance in procurement long before a regulator ever calls. ## Where ISO 42001 fits The AI Act tells you what outcomes are required. It does not tell you how to run an organisation that reliably achieves them. That is precisely what a management system standard does, and it is why ISO 42001 has become the practical backbone for AI Act readiness: risk and impact assessments become systematic rather than heroic, roles and accountability are defined, data and model lifecycles are documented, and evidence accumulates as a by-product of normal operation rather than a scramble before an audit or a customer questionnaire. Certification also solves a commercial problem the Act does not: proof. A certificate from an accredited body is a one-line answer to the AI governance section of every security questionnaire you will see this year. ## What UK companies should actually do - **Inventory your AI.** You cannot govern what you have not listed, and most organisations are using more AI than they think, much of it embedded in SaaS tools. - **Classify against the Act.** Establish whether anything you provide or deploy touches the EU and where it sits in the risk hierarchy. This is usually a short, clarifying exercise. - **Stand up proportionate governance.** An AI policy, a risk and impact assessment process, and clear accountability. ISO 42001 gives you the structure so you are not inventing one. - **Build on what you have.** If you already run ISO 27001, the overlap is substantial: the same management system disciplines, extended to AI. The two certify well together. ## A note on timing The AI Act's obligations phase in over several years, and standards and guidance underneath it are still maturing. That is an argument for starting with governance now, not for waiting: organisations that certified ISO 27001 early will recognise the pattern, because the companies that treat AI governance as a design decision rather than a retrofit will spend far less and win the enterprise deals in the meantime. Cybercontrols is itself certified to ISO/IEC 42001, one of the first UK consultancies to be so, and we implement the standard for clients alongside ISO 27001 and [ISO 27701](https://www.cybercontrols.io/it-compliance/iso-27701). If you want to know what the AI Act and ISO 42001 mean for your specific products, a free scoping call with a senior consultant will map it out. Planning ISO 42001? [Book a free scoping call](https://www.cybercontrols.io/contact) with consultants who hold the certificate themselves. ## Share this post [mailto:https%3A%2F%2Fwww.cybercontrols.io%2Fblog%2Fiso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do](mailto:https%3A%2F%2Fwww.cybercontrols.io%2Fblog%2Fiso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do) ## Keep reading ### [![Tony's auditor quote of the day: A nonconformity isn't a failure. It's free advice with a deadline. What Clause 10.2 asks of you: react and correct, find the real cause, act so it cannot recur, review and record. Cybercontrols.io](https://www.cybercontrols.io/hs-fs/hubfs/Cybercontrols%20blog%20-%20Nonconformity%20-%20header%201600x800.png?width=1600&height=800&name=Cybercontrols%20blog%20-%20Nonconformity%20-%20header%201600x800.png) A Nonconformity Isn't a Failure: How to Handle ISO Audit Findings Well](https://www.cybercontrols.io/blog/a-nonconformity-isnt-a-failure-how-to-handle-iso-audit-findings-well) ### [![Where do your people's health records actually live? Four things UK GDPR and ISO 27701 expect: a lawful basis and an Article 9 condition, an appropriate policy document, need-to-know access, and retention you actually apply.](https://www.cybercontrols.io/hs-fs/hubfs/Cybercontrols%20blog%20-%20Employee%20health%20data%20-%20header%201600x800.png?width=1600&height=800&name=Cybercontrols%20blog%20-%20Employee%20health%20data%20-%20header%201600x800.png) Employee Health Data and UK GDPR: Where Do Your People's Health Records Actually Live?](https://www.cybercontrols.io/blog/employee-health-data-and-uk-gdpr-where-do-your-peoples-health-records-actually-live) [![Cybercontrols.io logo](https://www.cybercontrols.io/hs-fs/hubfs/cybercontrols-logo-white-bg-800.jpg?width=800&height=178&name=cybercontrols-logo-white-bg-800.jpg "Cybercontrols.io logo")](https://cybercontrols.io) - [Products](https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do#products) - [Services](https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do#services) - [Blog](https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do#blog) - [About](https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do#about) --- Privacy Policy · Legal · © 2026 CyberControls. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Marius van Aswegen", "url" : "https://www.cybercontrols.io/blog/author/marius-van-aswegen" }, "dateModified" : "2026-09-14T06:15:35.685Z", "datePublished" : "2026-09-13T23:05:17.000Z", "headline" : "ISO 42001 and the EU AI Act: What UK Companies Must Do", "image" : [ "https://www.cybercontrols.io/hubfs/blog-iso-42001-eu-ai-act.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.cybercontrols.io/blog/iso-42001-and-the-eu-ai-act-what-uk-companies-actually-need-to-do", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.cybercontrols.io/hubfs/cybercontrols-logo-white-bg-800.jpg" }, "name" : "CyberControls" } } ```