Does the EU AI Act apply to my company outside Europe?

Yes, if you offer AI in Europe. The law applies by where the AI lands, not by where the company sits: if your system, your users or its results are in the European Union, you are in scope. A non-EU software company selling an AI-enabled product to European customers is inside.

Do I have to get ISO 42001?

No. ISO 42001 is voluntary. You do it when you want to prove to customers, investors and regulators that you use AI responsibly, or when you want a firm base for complying with laws like the AI Act. The gain is proof recognised worldwide, not an obligation.

What are the EU AI Act deadlines?

The law takes effect in phases. Prohibited AI uses and the basic staff-literacy rules have applied since February 2025. Rules for general-purpose models started in August 2025. Most high-risk obligations and the user-notice rules take effect in August 2026, with an extra window, to August 2027, for AI that is part of products already regulated by other EU laws.

ISO 42001 or NIST AI RMF, which one?

They are different things. The NIST AI RMF is a set of good practices for handling AI risk, from the United States, and it earns no certificate: it works as a guide. ISO 42001 is also voluntary, but it earns a certificate issued by an outside body. If you want a recognised badge you choose ISO 42001; the NIST AI RMF helps a lot when organising the risk analysis, and the two work well together.

Where should a company start?

With two diagnostics at once: check your AI systems' risk under the AI Act, to learn what the law asks of you and when, and measure the distance to ISO 42001, to size the effort. With both in hand, you can build a single plan that answers the law and prepares the certificate without repeated work.

AI governance

ISO 42001 vs EU AI Act

They aren't rivals, and you don't have to choose between them. ISO/IEC 42001 is an international standard that organises how your company builds and uses artificial intelligence responsibly, and you can earn a certificate from it. The EU AI Act is European Union law: it applies to anyone offering AI in Europe, even with the company based in Brazil, and it carries fines. Doing ISO 42001 is the fastest way to get ahead of what the European law demands.

See AI Trust readiness Jump to the comparison

In short

ISO 42001 is a standard: you follow it by choice, and you earn a certificate. The EU AI Act is law: you comply because you must, or you risk a fine.
The EU AI Act reaches your company outside Europe if you offer or use AI there. It applies by where the AI is used, not by where the company is based.
Holding ISO 42001 doesn't make you compliant on its own, but it builds almost all of the organisation, risk control and paperwork the law requires.
In practice, the best path joins both: you use ISO 42001 as the base and link each part of it to what the AI Act asks.

Side by side

What separates a standard from a law

What to compare	ISO/IEC 42001	EU AI Act
What it is	An international standard for managing artificial intelligence. You follow it by choice.	Regulation (EU) 2024/1689, a law that applies directly in Europe. Mandatory.
What it organises	How the company handles AI from start to finish: rules, owners, risk and impact assessment, controls and continual improvement.	Placing and using AI on the European market, with rules that change according to each system's risk.
How it works	A cycle of plan, do, check and adjust, with about 38 reference controls.	Organised by risk level: prohibited uses, high risk, limited risk (you only have to inform) and low risk.
Who it applies to	Any company that builds, provides or uses AI and wants to prove it does so carefully.	Anyone whose AI reaches the European market or its users, wherever the company sits.
Is there a certificate?	Yes. An accredited body issues the certificate, as with ISO 27001.	No. It is compliance with the law. High-risk systems go through an assessment and get the CE marking.
Is there a deadline?	No. You adopt it when you want, at your own pace.	It arrives in phases: prohibited uses since Feb 2025, general-purpose models in Aug 2025, most high-risk rules in Aug 2026.
What the penalty is	No fine. What you risk is not getting the certificate, or losing it.	Up to €35 million or 7% of worldwide turnover, whichever is higher, for prohibited uses.
How you prove it	A valid ISO 42001 certificate, with follow-up audits.	Technical documentation, a system assessment and registration in an EU database, for high-risk systems.

ISO 42001 was the first international standard for managing AI, from 2023. The EU AI Act is the world's first broad AI law.

The standard that earns a certificate

ISO/IEC 42001

It does for artificial intelligence what ISO 27001 does for information security: it creates an organised way to handle the topic. You set the rules for using AI, share out responsibilities, assess the risks and impacts, put controls in place and improve over time. In the end, a certificate shows customers, investors and regulators that your company takes the topic seriously.

You adopt it by choice and an accredited body issues the certificate
It covers AI from start to finish, across the company
About 38 reference controls, on a continual-improvement cycle
A base for showing diligence under the AI Act

The law

EU AI Act

It sorts each AI system by risk and asks more of those that carry more risk. Some uses are prohibited. High-risk ones need risk control, quality data, documentation, human oversight and an assessment before reaching the market. It applies to anyone offering AI in Europe, so a Brazilian company selling AI-enabled software there is already under the law.

Mandatory and directly applicable in Europe
Reaches providers outside the continent
Fines up to €35 million or 7% of worldwide turnover
High-risk rules take effect in August 2026

How they fit together

ISO 42001 puts into practice what the AI Act demands

The law says what you must ensure: risk control, care with data, documentation and a human eye on decisions. The standard says how to build all of that and keep it running. Doing ISO 42001 doesn't make you compliant automatically (only specific European standards give that guarantee), but it delivers almost the entire structure the law asks for, with proof that it exists. It is the safest shortcut for anyone who doesn't want to start from scratch.

ISO 42001's rules and owners satisfy the governance the AI Act asks for
The standard's risk and impact assessment feeds the law's risk control
The documentation and improvement routine support the required technical reports

Which is your case

Where to start

You sell or use AI in Europe

Start with the EU AI Act

It is mandatory. The first step is to check each system's risk: knowing whether any is prohibited, high-risk or only needs a user notice shapes everything else.

You want to prove you use AI responsibly

Go with ISO 42001

It is the proof that big customers and investors recognise, even outside Europe. And it leaves you ready for any AI rule still to come, wherever you operate.

You want to solve both at once

ISO 42001 linked to the AI Act

The most efficient path. You build the base with the standard and link each control to what the law asks, with a single paperwork and evidence effort.

Numbers that matter

€35M / 7%

EU AI Act fine ceiling (the higher of the two)

Aug 2026

when high-risk rules take effect

2023

year of ISO/IEC 42001, the first standard for managing AI

How DM11 helps

ISO 42001 readiness and EU AI Act alignment, with DM11

We build the AI governance with ISO 42001, sort your systems by the AI Act's risk levels and join the two into a single programme, with all the documentation and proof that support the certificate and answer the law.

One project covers both fronts, so you neither pay nor work twice
You find out early if any system is high-risk, before it turns into a fine
We handle the paperwork and evidence; your team keeps running the day to day
You reach the audit already knowing you'll pass, with no last-minute surprise

Explore AI Trust

Frequently asked

What people ask before deciding

Answers anchored in Regulation (EU) 2024/1689 and ISO/IEC 42001:2023.

Not automatically. The guarantee that you comply with the AI Act comes from specific European standards, and ISO 42001 isn't one of them. Even so, it delivers almost everything the law asks for: organisation, risk control, documentation and continual improvement, with proof that it works. That is why it is the fastest route to compliance, and the base almost every serious programme uses.

Start with your systems' risk and the distance to ISO 42001

A short conversation shows whether any system is high-risk and how far the path to governance runs. No commitment.

Talk to a specialist Explore AI Trust

ISO 42001 vs EU AI Act

What to compare

ISO/IEC 42001

EU AI Act

What it is

An international standard for managing artificial intelligence. You follow it by choice.

Regulation (EU) 2024/1689, a law that applies directly in Europe. Mandatory.

What it organises

How the company handles AI from start to finish: rules, owners, risk and impact assessment, controls and continual improvement.

Placing and using AI on the European market, with rules that change according to each system's risk.

How it works

A cycle of plan, do, check and adjust, with about 38 reference controls.

Organised by risk level: prohibited uses, high risk, limited risk (you only have to inform) and low risk.

Who it applies to

Any company that builds, provides or uses AI and wants to prove it does so carefully.

Anyone whose AI reaches the European market or its users, wherever the company sits.

Is there a certificate?

Yes. An accredited body issues the certificate, as with ISO 27001.

No. It is compliance with the law. High-risk systems go through an assessment and get the CE marking.

Is there a deadline?

No. You adopt it when you want, at your own pace.

It arrives in phases: prohibited uses since Feb 2025, general-purpose models in Aug 2025, most high-risk rules in Aug 2026.

What the penalty is

No fine. What you risk is not getting the certificate, or losing it.

Up to €35 million or 7% of worldwide turnover, whichever is higher, for prohibited uses.

How you prove it

A valid ISO 42001 certificate, with follow-up audits.

Technical documentation, a system assessment and registration in an EU database, for high-risk systems.

ISO/IEC 42001

You adopt it by choice and an accredited body issues the certificate

It covers AI from start to finish, across the company

About 38 reference controls, on a continual-improvement cycle

A base for showing diligence under the AI Act

EU AI Act

Mandatory and directly applicable in Europe

Reaches providers outside the continent

Fines up to €35 million or 7% of worldwide turnover

High-risk rules take effect in August 2026

ISO 42001 puts into practice what the AI Act demands

ISO 42001's rules and owners satisfy the governance the AI Act asks for

The standard's risk and impact assessment feeds the law's risk control

The documentation and improvement routine support the required technical reports

ISO 42001 readiness and EU AI Act alignment, with DM11

One project covers both fronts, so you neither pay nor work twice

You find out early if any system is high-risk, before it turns into a fine

We handle the paperwork and evidence; your team keeps running the day to day

You reach the audit already knowing you'll pass, with no last-minute surprise