Framework Crosswalk · pack v2026.07.30
ISO/IEC 42001 vs EU AI Act: what actually carries over
24 requirement-level mappings connect ISO/IEC 42001 and EU AI Act: 0 strong (completing one substantially satisfies the other) and 24 partial (it contributes, but more is needed). Neither framework substitutes for the other — this page shows exactly what carries over, requirement by requirement.
What carries over between ISO/IEC 42001 and EU AI Act?
No strong mappings exist between ISO/IEC 42001 and EU AI Act in the crosswalk pack — every connection between them is partial. Treat them as separate workstreams that share evidence, not as substitutes.
What only partly carries over?
Partial mappings: work on one contributes to the other, but more is needed. Shieldra deliberately does not count these as coverage — the "why" column is what's still missing.
| ISO/IEC 42001 | EU AI Act | Why (and what’s missing) |
|---|---|---|
| ISO/IEC 42001 7.2 | EU AI Act: AI literacy duty | Art. 4 literacy training feeds 7.2, but ISO also requires documented competence determination and evidence for all AIMS roles (assessors, auditors, leadership). |
| ISO/IEC 42001 7.3 | EU AI Act: AI literacy duty | Awareness of the AI policy and the consequences of nonconformance supports staff literacy but is not role-specific AI training. |
| ISO/IEC 42001 A.8 | EU AI Act: AI interaction disclosure | A.8 user-information processes are the natural home for interaction disclosure, but Art. 50(1) requires a specific in-product notice at or before first interaction. |
| ISO/IEC 42001 A.8 | EU AI Act: Deep fake disclosure | Transparency-to-affected-parties processes support deep-fake labelling, but the specific disclosure duty and its artistic-works carve-out have no ISO clause equivalent. |
| ISO/IEC 42001 A.8 | EU AI Act: Public-interest text disclosure | Disclosures for AI-generated public-interest text can ride on A.8 communication processes, but the publication duty and its editorial-review exemption are EU-specific. |
| ISO/IEC 42001 A.8 | EU AI Act: Emotion & biometric notification | Informing exposed persons that the system operates fits A.8 information duties; lawful biometric-data processing under GDPR requires separate work. |
| ISO/IEC 42001 A.6 | EU AI Act: GPAI technical documentation | A.6 life-cycle technical-documentation practice supplies the habit, but Annexes XI/XII prescribe specific model documentation content the standard does not. |
| ISO/IEC 42001 A.8 | EU AI Act: GPAI technical documentation | Providing system information to downstream integrators is an A.8 interested-party information duty; Art. 53 fixes the exact content and recipients. |
| ISO/IEC 42001 A.7 | EU AI Act: GPAI copyright & training summary | Documented data provenance and acquisition processes feed the training-content summary, but the copyright policy and the public summary itself are additional artifacts. |
| ISO/IEC 42001 6.1.2 | EU AI Act: Systemic-risk GPAI duties | A defined AI risk assessment process supports systemic-risk assessment, but Art. 55 also demands model evaluations, adversarial testing, and Commission notification. |
| ISO/IEC 42001 A.6 | EU AI Act: Systemic-risk GPAI duties | A.6 verification-and-validation practice contributes to the required model evaluations, not to the adversarial-testing, incident-reporting, or cybersecurity duties. |
| ISO/IEC 42001 A.8 | EU AI Act: Systemic-risk GPAI duties | A.8 incident-reporting processes support serious-incident reporting, but Art. 55 sets specific recipients and timelines. |
| ISO/IEC 42001 4.4 | EU AI Act: High-risk provider obligations | An operating AIMS supplies much of the Art. 17 quality-management-system skeleton, but the Act prescribes elements (conformity procedures, post-market plan) the standard does not. |
| ISO/IEC 42001 6.1.2 | EU AI Act: High-risk provider obligations | The ISO risk assessment process is the backbone of the Art. 9 risk-management system, which is one component of the conformity bundle. |
| ISO/IEC 42001 A.6 | EU AI Act: High-risk provider obligations | A.6 life-cycle controls produce technical documentation and verification evidence toward Arts. 11 and 15, a fraction of the full package. |
| ISO/IEC 42001 A.7 | EU AI Act: High-risk provider obligations | A.7 data management maps to the Art. 10 data-governance duty but not to the specific training/validation/test data criteria the Act prescribes. |
| ISO/IEC 42001 A.3 | EU AI Act: High-risk deployer duties | Defined AI roles and life-cycle accountability support assigning human oversight, one element of the Art. 26 bundle. |
| ISO/IEC 42001 A.6 | EU AI Act: High-risk deployer duties | Operation-and-monitoring stage processes contribute to the monitoring duty; log retention, worker notification, and input-data checks remain. |
| ISO/IEC 42001 A.9 | EU AI Act: High-risk deployer duties | Responsible-use-per-intended-purpose processes directly support using the system per the provider's instructions, but the other Art. 26 duties remain. |
| ISO/IEC 42001 6.1.4 | EU AI Act: Fundamental rights impact assessment | A one-shot pre-use FRIA contributes to 6.1.4 but is not its repeatable lifecycle impact-assessment process; reverse misses Art. 27 prescribed fields and the authority notification. |
| ISO/IEC 42001 A.5 | EU AI Act: Fundamental rights impact assessment | A single FRIA contributes to A.5 but not its established lifecycle assessment process across the AI portfolio; reverse misses Art. 27 content and the market-surveillance notification. |
| ISO/IEC 42001 8.4 | EU AI Act: Fundamental rights impact assessment | Re-performing impact assessments on significant change keeps a FRIA current, but the initial pre-use assessment must exist first. |
| ISO/IEC 42001 A.10 | EU AI Act: Importer duties for high-risk AI | Supply-chain requirements management supports verifying provider conformity, but CE-mark checks, labelling, and 10-year retention are EU-specific. |
| ISO/IEC 42001 A.10 | EU AI Act: Distributor duties for high-risk AI | Third-party assurance processes support distributor verification, but the CE-marking checks and market-surveillance cooperation duties are EU-specific. |
Frequently asked questions
Does ISO/IEC 42001 cover EU AI Act?
Not by itself. Of the 24 requirement-level mappings between them, only 0 are strong; the other 24 are partial, meaning work on one contributes evidence toward the other but does not satisfy it. Shieldra deliberately does not count partial mappings as coverage.
What is the difference between a strong and a partial mapping?
Requirement-level crosswalk among the AI frameworks. strength=strong means completing one substantially satisfies the other; partial means it contributes but more is needed.
Should you do ISO/IEC 42001 or EU AI Act first?
They answer different demands: a regulation binds by law, a management-system standard or risk framework is what enterprise buyers ask for. The overlap table on this page shows which requirements you only have to build once — start from whichever one a customer or regulator is actually asking you for.