Standards briefing · updated 5 August 2026

ISO/IEC 42001 — greenfield, premium, and widely mis-sold

Roughly 350 certified organisations worldwide. About as greenfield as this industry gets — and about as commonly misrepresented.

The correction that wins credibility

ISO 42001 does not confer presumption of conformity with the EU AI Act. Only harmonised standards cited in the Official Journal give Article 40 presumption.

The European Commission assessed ISO/IEC 42001 and found its goals and definitions misaligned with AI Act Article 17. That is precisely why CEN-CENELEC JTC 21 drafted a bespoke European standard — prEN 18286 — rather than adopting 42001. As of June 2026, none of the JTC 21 harmonised standards had been published or cited in the Official Journal.

Half the market is currently telling clients that 42001 delivers AI Act compliance.

The sophisticated buyers know it is wrong. Being the firm that says so plainly is a fast way to be taken seriously — and a fast way to lose a client if you are on the wrong side of it.

What it actually is

An organisational governance certification and a procurement trust signal. It materially reduces the lift for a later conformity programme, and it answers the AI questions now appearing in enterprise vendor questionnaires. Those are real, sellable benefits. They are just not the benefit most firms are claiming.

Note also that there is no official register of certified organisations — the ~350 figure is assembled from certification body announcements. Cite it as an estimate.

The AI Act dates moved

The Digital Omnibus, politically agreed 6 May 2026 and approved that June, deferred Annex III standalone high-risk obligations to 2 December 2027 and Annex I embedded high-risk to 2 August 2028. Article 50 transparency obligations applied from 2 August 2026 and are now live.

Anyone who forecast 2026 revenue against the old high-risk dates has a hole in their pipeline. Reframe as an eighteen-month structured readiness programme rather than abandoning it.