The EU AI Act is Now Applying. Does Your Business Need ISO 42001 Certification?

What is the EU AI Act About?

The EU AI Act sets rules for artificial intelligence across the European Union, with the aim of protecting people’s health, safety and fundamental rights. It takes a risk-based approach: it bans certain uses of AI, sets stricter requirements for high-risk systems and requires transparency in some situations, such as when people interact with a chatbot.

The rules also depend on an organisation’s role, such as developing or using an AI system. ISO/IEC 42001 is a separate, voluntary standard for managing AI across an organisation. Certification to it is not a blanket requirement under the Act.

Does The EU AI Act Apply to UK Businesses?

Yes. The EU AI Act can apply to a UK business even if it has no office in the EU. It covers providers that place AI systems or general-purpose AI models on the EU market. It can also cover providers and deployers based outside the EU when their system’s output is used in the Union. The duties depend on the organisation’s role and the system’s use and risk category.

For a UK technology company selling into Europe, checking scope early can help avoid surprises around market access and customer requirements. The GDPR has already made territorial scope a practical business issue for UK firms. The AI Act has its own test, so assess each AI system and your role under the Act.

At Tempo Audits, we audit AI management systems against ISO 42001. Our certification audit assesses the management system; it does not determine whether the Act applies to your business or provide implementation consulting.

When Does the EU AI Act Reach Your UK Business?

The EU AI Act can apply to UK businesses through several routes. Under Article 2, check whether:

• You provide an AI system or general-purpose AI model for the EU market, or put it into service there.
• Your organisation deploys an AI system from an establishment or location in the EU.
• You provide or deploy an AI system from outside the EU, and its output is used in the Union. A UK SaaS company could fall within this rule when an EU customer uses an AI feature, even if the company has no EU office or staff.
• You import or distribute AI systems in the EU.
• You manufacture a product with an AI system and place it on the EU market under your own name or trade mark.

The duties depend on your role and the system involved. An EU customer alone does not automatically settle the question; you need to check whether the feature is an AI system and how it is used.

Which Role Does Your Business Play Under the EU AI Act?

The EU AI Act assigns duties according to the role a business plays in relation to an AI system. A UK company may hold more than one role, depending on what it develops, sells or uses.

A company’s role attaches to its activities and systems, so it may be a provider for one tool and a deployer for another.

EU AI Act Risk Levels: What The Four Tiers Mean

The EU AI Act groups AI systems by the level of risk they pose. The category depends on the system’s purpose and use, not simply on the technology or the company that built it.

EU AI Act Compliance Timeline: What Applies Now and What Comes Next

The EU AI Act has been taking effect in stages. As of October 2026, its general application has begun, but some high-risk AI requirements have later deadlines. The Digital Omnibus entered into force on 27 July 2026 and set dates for those rules.

These are legal deadlines under the Act. ISO/IEC 42001 certification has a separate audit process: at Tempo Audits, we assess an organisation’s AI management system against the standard, but certification does not replace its legal obligations under the AI Act.

Where ISO/IEC 42001 Supports EU AI Act Requirements

ISO/IEC 42001 does not reproduce the EU AI Act as a checklist. It gives organisations a management system for identifying and controlling AI risks. Some of its Annex A areas overlap with the Act’s requirements, especially for high-risk AI systems. The connection is useful, but it does not make certification proof of legal compliance.

For example, an auditor may trace one AI system from its risk assessment through data decisions, user information and human oversight. That evidence can show how the management system works; it cannot determine by itself whether the organisation has met every legal duty.

Does Your Company Need ISO 42001 Certification?

Yes, if your organisation develops or uses AI and needs to show customers how it manages AI risks. Certification provides independent evidence that your AI management system meets the ISO/IEC 42001 standard.

It is voluntary, but can strengthen customer confidence and support procurement discussions. It does not replace any legal duties your organisation has under the EU AI Act.

Where certification can add value

Customers and business partners may want to know who oversees your AI systems, how you assess risks and what happens when a system’s performance or impact changes. ISO/IEC 42001 gives you a structured way to address these questions and demonstrate that your approach is part of an ongoing management system.

What certification involves

Tempo Audits independently audits AI management systems against ISO/IEC 42001. If the system meets the standard, we can certify it. Our role is to assess the system impartially; your organisation remains responsible for meeting the legal requirements that apply to its AI activities.

What ISO 42001 Certification Proves and What It Does Not

ISO 42001 certification gives independent evidence that an organisation’s AI management system meets the standard within the scope stated on its certificate. It does not approve every AI system or confirm compliance with the EU AI Act.

What the certificate demonstrates

An audit looks at how the organisation manages AI in practice: who is accountable, how risks and impacts are assessed, how data and system life cycles are controlled, and how people oversee AI use. The evidence needs to show these processes are defined and put into operation, not just described in a policy.

What it does not confirm

The certificate does not establish that every AI system is lawful, safe or compliant with every relevant regulation. The EU AI Act sets obligations according to an organisation’s role and the system’s risk category. High-risk systems may also need separate conformity assessments and technical documentation. The European Commission notes that ISO 42001 helps organisations set up an AI management system, but it does not align fully with the quality management system required by the Act.

How to Get ISO/IEC 42001 Certified: The Process

Preparing for certification can take a few months. Once the Stage 1 audit begins, the audit process typically takes about a month, assuming everything is in order. That usually includes a two to three week gap before Stage 2, followed by three to seven days for us to issue the audit report and certificate.

Stage 1: Review your AI management system

We review your policies and other AIMS documentation, confirm the certification scope and check whether your organisation is ready for Stage 2. If we identify areas that need attention, you have time to address them before the main audit.

Stage 2: Audit how your system works

Tempo Audits assesses how your AI management system operates in practice. This involves interviews, document reviews, process testing and control checks. Once the audit is complete and everything is in order, we issue your audit report and certificate.