The first harmonised standard for the AI Act is here

What the standard does

The European Commission published the first harmonised standard for the AI Act on 16 January 2025. The standard is EN ISO/IEC 42001:2023, Information technology – Artificial intelligence – Management system. It is now available in all EU languages in the Official Journal ^[1].

A harmonised standard is a technical specification that follows a request from the Commission. When a company meets a harmonised standard, there is a presumption that it also meets the legal requirements that standard covers ^[2]. In this case, the standard covers quality management systems for AI and parts of risk management.

Think of it like building permits: the regulation says your building must be safe, and the harmonised standard shows one way to prove it is. You can follow another route, but the standard gives you a tested blueprint.

For providers of high-risk AI systems under Annex III, the quality management and risk management requirements apply from 2 December 2027 ^[3]. For general-purpose AI models, the transparency obligations apply from 2 August 2025.

What it covers

EN ISO/IEC 42001:2023 sets out how an organisation should manage AI development and use. It covers:

• establishing, implementing, maintaining and continually improving an AI management system,
• defining policies, objectives and controls for AI,
• identifying and treating AI-related risks,
• managing data quality for AI systems.

The standard does not cover every requirement in the AI Act. It addresses quality management under Article 17, and parts of the risk management framework in Article 9. It does not, for example, cover the logging requirements in Article 12, the transparency obligations in Article 13 or the human oversight requirements in Article 14 ^[2].

Voluntary, not mandatory

The standard is voluntary. High-risk AI providers can follow EN ISO/IEC 42001:2023, or they can show compliance in another way. What is mandatory is meeting the AI Act's requirements. The standard is one route; it is not the only one ^[2].

Conformity assessment bodies, which are notified bodies or internal compliance teams depending on the system, check that a high-risk AI system meets the regulation's requirements. If a provider has followed a harmonised standard, the assessor presumes that the parts covered by the standard are compliant, unless there is evidence to the contrary. If the provider has not used the standard, they must show compliance through other documentation.

Why it matters now

High-risk AI systems under Annex III must meet the quality management and risk management requirements from 2 December 2027. That gives providers less than three years to set up their systems. Having a harmonised standard now means they know what 'good enough' looks like, at least for the parts the standard covers.

It also means conformity assessment bodies can start training and preparing. Notified bodies need to know what to check, and a harmonised standard gives them a reference.

For systems already on the market, this is the moment to map what you have against what the standard expects. Gap analyses tend to surface more work than anyone wants to find, but better now than in 2027.

What this means for you

If you provide high-risk AI under Annex III:

• Read EN ISO/IEC 42001:2023 and compare it with your current quality and risk management systems. The standard is available from national standards bodies.
• Decide whether you will follow the standard or document compliance another way.
• Remember that the standard covers quality management and risk management, not logging, transparency or human oversight. Those still need separate solutions.
• If you plan to seek certification to the standard, talk to a certification body now. Waiting until late 2027 means joining a queue.

If you use high-risk AI, ask your provider whether they plan to follow the harmonised standard and, if not, how they will show compliance.

A record of which system version, and when

The AI Act requires high-risk systems to log events automatically over their lifetime. Article 12 says what to log. It does not say how to protect the logs, or how to prove later that they have not been edited.

Here, the thing to seal is each version of the AI system as it is released, and each decision or event as it is written to the log. Sealing takes a fingerprint of the record, not the data itself, so the content never leaves your systems. When an auditor or a notified body asks which version was running on a given day, or whether a log entry has changed, anyone you share the record with can check that it is exactly what was sealed at that time.

WitniumChain does that through a REST API, an SDK or an MCP server. The content stays with you. The first 2,000 witnesses a month are free. Start at witniumchain.com/signup.

Sealing a version or a log entry doesn't show that the system was compliant, or that the logged decision was correct. It shows that the record is the one that existed at that time, unchanged.

What to watch

More harmonised standards are on their way. The Commission has asked CEN and CENELEC to develop standards for transparency, data governance, accuracy, robustness and cybersecurity. Those will follow the same process: publication in the Official Journal, voluntary use and presumption of conformity for the parts they cover.

The next date to watch is 2 August 2025, when the transparency obligations for general-purpose AI models apply. After that, 2 December 2027 is the deadline for high-risk systems under Annex III to meet the full set of requirements, including quality management, risk management, logging, transparency and human oversight.