No. ISOâs own explainer states that âCertification for ISO/IEC 42001 is voluntaryâ, and as of October 2026 no US federal or state law requires it. An ISO/IEC 42001 certificate shows that a certification body audited your AI management system against the standard. It does not show that you comply with any particular AI law.
That gap matters because some AI answers and older articles still describe a Colorado law that rewarded ISO/IEC 42001. That law was repealed and re-enacted in May 2026 without the framework defense. Among the laws we reviewed, only Texas rewards a recognized AI risk framework, and it does not name ISO/IEC 42001 either. This page explains what the instruments say; it is not legal advice.
| Question | Short answer, October 2026 |
| Does any US law require ISO/IEC 42001 certification? | No |
| Does any law name ISO/IEC 42001? | None of the six instruments in our table below |
| Does any law reward following a recognized framework? | Only Texas TRAIGA, in one narrow route under section 552.105(e), quoted in the Texas section below |
| Does ISO/IEC 42001 give presumption of conformity under the EU AI Act? | No. It is not a harmonized standard |
| Why do companies certify anyway? | Customers, contracts and procurement teams ask for independent proof |
Sources: iso.org; Texas HB 149 enrolled text; Colorado SB 26-189 fiscal note; EU AI Act Articles 17 and 40 on the AI Act Service Desk; European Commission standardization FAQ. October 2026.
Is ISO 42001 Mandatory in the United States?
ISO/IEC 42001 is not mandatory anywhere in the United States. No federal statute requires it, and none of the state and city AI laws we reviewed requires or names it.
The US approach to AI is a patchwork of executive orders, state laws and sector rules, not one statute. At the federal level, the NIST AI Risk Management Framework (AI RMF 1.0, released 26 January 2023) is âintended for voluntary useâ. Executive Order 14110 of October 2023 was revoked in January 2025. Executive Order 14365, signed on 11 December 2025, tells the Attorney General to set up a task force to challenge state AI laws and the Commerce Department to list âonerousâ ones. It imposes no framework on companies. If you are deciding between the two voluntary options, see how ISO 42001 and the NIST AI RMF fit together. If you are new to the standard itself, start with an introduction to ISO/IEC 42001.
What an ISO 42001 Certificate Proves, and What It Does Not
An ISO/IEC 42001 certificate proves that a management system exists and was audited for a stated scope. It does not prove that any AI system is lawful, fair or safe, and no regulator we reviewed accepts it as a substitute for a specific legal duty.
| An accredited ISO/IEC 42001 certificate proves | It does not prove |
| An AI policy, roles and an AIMS scope exist (clauses 4.3, 5.2, 5.3) | That every AI system you run is inside that scope |
| AI risk and impact assessments are planned and performed (6.1.2 to 6.1.4, 8.2 to 8.4) | That a given model is free of unlawful bias |
| Legal requirements were considered as context (clause 4.1) | That you meet each requirement of a named law |
| Internal audit and management review run (9.2, 9.3) | That a regulatorâs audit or a court would reach the same view |
| A certification body sampled your evidence | That the sample covered the decision a regulator is asking about |
| Surveillance audits recheck the system each year | That it stayed compliant between audits |
Source: ISO/IEC 42001:2023 official preview (clause titles and clause 4.1 text); AI Training Skool analysis, October 2026.
The clause 4.1 row is the bridge. The standard tells you to consider âapplicable legal requirements, including prohibited uses of AIâ when you set your context (official preview, clause 4.1, note 2). A good AIMS therefore carries a register of the laws that apply to you. The certificate shows the register exists, not that each law is met.
Certificate quality varies too. A certificate from a body accredited by ANAB or UKAS carries more weight than one from an unaccredited issuer, so before accepting one, buyers should know which of the three kinds of ISO 42001 accreditation stands behind it. The audit itself follows the Stage 1 and Stage 2 route to ISO 42001 certification.
ISO 42001 Against Six AI Laws and Frameworks
ISO/IEC 42001 is named in none of the six instruments below. In each one, an AIMS gives you records that help, and each law still asks for something the standard does not produce.
| Jurisdiction and instrument | What the law requires | Names ISO/IEC 42001 or a recognized framework? | What an ISO/IEC 42001 AIMS gives you as evidence | What you still need on top |
| EU AI Act, Regulation (EU) 2024/1689 | Providers of high-risk AI systems must run a quality management system (Art. 17) and a risk management system (Art. 9), among other duties | No. Presumption of conformity comes only from harmonized standards cited in the Official Journal (Art. 40); ISO/IEC 42001 is not one | Policy, roles, risk assessment and treatment, impact assessment, documented information, internal audit, management review | Art. 17 items the AIMS does not cover by name, such as post-market monitoring (Art. 72), serious incident reporting (Art. 73) and conformity assessment |
| Texas TRAIGA, HB 149 (effective 1 January 2026) | Bars developing or deploying AI intended to incite self-harm, harm to others or crime, to infringe constitutional rights or to unlawfully discriminate, among other prohibitions; disclosure duties for government agencies and health care providers | Names the NIST Generative AI Profile or another recognized framework, for one route in section 552.105(e); not ISO/IEC 42001 | An internal review process, testing records, a feedback channel, and system descriptions for a civil investigative demand | Proof the violation was found through a listed route; legal analysis of each intent-based prohibition |
| Colorado SB 26-189 (signed 14 May 2026; consequential decisions from 1 January 2027) | Disclosures for automated decision-making technology: developer documentation to deployers, pre-use consumer notice, an explanation within 30 days of an adverse outcome, records kept at least three years | No. The fiscal note mentions no framework | An AI system inventory that flags consequential-decision systems; documented information control for record retention | The notices and adverse-outcome explanations themselves; the Attorney Generalâs rules, due before 1 January 2027 |
| New York City Local Law 144 (enforced since 5 July 2023) | A bias audit of an automated employment decision tool within one year of use, a public summary of results, and candidate notice 10 business days before use | No | Inventory entries and impact assessments for hiring tools | The bias audit itself, the published summary and the notices |
| California SB 53 (signed 29 September 2025) | Large frontier developers publish a framework showing how they incorporate ânational standards, international standards, and industry-consensus best practicesâ | International standards in general; ISO/IEC 42001 is not named | ISO/IEC 42001 is one international standard a developer can describe in that framework | The published framework, critical safety incident reporting to the state, whistleblower protections |
| US federal: NIST AI RMF 1.0 and Executive Order 14365 | No statute requiring an AI management system; the AI RMF is voluntary | The AI RMF is itself a voluntary framework | ISO/IEC 42001 clause 4.1 points to the AI RMF for AI roles, so the two map | Sector rules from your regulators, which apply separately |
Sources: AI Act Service Desk (Articles 9, 17, 40); Texas HB 149; Colorado SB 26-189 fiscal note; NYC DCWP AEDT page; Office of the Governor of California; NIST; Federal Register (EO 14365). October 2026.
What Texas TRAIGA Says About Recognized AI Risk Frameworks
Texas TRAIGA lets a defendant avoid liability in listed situations, and one of them involves a recognized risk management framework. The wording is narrower than most summaries suggest.
Under Texas HB 149, section 552.105(e), a defendant âmay not be found liableâ if another person used its AI system in a way the chapter prohibits. The same applies if it discovers a violation through feedback, testing (including adversarial or red-team testing) or state agency guidelines. The fourth route is an internal review process, if the defendant substantially complies with the NIST Generative AI Profile or âanother nationally or internationally recognized risk management framework for artificial intelligence systemsâ. That defense turns on how you found the problem, not on holding a certificate, and the statute never mentions ISO.
The Attorney General has exclusive enforcement power and must give written notice and 60 days to cure before suing (sections 552.101 and 552.104). Violations that are not cured carry civil penalties under section 552.105(a). The ranges are $10,000 to $12,000 for a curable violation or a broken cure statement, $80,000 to $200,000 for an uncurable one, and $2,000 to $40,000 for each day a violation continues.
The most practical link to ISO/IEC 42001 sits in section 552.103. In a civil investigative demand, the Attorney General may ask for an AI systemâs purpose and intended use, the type of training data, input data categories, outputs, performance metrics, known limitations, and post-deployment monitoring and user safeguards. An AIMS with an AI system inventory, impact assessments and monitoring records can answer most of that list from existing files.
Why Colorado No Longer Recognizes ISO 42001
Coloradoâs original AI Act, SB 24-205, named ISO/IEC 42001 and the NIST AI RMF as benchmarks for a deployerâs risk management program, and it offered an affirmative defense tied to recognized frameworks.
SB 26-189, signed on 14 May 2026, ârepeals and reenactsâ the SB 24-205 requirements, according to the Colorado SB 26-189 fiscal note. The new law centers on disclosures for automated decision-making technology in consequential decisions such as employment, education, lending, real estate, insurance and health care, and applies to decisions made on or after 1 January 2027. Violations are deceptive trade practices enforced by the Attorney General, with civil penalties of up to $20,000 per violation and a 60-day right to cure that expires on 1 January 2030.
According to the billâs fiscal note and published analyses, the framework-based affirmative defense and rebuttable presumption of SB 24-205 were not carried over. The fiscal note does not mention NIST, ISO or any framework. If a vendor tells you ISO/IEC 42001 certification protects you in Colorado, ask which section of SB 26-189 they mean.
Does ISO 42001 Satisfy the EU AI Act?
ISO/IEC 42001 does not satisfy the EU AI Act by itself, and it gives no presumption of conformity. It does cover much of the management system the Act expects from providers of high-risk AI.
EU AI Act Article 17 says providers of high-risk AI systems âshall put a quality management system in placeâ, listing 13 aspects from (a) to (m). Item (g) is the risk management system of Article 9, which must be âestablished, implemented, documented and maintainedâ as a continuous iterative process across the life cycle. Article 40 grants a presumption of conformity only to harmonized standards whose references are published in the Official Journal.
ISO/IEC 42001 is not such a standard. The European Commissionâs standardisation FAQ says its goals and definitions âare not aligned with the quality management systemâ the Act requires, so the Commission asked for a new standard. CEN and CENELEC published that standard, EN 18286, âQuality management system for EU AI Act regulatory purposesâ, in July 2026. CEN-CENELEC said the Commission was expected to publish its reference in the Official Journal later in 2026. When we checked EUR-Lex in mid-October 2026, we found no Official Journal reference for EN 18286, so check the Journal before relying on it.
The dates moved too. The AI Act became generally applicable on 2 August 2026. The AI Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, moved high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product-embedded systems. A US company selling high-risk AI into the EU can build its EU quality management system on top of an ISO/IEC 42001 AIMS, then add the Article 17 items it lacks.
Why Customers Ask for ISO 42001 Before Regulators Do
The pressure to certify mostly comes from buyers, not lawmakers. ISO describes certification as the route for organizations that want âindependent confirmationâ that their AIMS meets the standard. That demand shows up in three places:
- Vendor questionnaires. Enterprise buyers now ask AI governance questions beside their ISO/IEC 27001 and SOC 2 questions. If you already hold ISO/IEC 27001, compare the two in ISO 42001 vs ISO 27001.
- Contract clauses. A master service agreement can require a supplier to keep a named certification, and that clause binds once signed.
- Procurement scoring. Tenders can award points for third-party certification of AI governance.
Read the requirement closely. A clause that asks for âISO/IEC 42001 certificationâ means the organization, audited by a certification body. It is a different thing from a person holding ISO 42001 Lead Implementer certification for professionals, which shows an individualâs knowledge and certifies no company.
How to Use an ISO 42001 AIMS as Regulatory Evidence
Use the AIMS to find, record and track your legal duties, with a separate line for each lawâs deliverable:
- Clause 4.1, legal context. List every AI law that applies by jurisdiction and AI role (provider, deployer, developer). Re-check it when laws change, as Coloradoâs did in 2026.
- Clause 4.3, scope. Make sure systems used for hiring, lending, housing or other consequential decisions sit inside the AIMS scope, or record why they do not.
- Clauses 6.1.4 and 8.4, impact assessment. Add fields for each lawâs questions, such as the NYC bias audit date or the Colorado adverse-outcome explanation.
- Clause 7.5, documented information. Set retention to the longest legal period that applies, at least three years wherever Coloradoâs record rule reaches you.
- Clause 9.3, management review. Put regulatory change on the agenda, so leadership sees new duties before they apply.
Counsel still confirms each lawâs deliverable; the AIMS tracks it but does not replace it.
Frequently Asked Questions
Is ISO 42001 Certification Legally Required?
No. ISO states that certification for ISO/IEC 42001 is voluntary, and as of October 2026 no US federal or state law requires it. None of the instruments we reviewed (the EU AI Act, Texas TRAIGA, Colorado SB 26-189, NYC Local Law 144, California SB 53 or the NIST AI RMF) names the standard. It can become required through a customer contract, a procurement rule or a tender.
Does ISO 42001 Give a Legal Defense in Texas?
Possibly, but it is untested. Under Texas TRAIGA section 552.105(e), a defendant âmay not be found liableâ if it finds a violation through an internal review process while substantially complying with the NIST Generative AI Profile or âanother nationally or internationally recognized risk management frameworkâ. ISO/IEC 42001 is not named, so whether it qualifies is for a court to decide.
Does the Colorado AI Act Still Recognize ISO 42001?
No. Colorado SB 26-189, signed on 14 May 2026, repealed and re-enacted the SB 24-205 requirements and applies to consequential decisions made on or after 1 January 2027. According to the billâs fiscal note and published analyses, SB 24-205âs framework-based affirmative defense and rebuttable presumption were not carried over, so ISO/IEC 42001 no longer earns a defense under Colorado law.
Is ISO 42001 a Harmonized Standard Under the EU AI Act?
No. Under Article 40 of the EU AI Act, presumption of conformity comes only from harmonized standards cited in the Official Journal. The European Commission says ISO/IEC 42001 is not aligned with the Actâs quality management system and requested a new standard, which CEN and CENELEC published as EN 18286 in July 2026. We found no Official Journal reference for it as of mid-October 2026.
Who Needs ISO 42001 Certification?
Organizations whose customers, partners or tenders ask for independent proof of AI governance need it most: AI vendors selling to enterprises, suppliers in regulated sectors such as finance and health care, and companies bidding where certification scores points. A company with a few internal AI tools and no external demand can often adopt the standard without certifying.
