AI Act, ISO and AI governance standards: how they connect and what is mandatory

Why the AI governance map matters

An organisation may have an inventory, an AI policy and several risk assessments while still being unsure which legal duties apply. It may also pursue certification before establishing who can approve a system or accept its remaining risks. The practical challenge is connecting those pieces with decisions and actual operations.

The research behind this article separates four complementary perspectives: law, conformity, management systems and specialist guidance. The EU AI Act establishes duties. A harmonised standard can help demonstrate covered requirements. A management system organises work. Specialist references provide depth on risk, security and oversight.

The seven references therefore serve different purposes. Selection depends on the organisation’s role, its systems and the evidence it needs. AI governance connects these needs with decisions that people can explain, challenge and review. Treating every standard as an interchangeable compliance label makes that task harder.

What is mandatory and what is voluntary

Regulation (EU) 2024/1689 is binding legislation within its scope and applicable timetable. Technical standards have a different legal nature. Voluntary status does not make them irrelevant, and different types of standards offer different benefits.

ISO/IEC 42001 is a management system requirements standard against which independent bodies can assess and certify an organisation. ISO/IEC 23894, 27090 and 38507 provide guidance. IEEE 2863 is a Recommended Practice. These references should not be described as equivalent certifications or general AI Act obligations.

Harmonised standards also remain voluntary. Publication of their references in the Official Journal can trigger a presumption of conformity for covered requirements. Separately, contracts or sector-specific provisions may make a voluntary standard applicable to a particular organisation. Both the legal basis and the scope need checking rather than assuming that voluntary always means irrelevant.

The EU AI Act: the legal reference

Start by identifying the operator’s role. An organisation developing and marketing a system under its own name may be a provider; an organisation using it under its authority may be a deployer. Buying an external product does not remove the need to assess its actual use. Changes to purpose or the system may also affect the role analysis.

For high-risk systems, Article 9 addresses risk management; Article 15, accuracy, robustness and cybersecurity; Article 17, the provider’s quality management system. Article 40 provides the mechanism for presumption of conformity linked to harmonised standards cited in the Official Journal. These provisions have different functions and addressees. A business user does not automatically inherit every provider duty.

Regulation (EU) 2026/1744 changes the timetable. Chapter III Sections 1, 2 and 3, except Article 6(5), apply from 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems. This is not a general postponement of the entire AI Act.

Article 111 transitional arrangements also need review. Previously marketed or commissioned systems, significant design changes and certain public-authority uses require particular analysis. Purchase date alone does not settle the question. Record the actual purpose, classification and relevant dates before deciding which requirements need implementation.

EN 18286:2026: connecting law and standardisation

EN 18286:2026, Artificial intelligence – Quality management system for EU AI Act regulatory purposes, addresses quality management for AI Act regulatory purposes. It primarily concerns organisations providing high-risk AI systems. Its relationship with Article 17 explains its distinctive position in this map.

Commission Implementing Decision (EU) 2026/2274, published on 14 October 2026, publishes its reference in the Official Journal. CEN-CENELEC’s announcement explains its relationship with practical, auditable quality requirements.

Presumption of conformity concerns only requirements covered by the standard or the parts applied. Teams should record the requirements they intend to demonstrate, the standard’s version and supporting evidence. Applying EN 18286 does not automatically establish compliance with the whole AI Act or replace an applicable conformity assessment. Its use remains voluntary. The EN 18286 resource provides further context.

ISO/IEC 42001:2023: the AI management system

ISO/IEC 42001:2023 specifies requirements for an AI management system, or AIMS. It connects policy, objectives, responsibilities, risks, controls, documentation, audits and continual improvement within a defined scope.

Organisations can use that structure to maintain a consistent account of their systems. As a Céntrika integration example, an approval record can refer to the assessed version, permitted uses, restrictions and pending reviews. That helps different teams discuss the same decision without maintaining disconnected files for every reference.

The standard supports independent certification. ISO itself does not certify organisations. A certificate concerns the management system and its scope; it is not a general certificate of AI Act compliance. Our ISO 42001 versus AI Act comparison explains this distinction.

EN 18286 focuses on regulatory quality management, while ISO/IEC 42001 addresses organisational AI management. Their coexistence is a proposed integration based on their respective scopes, not a claim of equivalence. Implementing ISO/IEC 42001 can turn that architecture into processes an organisation can operate, review and improve over time.

ISO/IEC 23894:2023: AI risk management

ISO/IEC 23894:2023 provides guidance on managing AI-related risks and integrating that activity into an organisation’s functions. Its practical contribution is methodological depth for identification, analysis, evaluation and treatment in context.

The connection with Article 9 is functional: guidance can support an activity required by legislation for high-risk systems. It does not automatically create an Article 40 presumption of conformity. Within an AIMS, risk work should inform controls, monitoring and decisions about remaining exposure.

As a Céntrika recommendation, a useful risk record can link the system, a harm scenario, affected people, controls, owner, test and review date. Record uncertainty as well: insufficient evidence should not be mistaken for proof that a risk has disappeared. The AI risk management resource develops this operational perspective and the importance of following decisions through.

ISO/IEC 27090:2026: AI-specific cybersecurity

ISO/IEC 27090:2026, published on 14 October 2026, provides guidance on security threats and compromises affecting AI systems. It considers assets including training data and models throughout the life cycle and complements established security practices.

Its connection with Article 15 concerns protection of high-risk systems. Data poisoning, model theft and adversarial inputs need concrete scenarios and appropriate testing. Security risks can be integrated into the wider risk process supported by ISO/IEC 23894 rather than assessed in isolation.

Céntrika’s proposed integration links each relevant threat with an asset, a safeguard, a test and a decision. Changing a model, supplier or retraining dataset can invalidate earlier assumptions and require reassessment. The standard does not independently confer presumption of conformity. Our ISO/IEC 27090 cybersecurity article examines threats and possible safeguards in greater detail.

ISO/IEC 38507:2022: governance by the governing body

ISO/IEC 38507:2022 provides guidance on governance implications of organisational AI use. Its perspective helps locate oversight, responsibility and the acceptability of AI use with the governing body.

The central distinction is straightforward: ISO/IEC 42001 structures a management system; ISO/IEC 38507 addresses governance implications. A process may explain how a system is reviewed without making clear who can accept a major exposure or order its suspension.

A practical application is to provide decision-makers with information about important risks, purpose changes, incidents, limitations and unresolved issues. Frequency and detail depend on context. Clear AI governance roles and responsibilities help ensure that oversight involves an ability to act, rather than simply receiving reports. These operational examples are Céntrika recommendations, not quotations from the standard.

IEEE 2863-2026: organisational AI governance

IEEE 2863-2026, published on 16 October 2026, is the IEEE Recommended Practice for Organizational Governance of Artificial Intelligence. It connects governance principles, implementation processes and cases that illustrate tensions between objectives.

It shares an interest in governance with ISO/IEC 38507, while offering a different approach. An organisation can draw on both to connect governing-body priorities with decisions and accountability. This complementarity is Céntrika’s functional interpretation, not a required dependency between the documents.

Useful practical questions include who approves a use case, who receives an alert and who decides when commercial goals, security and rights conflict. IEEE 2863 is a recommended practice: it does not replace the AI Act and should not be presented as an EU harmonised standard or a certification equivalent to ISO/IEC 42001. Its value lies in supporting governance activity.

How the references work together

The map becomes useful when applied to a single decision. Law determines duties; EN 18286 supports demonstration of covered requirements; ISO/IEC 42001 organises management. ISO/IEC 23894 and 27090 deepen risk and security work. ISO/IEC 38507 and IEEE 2863 address oversight and organisational accountability.

There is no general requirement to implement all seven together, nor a legal hierarchy between these voluntary standards. This is a proposed integration architecture. Each organisation should explain which references it selects and the purpose they serve.

A supplier change, for example, can trigger risk reassessment, security testing, a quality review and a governance decision. Linking these activities to the same system and version allows evidence to be reused without confusing its purpose. High-risk AI conformity assessment retains its distinct legal function; a management-system audit does not automatically replace it.

Practical example: a business using AI

Imagine a repair workshop. The AI Act represents applicable law; EN 18286 represents a recognised route for demonstrating certain quality requirements. ISO/IEC 42001 organises the workshop, ISO/IEC 23894 examines what could go wrong, and ISO/IEC 27090 explores attacks. ISO/IEC 38507 guides the owners’ oversight, while IEEE 2863 supports translating principles into governance decisions. This is an explanatory analogy, not a legal equivalence.

Now consider an employer using AI to support recruitment. It first needs to describe the actual purpose, determine its role and assess classification, including applicable conditions and exceptions. Neither a product’s marketing label nor the presence of human review settles that assessment.

As a deployer, it must identify its own obligations and obtain relevant information from the provider. An AIMS can coordinate human resources, security and management. If the business also develops and markets the system under its own name, provider obligations need examination, including regulatory quality management where applicable. A change of role changes the compliance analysis and the evidence required.

How a business can integrate the references

The following sequence is an operational recommendation from Céntrika, not a universal legal checklist or a reproduction of standards clauses. Scope and depth should reflect actual systems and exposure.

• Inventory: record systems, tools, suppliers and owners in an AI inventory.
• Establish purpose and role: describe actual use and distinguish providers, deployers and other operators.
• Classify: document the risk classification, legal duties and relevant timetable.
• Determine requirements: connect each applicable duty with a process and evidence.
• Assign oversight: identify who implements, approves, reviews and escalates decisions.
• Operate proportionate processes: connect policy, change management, quality, audit and improvement.
• Integrate risk and cybersecurity: assess scenarios, choose safeguards and test outcomes.
• Retain evidence: preserve versions, tests and decisions with appropriate access and retention.
• Review: define periodic monitoring and triggers such as incidents or changes of purpose or supplier.

AI evidence should make a decision reconstructable. AI system monitoring helps establish whether accepted conditions still hold. An approved document loses practical value when no one updates it after an important change. Review responsibilities therefore need to survive the initial implementation project.

AI governance map: obligations and complementary references

The infographic brings the seven references together. Coral identifies the legal layer, amber the harmonised standard, and turquoise and mint the voluntary references. The supplied infographic is in Spanish and opens at full size. The English table below provides an accessible equivalent of its comparison.

Connections show functional relationships and complementarity, not a legal hierarchy between voluntary technical standards. Presumption of conformity requires verification of the harmonised reference and its coverage in the Official Journal. Contractual and sector-specific obligations require separate analysis.

Conclusion

AI governance cannot be resolved by implementing a single standard. The AI Act establishes applicable legal duties; technical references provide methods to organise management, control risks, protect systems and assign responsibilities.

Their value emerges when they connect with decisions, processes and evidence that an organisation can maintain and demonstrate. A useful map shows what needs doing, who is accountable, what has been checked and when the decision should be reviewed.

References

This analysis prioritises European Union legal sources and official ISO, CEN-CENELEC and IEEE pages. Commercial interpretations have been avoided where a primary source is available.

European Union — Artificial Intelligence Act. Regulation (EU) 2024/1689 and the consolidated text used by the Commission’s AI Act Service Desk. Articles 9, 15, 17 and 40 are the main references for risk management, cybersecurity, quality management systems and harmonised standards, respectively.

European Union — Regulation (EU) 2026/1744. The 2026 amendment changes, among other matters, the application timetable for Chapter III Sections 1, 2 and 3 concerning high-risk systems: 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems.

European Commission — Implementing Decision (EU) 2026/2274 of 12 October 2026. Published in the Official Journal on 14 October 2026. Its annex includes EN 18286:2026 as a harmonised standard for high-risk AI systems supporting Regulation (EU) 2024/1689.

CEN-CENELEC — EN 18286:2026. Official project record and announcement of publication in the Official Journal. The record describes a quality management system for organisations providing AI systems, primarily those placing high-risk systems on the market or putting them into service, and confirms its citation in OJ L 2026/2274.

ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system. ISO defines it as a requirements standard for establishing, implementing, maintaining and continually improving an AI management system.

ISO/IEC 23894:2023 — Information technology — Artificial intelligence — Guidance on risk management. Guidance for managing AI-specific risks and integrating risk management into organisational activities.

ISO/IEC 38507:2022 — Governance of IT — Governance implications of the use of artificial intelligence by organizations. Guidance particularly intended for governing bodies, as well as management, specialists, consultants, assessors and auditors.

ISO/IEC 27090:2026 — Cybersecurity — Artificial intelligence — Addressing security threats and compromises to AI systems. Published in October 2026. It provides guidance on AI-specific threats and complements ISO/IEC 27001 and ISO/IEC 27002 practices.

IEEE 2863-2026 — IEEE Recommended Practice for Organizational Governance of Artificial Intelligence. Published on 16 October 2026. It defines principles, processes and case studies for organisational governance of responsible AI development and use.

ISO — Certification. ISO explains that it does not certify organisations or issue certificates; external bodies perform certification against management system standards.

Editorial approach. The relationships described between standards are an analysis of functional interoperability based on their official scopes. Apart from EN 18286:2026 under the terms of Decision (EU) 2026/2274 and Article 40 of the AI Act, adopting an ISO standard or IEEE 2863 should not be interpreted as independently conferring presumption of conformity with the Artificial Intelligence Act.