ISO 42001: The AI Management System Standard Explained

ISO/IEC 42001 is the international standard for an AI management system (AIMS). Published in December 2023, it is the first certifiable standard for governing artificial intelligence. It applies to any organisation that develops, provides or uses AI systems, of any size and in any sector. It is voluntary, and it follows the same management system structure as ISO 27001, so companies with an ISMS can extend it.

What is ISO 42001?

ISO 42001 requires an organisation to set up, run and improve a management system for AI. It doesn’t prescribe how to build models. It requires you to identify AI risks and impacts, decide how to treat them, apply controls and prove they work.

The standard has:

History and why it was introduced

ISO 42001 was introduced because organisations were deploying AI faster than they could govern it, and regulators, customers and the public needed a recognised way to judge whether AI was being managed responsibly.

Main objectives:

1. Responsible development and use of AI.
2. Systematic management of AI risks and impacts on people and society.
3. Transparency and accountability for AI systems.
4. A certifiable framework that supports AI regulation.

Who needs ISO 42001?

Is ISO 42001 mandatory?

No. It is voluntary. It becomes required in practice when customers or tenders ask for it. It is not a legal compliance certificate for the EU AI Act, but it supports many of its governance obligations, such as quality management, risk management, documentation and post-market monitoring.

Key requirements

Management system (clauses 4 to 10)

Annex A control objectives

AI system impact assessment

Clause 6.1.4 requires you to assess the potential consequences of AI systems for individuals, groups and society, considering their technical and societal context. ISO/IEC 42005 gives detailed guidance. This is different from the organisational risk assessment, which looks at risks to achieving your objectives.

How to implement ISO 42001

1. Inventory AI systems you develop, provide or use, including AI features built on third-party models.
2. Decide scope and role for each: developer, provider, user, or a mix.
3. Write an AI policy approved by leadership, setting principles such as fairness, transparency, safety, privacy and accountability.
4. Assign responsibilities: an AI governance lead or committee, product owners, data owners.
5. Run AI risk assessments and impact assessments for each system.
6. Choose controls from Annex A and write the Statement of Applicability.
7. Build life cycle processes: requirements, data checks, testing for accuracy and bias, release approval, monitoring, incident handling, retirement.
8. Manage third parties: model providers, data suppliers, customers’ responsibilities.
9. Train staff in their roles.
10. Internal audit and management review, then certification audits.

If you have ISO 27001, reuse document control, internal audit, management review and corrective action processes.

Documentation and policies

• AIMS scope and AI system inventory
• AI policy and topic policies (responsible use, data, third-party AI)
• Roles and responsibilities
• AI risk assessment and treatment plan
• AI system impact assessments
• Statement of Applicability
• Data documentation (provenance, quality, preparation)
• Model and system documentation, including intended use and limitations
• Verification and validation records
• Monitoring and event logs
• Incident and concern reporting process
• Supplier and customer responsibility agreements
• Training records, internal audit reports, management review minutes

Audits and certification

Certification follows the usual ISO pattern:

1. Stage 1: documentation and readiness review.
2. Stage 2: assessment of the AIMS in operation.
3. Certificate: three years, with annual surveillance audits.

Choose a certification body accredited for ISO/IEC 42001 by a national accreditation body. ISO/IEC 42006 sets the requirements those bodies must meet.

Cost

Benefits

• Independent evidence of responsible AI for customers and regulators.
• A practical structure for EU AI Act readiness.
• Clear ownership of AI risks across product, data and engineering teams.
• Integration with ISO 27001 and ISO 27701.
• Fewer AI incidents through systematic testing and monitoring.

Risks of not having AI governance

• Unmanaged AI risks: bias, errors, data leakage, misuse.
• Failed AI procurement reviews.
• Difficulty meeting AI regulations as they come into force.

Common mistakes

• No complete AI inventory, especially shadow AI features.
• Confusing risk assessment with impact assessment.
• Copying ISO 27001 controls instead of addressing AI-specific risks such as data provenance and model drift.
• Ignoring third-party models, which still need governance.
• Treating certification as AI Act compliance.

Challenges for IT companies

• Rapid model and prompt changes that bypass normal release controls.
• Limited transparency into third-party foundation models.
• Measuring fairness and accuracy meaningfully for generative AI.
• Balancing governance with fast experimentation.

Best practices

• Integrate ISO 42001 with your ISO 27001 ISMS.
• Use the NIST AI RMF for practical risk techniques.
• Map controls to EU AI Act obligations from the start.
• Keep model cards and data sheets for every AI feature.
• Treat prompt and model changes as changes requiring evaluation.

Tools that help

How ISO 42001 relates to other frameworks

Real-world examples

• Early adopters. Several large cloud and AI providers announced ISO/IEC 42001 certification of their AI services during 2024 and 2025.
• US state law. Colorado’s AI law recognised frameworks such as ISO 42001 and the NIST AI RMF as relevant to risk management programmes.
• Illustrative scenario, not a real company: a recruitment SaaS company with ISO 27001 adds an AIMS covering its candidate-matching models. It runs impact assessments on fairness, documents training data provenance, adds human review for rejections, and certifies to ISO 42001 to support EU customers’ AI Act due diligence.

Frequently asked questions

Is ISO 42001 mandatory? No. It is voluntary, but customers increasingly ask for it.

Does ISO 42001 certification make us EU AI Act compliant? No. It supports compliance but doesn’t replace the AI Act’s specific requirements or conformity assessment.

How many controls are in ISO 42001? 38 controls in Annex A, across 9 control objectives.

Do we need ISO 27001 first? No. ISO 42001 can be certified on its own, though combining them is efficient.

Does ISO 42001 apply if we only use AI, not build it? Yes. It applies to organisations that develop, provide or use AI systems.

What is an AI system impact assessment? An assessment of how an AI system could affect individuals, groups and society, required by clause 6.1.4.

How long is the certificate valid? Three years, with yearly surveillance audits.

Next steps

• Build an inventory of AI systems you develop, provide or use.
• Write and approve an AI policy.
• Run impact assessments on your highest-risk AI features.
• Run a gap assessment against clauses 4 to 10 and Annex A.