ISO/IEC 42001
ISO/IEC 42001 is the first international standard for AI management systems (AIMS). Published in December 2023, it specifies requirements for governing the development and use of AI — policies, risk assessment, lifecycle controls, and accountability — and is certifiable like ISO 27001.
What it covers
The standard follows the Annex SL management-system structure — clauses 4–10 covering context, leadership, planning, support, operation, performance evaluation, and improvement — so it slots naturally beside an existing ISO 27001 or ISO 9001 system. Annex A defines 38 controls across 9 domains, from AI policies and risk assessment processes through data quality, transparency, human oversight, and third-party AI management.
Two features distinguish it from generic IT governance: an AI-specific risk assessment covering harms to individuals, groups, and society — not just the organization — and a system-impact assessment required for each AI system in scope.
Why it matters now
The EU AI Act creates legal obligations for AI providers and deployers, and procurement teams are starting to ask for evidence of AI governance. ISO/IEC 42001 is emerging as the presumption-of-conformity vehicle: certification is voluntary, but it is becoming the fastest credible answer to the question how do you govern your AI.
Frequently Asked Questions
Is ISO/IEC 42001 certification mandatory?
No — it is voluntary. But it is increasingly requested in procurement and is strong evidence of AI governance maturity under the EU AI Act.
Who needs ISO/IEC 42001?
Any organization that develops, provides, or meaningfully deploys AI systems — especially where AI outputs affect customers, employees, or regulated decisions. Even organizations that only consume third-party AI can scope an AIMS around usage governance.
Can it integrate with an existing ISO 27001 system?
Yes — both follow the Annex SL structure, so context, leadership, document control, internal audit, and management review can be shared. Most organizations run them as one integrated management system with AI-specific extensions.
Related Standards
- •ISO/IEC 42001:2023 — AI management systems
- •ISO/IEC 23894 — AI risk management guidance
- •Regulation (EU) 2024/1689 (EU AI Act)
Free Tools & Resources
Further Reading
Need help with this?
We consult and build across all of these domains — tell us what you are working on.