Published in December 2023, ISO/IEC 42001 is the first international management system standard for artificial intelligence. It specifies requirements for establishing, implementing, maintaining, and continually improving an AI Management System (AIMS) — the AI equivalent of what ISO 27001 is for information security or ISO 9001 for quality.
With the EU AI Act now in force and enforcement ramping up through 2026–2027, organizations that develop or deploy AI systems need demonstrable governance. ISO/IEC 42001 provides the certifiable framework; the AI Act provides the legal obligation. They complement each other.
Who Needs ISO/IEC 42001?
The standard applies to any organization that provides or uses AI-based products or services — not just AI vendors. If you integrate a third-party LLM into customer-facing workflows, you are an AI user with governance obligations. Typical adopters include SaaS companies embedding AI features, financial institutions using ML models, healthcare providers, and public-sector bodies.
Structure: Clauses 4–10
Like all modern ISO management system standards, ISO/IEC 42001 follows the Harmonized Structure (Annex SL):
- Clause 4 — Context: define the scope of your AIMS and which AI systems it covers.
- Clause 5 — Leadership: top management accountability and an AI policy.
- Clause 6 — Planning: AI risk assessment, AI impact assessment, and measurable AI objectives.
- Clause 7 — Support: competence, awareness, communication, and documented information.
- Clause 8 — Operation: operational planning, AI system lifecycle controls, and impact assessments.
- Clause 9 — Performance evaluation: monitoring, internal audit, management review.
- Clause 10 — Improvement: nonconformity handling and continual improvement.
Annex A: The Control Catalog
Annex A defines 38 controls across 9 domains, including AI policy, internal organization, resource management, AI system impact assessment, lifecycle management, data management, information for interested parties, responsible use, and third-party relationships. You select applicable controls via a Statement of Applicability — the same mechanism as ISO 27001.
How ISO 42001 Relates to the EU AI Act
The AI Act is a regulation with risk-tiered obligations (prohibited, high-risk, limited, minimal). ISO/IEC 42001 is a voluntary management system standard. Implementing an AIMS does not replace AI Act compliance, but it gives you the governance machinery — risk processes, documentation, accountability — that regulators expect to see. Harmonized European standards under the AI Act are still being finalized; ISO/IEC 42001 is the closest internationally recognized anchor today.
ISO/IEC 42001 vs. NIST AI RMF vs. EU AI Act
These three frameworks are often confused because they overlap, but they serve different purposes:
- ISO/IEC 42001 — a certifiable management system standard. It defines the processes and documentation your organization must run continuously, and an accredited body can certify you against it.
- NIST AI RMF — a voluntary US risk management framework (Govern, Map, Measure, Manage). Excellent for structuring AI risk work, but it is guidance, not a certifiable standard.
- EU AI Act — binding law for AI placed on the EU market. Compliance is mandatory for in-scope systems; unlike the other two, non-compliance carries fines.
A common pattern is to use the NIST AI RMF to structure risk thinking, implement it through an ISO/IEC 42001 management system, and map the resulting controls to AI Act obligations. ISO/IEC 23894 (AI risk management guidance) slots in alongside as the risk-process companion to 42001.
Implementation Roadmap
A typical path from zero to certification readiness looks like this:
- Scope the AIMS (Clause 4): inventory your AI systems — including third-party models embedded in products — and decide what is in scope.
- Gap assessment: compare current practices against clauses 4–10 and Annex A to identify missing processes and controls.
- Establish governance: appoint accountable leadership, publish an AI policy, and define roles for AI development, deployment, and oversight.
- Build risk and impact assessment processes: Clause 6 requires an AI risk assessment; Clause 8 requires AI system impact assessments for each system in scope.
- Implement controls and the Statement of Applicability: apply the Annex A controls you selected and document justifications for exclusions.
- Internal audit and management review (Clause 9): verify the AIMS works before inviting external auditors.
- Certification audit: Stage 1 reviews documentation readiness; Stage 2 verifies the system operates in practice.
Evidence and Documentation Auditors Expect
Auditors will ask for documented information at every stage. The most commonly requested artifacts are: the AIMS scope statement, the AI policy, an AI system inventory, completed AI system impact assessments, risk assessment and treatment records, the Statement of Applicability, competence and training records, supplier/third-party AI assessments, internal audit reports, and management review minutes. Treating documentation as a byproduct of running the processes — rather than a pre-audit paperwork exercise — is what separates smooth certifications from painful ones.
Evidence expectations also matter commercially: enterprise procurement teams increasingly ask vendors for AI governance artifacts in security questionnaires and RFPs, and an ISO/IEC 42001 certificate is becoming a recognized shorthand answer.
Assess Your Readiness in 10 Minutes
Before engaging consultants or auditors, get a baseline. Our free ISO 42001 AI Readiness Assessment walks you through all clauses and Annex A controls, produces a maturity score, a prioritized gap list, and a downloadable PDF report — entirely in your browser, no data uploaded.
If you already run ISO 27001 or ISO 9001, much of the management-system scaffolding transfers. You can also check those baselines with our ISO 27001 Gap Analysis and ISO 9001 Readiness Checker.
Frequently Asked Questions
Is ISO/IEC 42001 certification mandatory?
No — it is voluntary. But it is increasingly requested in procurement and is strong evidence of AI governance maturity under the EU AI Act.
How long does implementation take?
For organizations with an existing ISO management system, typically 4–8 months. Starting from scratch, expect 9–18 months depending on the number and risk profile of AI systems in scope.
Can it be integrated with ISO 27001?
Yes — both share the Harmonized Structure, so context, leadership, audit, and improvement processes can be integrated into a single management system.
Does ISO/IEC 42001 apply if we only use third-party AI?
Yes. The standard covers organizations that use AI-based products or services, not just those that develop them. Third-party AI relationships have a dedicated Annex A control domain covering supplier assessment and responsible use.
Is ISO/IEC 42001 required in procurement?
Not legally, but enterprise buyers increasingly ask for AI governance evidence in security questionnaires and RFPs. A certificate — or a documented readiness assessment — is becoming a recognized shorthand answer to those questions.
