What ISO 42001 is
ISO/IEC 42001:2023 is the first international standard for an Artificial Intelligence Management System. Published in December 2023, it specifies how an organization establishes, implements, maintains and improves the governance of AI it develops, provides or uses.
It sits in the same family as ISO 27001 and ISO 9001 — a certifiable management system standard, audited by an accredited certification body, valid for three years with surveillance.
What it does not do: certify that a model is safe, accurate or unbiased. It certifies that you govern AI deliberately, with documented processes, assigned accountability and assessed impact. That distinction matters when a customer asks what the certificate proves.
Why it exists now
Three pressures converged. Enterprise procurement started asking how AI is governed and found no standard answer. Regulators, principally through the EU AI Act, began requiring governance that organizations could not evidence. And organizations deploying AI discovered their existing ISMS said nothing about models, training data or automated decisions.
ISO 42001 gives all three a common reference. That is its value — not that it is technically demanding, but that it is the shared vocabulary that did not previously exist.
The clause structure
Standard Annex SL, identical in shape to ISO 27001 and ISO 9001:
| Clause | Requirement |
|---|---|
| 4 — Context | Interested parties, AIMS scope, the organization role as AI developer, provider or user |
| 5 — Leadership | AI policy, roles and responsibilities, top management commitment |
| 6 — Planning | Risk assessment and treatment, AI impact assessment, objectives |
| 7 — Support | Resources, competence, awareness, communication, documented information |
| 8 — Operation | Operational planning, risk treatment, impact assessment in practice |
| 9 — Evaluation | Monitoring, internal audit, management review |
| 10 — Improvement | Nonconformity, corrective action, continual improvement |
If you have been through ISO 27001 this is familiar ground, and largely reusable — see ISO 27001 to ISO 42001.
Annex A: 38 controls, nine areas
Annex A supplies the controls, and as with ISO 27001 you consider all of them and justify which apply rather than implementing every one.
| Area | Focus |
|---|---|
| A.2 Policies related to AI | AI policy and its alignment with other policies |
| A.3 Internal organization | Roles, responsibilities, raising concerns |
| A.4 Resources for AI systems | Data, tooling, compute, people |
| A.5 Assessing impacts | Impact on individuals, groups and society |
| A.6 AI system life cycle | Objectives through design, verification, deployment, operation |
| A.7 Data for AI systems | Acquisition, quality, provenance, preparation |
| A.8 Information for interested parties | Transparency, documentation, incident reporting |
| A.9 Use of AI systems | Responsible use, intended purpose, monitoring |
| A.10 Third-party relationships | Suppliers, customers, allocation of responsibility |
Full detail in the 38 Annex A controls.
The AI impact assessment
The requirement with no ISO 27001 equivalent, and the one that defines the standard.
A conventional risk assessment asks what could harm the organization. An AI impact assessment asks what the system could do to the people it affects. Who is subject to its outputs, what happens when it is wrong, whether outcomes could be unfair, what human oversight exists, and how an affected person contests a result.
Documented per AI system, revisited when systems change materially — which for most AI estates is frequently.
How certification works
The same two-stage process as any ISO management system standard. Stage 1 reviews documentation and readiness; Stage 2 tests whether the AIMS operates. The certificate lasts three years, with surveillance in years two and three and recertification at the end.
One practical constraint worth knowing: the pool of certification bodies accredited for ISO 42001 is still small relative to demand, so scheduling is frequently the binding constraint on your certification date rather than your own readiness.
ISO 42001 and the regulation around it
| ISO 42001 | EU AI Act | NIST AI RMF | |
|---|---|---|---|
| Nature | Certifiable standard | Legislation | Voluntary framework |
| Binding | No | Yes, in the EU | No |
| Certificate | Yes | Conformity assessment for high-risk systems | None |
| Scope | Organizational governance | Systems by risk tier | Risk management practice |
They are complementary rather than alternatives. See ISO 42001 vs the EU AI Act and ISO 42001 vs NIST AI RMF.
FAQs
What is ISO 42001?
ISO/IEC 42001:2023 is the first international standard for an Artificial Intelligence Management System. Published in December 2023, it specifies requirements for governing AI an organization develops, provides or uses, and it is certifiable by an accredited certification body for a three-year term.
Is ISO 42001 mandatory?
No. It is a voluntary standard. What drives adoption is enterprise procurement asking how AI is governed, and regulatory pressure such as the EU AI Act creating a need for governance organizations can actually evidence.
How many controls does ISO 42001 have?
38 controls in Annex A, organised across nine areas covering AI policy, internal organization, resources, impact assessment, the AI system life cycle, data, transparency, use, and third-party relationships. As with ISO 27001, you consider all of them and justify which apply.
Does ISO 42001 certify that my AI is safe?
No, and this is the most common misunderstanding. It certifies that you govern AI deliberately — documented processes, assigned accountability, assessed impact. It makes no claim about the accuracy, safety or fairness of any particular model.
How long does ISO 42001 certification last?
Three years, with surveillance audits in years two and three and recertification at the end, following the same cycle as other ISO management system standards.
Where to go next
See ISO 42001 certification services, what it costs, or how to extend an existing ISO 27001 system.