What ISO 42001 Is
ISO/IEC 42001:2023 is the first international standard for an Artificial Intelligence Management System (AIMS). It sets out requirements for establishing, implementing, maintaining and improving how an organization governs its use and development of AI — policy, roles, risk, the AI system life cycle, data, transparency, and third-party relationships.
It is a management system standard in the same family as ISO 27001 and ISO 9001, which means two practical things: it is certifiable by an accredited certification body, and it uses the same Annex SL structure, so if you have been through ISO 27001 the shape is familiar.
What it is not: a technical standard for models, a safety certification for a specific AI system, or compliance with any particular regulation. It certifies that you govern AI deliberately, not that any given model is safe.
Who Needs It
Formally, any organization that develops, provides or uses AI systems. That definition is broad enough to include most software companies that have shipped a feature in the last two years.
In practice, demand comes from three directions:
Enterprise procurement. Security questionnaires now routinely ask how AI is governed, who reviews model changes, and what happens to customer data used in inference. ISO 42001 is the shortest credible answer.
Regulatory pressure. The EU AI Act has made AI governance a board-level question even for US-only companies with European customers.
Existing certification pressure. Companies already holding ISO 27001 or SOC 2 are being asked to extend that assurance to AI, and discovering their ISMS does not cover it.
| If you… | ISO 42001 relevance |
|---|---|
| Build AI features into a product you sell | High — you are an AI provider and procurement will ask |
| Use third-party AI to process customer data | High — you are an AI user with governance obligations |
| Use AI only internally, no customer data | Moderate — governance still applies, urgency lower |
| Sell into the EU | High — the AI Act makes this a compliance question, not a marketing one |
Clauses and Annex A
Like every Annex SL standard, ISO 42001 has management system requirements in clauses 4 to 10 — context, leadership, planning, support, operation, performance evaluation and improvement — plus a set of controls in Annex A.
Annex A contains 38 controls across nine areas:
| Area | Covers |
|---|---|
| A.2 Policies related to AI | AI policy, alignment with other organizational policies |
| A.3 Internal organization | Roles, responsibilities, reporting of concerns |
| A.4 Resources for AI systems | Data, tooling, compute, human resources |
| A.5 Assessing impacts of AI systems | The AI impact assessment — distinctive to this standard |
| A.6 AI system life cycle | Objectives, design, verification, deployment, operation |
| A.7 Data for AI systems | Acquisition, quality, provenance, preparation |
| A.8 Information for interested parties | Transparency, documentation, incident reporting |
| A.9 Use of AI systems | Responsible use, intended purpose, monitoring |
| A.10 Third-party relationships | Suppliers, customers, allocation of responsibility |
As with ISO 27001, you consider all 38 and justify which apply — you do not mechanically implement every one. See the Annex A controls in detail.
The AI Impact Assessment
This is the requirement with no equivalent in ISO 27001, and the one that surprises teams.
ISO 42001 requires you to assess the potential consequences of your AI systems for individuals, groups and society — not only the risk to your organization. A conventional risk assessment asks what could harm the business. An AI impact assessment asks what the system could do to the people it affects.
In practice that means documenting, per AI system: its intended purpose and reasonably foreseeable misuse, who is affected and how, potential for bias or unfair outcomes, the consequences of the system being wrong, what human oversight exists, and how affected people can contest an outcome.
It is the part of ISO 42001 that most resembles what regulators are asking for, which is why it carries weight beyond the certificate itself.
Our ISO 42001 Engagement
1. AIMS scope. Which AI systems, which teams, which data. As with any management system, scope drives audit days and therefore cost for three years.
2. AI system inventory. What you actually run, including the third-party models embedded in features nobody catalogued. This stage routinely surfaces systems the security team did not know about.
3. AI impact assessments. Per system, covering affected parties, foreseeable misuse and oversight.
4. Risk assessment and treatment. Organizational risk alongside impact, feeding control selection.
5. Annex A implementation. The applicable controls across the nine areas, with evidence assembled as we go.
6. Internal audit and management review. Both mandatory clauses, both required before the certification audit.
7. Stage 1 and Stage 2 support. We prepare your team and sit with you through both.
If You Already Hold ISO 27001
You are further along than you think. Both standards use the Annex SL structure, so clauses 4 to 10 are largely shared — you already have a management system, an internal audit function, a management review cadence, and a documented risk methodology.
| Element | Reusable from ISO 27001? |
|---|---|
| Clauses 4–10 management system | Largely — extend scope to AI |
| Internal audit programme | Yes, extend coverage |
| Management review | Yes, add AI inputs |
| Risk methodology | Yes, though impact differs from risk |
| Supplier management | Largely, extend to AI providers |
| AI impact assessment | No — genuinely new work |
| AI system life cycle controls | No — new |
| Data provenance and quality | Partly, but AI-specific requirements go further |
Running both as one integrated management system is meaningfully cheaper than treating them as separate programmes, and it is how we would normally scope it. See ISO 27001 to ISO 42001, or start with ISO 27001 if you hold neither — an Avantcert ISO 27001 engagement starts at $4,000.
Get a Scoped ISO 42001 Quote
Tell us what AI systems you run and whether you already hold ISO 27001. Scoped estimate within 24 hours.
Our form could not load. Email your AI system scope and you'll get the same estimate within 24 hours.
Email your requirements Open the full quote formISO 42001 FAQs
What is ISO 42001?
ISO/IEC 42001:2023 is the first international standard for an Artificial Intelligence Management System. It specifies requirements for establishing, implementing, maintaining and continually improving how an organization governs AI — covering policy, roles, risk, the AI system life cycle, data, transparency and third-party relationships. It is certifiable by an accredited certification body.
Who needs ISO 42001 certification?
Any organization that develops, provides or uses AI systems — which increasingly means any SaaS company that has shipped an AI feature. In practice demand is driven by enterprise procurement asking how AI is governed, and by regulatory pressure such as the EU AI Act, rather than by the standard itself.
How many controls are in ISO 42001?
Annex A of ISO 42001 contains 38 controls organised across nine areas: policies related to AI, internal organization, resources for AI systems, assessing impacts of AI systems, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships.
Is ISO 42001 the same as the EU AI Act?
No. The EU AI Act is legislation with legal obligations and penalties; ISO 42001 is a voluntary certifiable management system standard. Certifying to ISO 42001 does not make you compliant with the Act, but a functioning AI management system is a substantial part of the governance the Act expects, and the two are frequently pursued together.
Does ISO 27001 help with ISO 42001?
Considerably. Both use the Annex SL harmonized structure, so clauses 4 to 10 — context, leadership, planning, support, operation, evaluation and improvement — are largely shared. An organization with a working ISMS already has the management system scaffolding, the internal audit function and the management review cadence, and adds the AI-specific controls and the AI impact assessment on top.
How long is ISO 42001 certification valid?
Three years, following the same cycle as other ISO management system standards: a Stage 1 and Stage 2 certification audit, surveillance audits in years two and three, and recertification at the end of year three.
Related Reading
See what ISO 42001 certification costs, the 38 Annex A controls, how it compares to the EU AI Act and the NIST AI RMF, or start from what an AI management system is.
Official reference: ISO/IEC 42001:2023.
Govern AI before a customer asks how you do
Scoped estimate and an implementation roadmap within 24 hours.
Everything on ISO 42001
The first AI management system standard, and what it costs to certify.
- What ISO 42001 costs — priced by AI estate rather than headcount
- Coming from ISO 27001 — what carries over and what does not