The ISO 42001 AI management system is the world’s first certifiable standard for governing artificial intelligence responsibly, published by ISO and IEC in December 2023 as ISO/IEC 42001:2023. As organisations race to deploy machine learning, generative AI, and automated decision-making, this standard gives them a structured, auditable way to manage the risks and opportunities that AI creates. This guide explains what the standard requires, who needs it, how to implement and certify it, and how it differs from related frameworks.
Whether you build AI systems, buy them, or embed them in your products, an ISO 42001 AI management system helps you demonstrate to customers, regulators, and partners that your organisation manages AI with appropriate diligence, transparency, and accountability.
What is the ISO 42001 AI management system?
ISO/IEC 42001:2023 is a management system standard (MSS) for artificial intelligence. It specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system, commonly abbreviated as AIMS. It is the first international standard dedicated to AI governance and is designed to be certifiable by accredited third parties.
Like ISO 27001 (information security) and ISO 9001 (quality), the ISO 42001 AI management system follows the ISO Harmonized Structure, a common clause framework shared across modern management system standards. This makes it straightforward to integrate AI governance into an organisation that already runs other ISO management systems.
The standard is risk-based and technology-neutral. It does not tell you which AI techniques to use or ban. Instead, it asks you to identify your AI-related risks and impacts, set objectives, apply appropriate controls, and prove you are managing everything through a documented, repeatable process.
Why the standard matters now
AI introduces risks that traditional governance frameworks were not built to handle: bias and fairness, explainability, data provenance, model drift, autonomy, and impacts on individuals and society. A dedicated AI management system provides a defensible, recognised structure for addressing these issues. It also signals maturity to buyers who increasingly ask vendors how they govern AI before signing contracts.
Who needs an ISO 42001 AI management system?
The standard is deliberately broad. It applies to any organisation that provides or uses products or services that utilise AI, regardless of size or sector. In practice, several groups benefit most:
- AI developers and vendors building models, platforms, or AI-enabled software who need to prove responsible development practices.
- Enterprises deploying AI in hiring, credit, healthcare, insurance, or other high-stakes contexts where poor decisions carry real consequences.
- Public sector and regulated bodies that must demonstrate accountability and fairness in automated decisions.
- Suppliers to large enterprises facing AI-governance questions in procurement and vendor due diligence.
- Consultancies and integrators that embed third-party AI into client solutions and need to manage inherited risk.
You do not need to build your own models to benefit. Organisations that only consume AI, for example through APIs or off-the-shelf tools, still carry accountability for how those systems affect their customers and can certify accordingly.
Key requirements and structure of the standard
ISO/IEC 42001:2023 uses the ISO Harmonized Structure, so its core requirements sit in clauses 4 through 10. Each clause builds on the previous one to form a continual improvement loop often described as Plan-Do-Check-Act.
| Clause | Focus area | What it asks you to do |
|---|---|---|
| 4 | Context of the organisation | Define your AIMS scope, interested parties, and the role your organisation plays (developer, provider, user). |
| 5 | Leadership | Secure top-management commitment, set an AI policy, and assign roles and responsibilities. |
| 6 | Planning | Address AI risks and opportunities, conduct AI risk assessment, and set measurable AI objectives. |
| 7 | Support | Provide resources, competence, awareness, communication, and documented information. |
| 8 | Operation | Implement operational controls and, critically, carry out AI system impact assessments. |
| 9 | Performance evaluation | Monitor, measure, audit internally, and run management reviews. |
| 10 | Improvement | Handle nonconformities, take corrective action, and continually improve the system. |
The distinctive requirement: AI system impact assessment
What sets the ISO 42001 AI management system apart from earlier management standards is its explicit demand for an AI system impact assessment. This is a structured evaluation of how an AI system could affect individuals, groups, and society, including consequences for rights, safety, fairness, and wellbeing. It goes beyond a data-protection or security lens and forces you to think about downstream real-world outcomes.
Annex A controls
The standard includes Annex A, a reference set of controls you can apply to treat identified AI risks. As of the current version, Annex A lists approximately 38 controls organised into roughly 9 control areas, covering topics such as AI policies, internal organisation, resources, impact assessment, AI system lifecycle, data management, information for interested parties, and third-party and supplier relationships. Verify the exact count against the latest published text, as ISO periodically revises annexes. Unlike a rigid checklist, you select and justify controls based on your risk assessment, documented in a statement of applicability.
Step-by-step implementation and certification process
Achieving certification for your ISO 42001 AI management system follows a familiar management-system path. A typical route looks like this:
- 1. Secure leadership sponsorship. Get executive buy-in, budget, and a named owner for the AIMS.
- 2. Define scope and context. Decide which AI systems, business units, and locations the system covers, and identify interested parties.
- 3. Perform a gap analysis. Compare current practice against the standard to see where you already comply and where work is needed.
- 4. Conduct AI risk and impact assessments. Identify AI-specific risks and complete impact assessments for relevant systems.
- 5. Build the documentation set. Draft your AI policy, procedures, statement of applicability, and records.
- 6. Implement controls. Apply the selected Annex A controls and operational processes across the AI lifecycle.
- 7. Train and raise awareness. Ensure staff understand their roles and the AI policy.
- 8. Run internal audit and management review. Test the system, fix nonconformities, and confirm leadership oversight.
- 9. Stage 1 certification audit. An accredited certification body reviews your documentation and readiness.
- 10. Stage 2 certification audit. The auditor assesses implementation and effectiveness on site or remotely, then issues certification if you conform.
- 11. Surveillance and recertification. Ongoing surveillance audits (typically annual) and a full recertification cycle (typically every three years) maintain your certificate.
Some organisations pursue a formal self-attestation or readiness assessment first, then move to accredited certification once the AI management system is mature. Choose an accredited certification body to ensure your certificate carries recognition.
Documentation involved
The standard requires documented information rather than a fixed template. A well-run AI management system typically maintains:
- An AI policy and supporting objectives.
- The defined scope of the AIMS.
- An AI risk assessment methodology and results.
- AI system impact assessment records.
- A statement of applicability documenting selected Annex A controls.
- Roles, responsibilities, and competence records.
- Operational procedures across the AI system lifecycle, including data management.
- Internal audit reports, management review minutes, and corrective-action logs.
Timeline and cost drivers
Timelines vary widely with organisation size, AI complexity, and existing maturity. Companies already certified to ISO 27001 often reach certification in roughly three to six months; those starting from scratch may need six to twelve months or more. Treat these as indicative ranges, not guarantees.
Cost is driven by scope breadth, number and risk level of AI systems, whether you use consultants or toolkits, internal effort, and certification-body fees for both the initial audit and ongoing surveillance. Reusing existing ISO management-system infrastructure substantially lowers both time and cost.
Common challenges and how to avoid them
Implementers of an ISO 42001 AI management system frequently hit a few recurring obstacles:
- Treating it as a technical project. AI governance is a leadership and process discipline, not just an engineering task. Involve legal, compliance, and business owners early.
- Underestimating impact assessments. Teams often lack a repeatable method. Build a template and criteria before you start assessing systems.
- Vague scope. An over-broad scope stalls projects. Start with your highest-risk or highest-value AI systems and expand later.
- Confusing certification with legal compliance. Certification proves good governance; it is not automatic regulatory compliance. Map obligations separately.
- Neglecting third parties. Much AI risk is inherited from vendors and foundation models. Extend controls to your supply chain.
How ISO 42001 compares to a related framework
The most common comparison is with the EU AI Act. They are fundamentally different instruments. ISO/IEC 42001 is a voluntary, certifiable management-system standard focused on how you govern AI. The EU AI Act is binding legislation that imposes obligations based on the risk level of specific AI use cases. Certifying to the standard can support your compliance efforts and evidence good practice, but it does not replace or guarantee legal compliance with the EU AI Act or any other law.
| Aspect | ISO/IEC 42001:2023 | EU AI Act |
|---|---|---|
| Nature | Voluntary international standard | Binding EU regulation |
| Focus | AI management system and governance | Risk-based rules for AI systems and uses |
| Scope | Any organisation, globally | AI placed on or used in the EU market |
| Outcome | Accredited certification | Legal obligations and penalties |
| Enforcement | Certification bodies | Regulators and authorities |
This article is for general guidance only and is not legal or regulatory advice. Consult qualified counsel about your obligations under the EU AI Act or any applicable law.
You can review the official standard on the ISO website for authoritative scope and purchasing details.
Frequently asked questions
Is ISO 42001 certification the same as complying with AI law?
No. Certification demonstrates that you operate a sound AI management system, but it is not a substitute for legal compliance. Regulations such as the EU AI Act impose separate obligations you must meet independently. This is not legal advice; confirm your duties with qualified counsel.
How many controls does Annex A contain?
As of the current version, Annex A lists approximately 38 controls across roughly 9 control areas. Because ISO revises annexes over time, verify the exact figures against the latest published edition of the standard.
Can we certify if we only use third-party AI?
Yes. The ISO 42001 AI management system applies to organisations that use AI, not only those that build it. You define your role and scope accordingly and manage the risks you are accountable for.
How long does certification take?
It depends on your starting maturity. Organisations with existing ISO management systems may certify in roughly three to six months, while others may need a year or more. Treat these as indicative ranges.
Do we need ISO 27001 first?
No, ISO 27001 is not a prerequisite. However, an existing information security management system shares the same Harmonized Structure, so it can significantly accelerate and reduce the cost of building your AI management system.
Who can issue an ISO 42001 certificate?
Accredited certification bodies issue certificates following a Stage 1 and Stage 2 audit. Choosing an accredited body ensures your certificate is recognised by customers and partners.
Related guides
- ISO 42001 requirements checklist: clause-by-clause guide
- ISO 42001 vs ISO 27001: key differences explained
- ISO 42001 Annex A controls: a practical overview
- The ISO 42001 certification process, step by step
- ISO 42001 and the EU AI Act: how they fit together
Ready to get started? Our editable ISO/IEC 42001:2023 toolkit gives you ready-to-use policies, procedures, risk and impact assessment templates, and a statement of applicability to fast-track your AI management system. Explore the ISO 42001 toolkit and build a certification-ready AIMS in a fraction of the time.