ISO 42001, formally ISO/IEC 42001:2023, is the international standard for an AI management system (AIMS). Published in December 2023, it sets requirements for how an organisation governs the AI it develops, provides or uses: policy, roles, risk and impact assessment, lifecycle controls and continual improvement. It is voluntary and certifiable by accredited certification bodies.
Key takeaways
- ISO/IEC 42001 is a management system standard, like ISO/IEC 27001 for information security, but focused on the responsible development and use of AI.
- Clauses 4 to 10 follow the ISO Harmonised Structure, so it integrates with 27001, 27701 and 9001.
- Annex A lists reference controls, commonly counted as 38 controls under nine objectives; Annex B gives implementation guidance, Annex C lists AI objectives and risk sources, Annex D covers use across sectors.
- Certification follows a stage 1 and stage 2 audit, then annual surveillance audits over a three-year cycle.
- Certification does not equal EU AI Act compliance, but it builds much of the governance the Act expects.
What ISO/IEC 42001 is
ISO/IEC 42001 was developed by the joint ISO and IEC subcommittee on artificial intelligence, ISO/IEC JTC 1/SC 42, and published by ISO in December 2023 as the first certifiable AI management system standard. Its full title is "Information technology — Artificial intelligence — Management system".
A management system is the set of policies, processes, roles and records an organisation uses to reach its objectives in a controlled way. ISO 42001 applies that idea to AI. It does not tell you which model to use or set technical thresholds for accuracy. Instead it requires you to decide what responsible AI means for your organisation, assess the risks and impacts of your AI systems, apply suitable controls, measure whether they work and improve them.
The standard applies to any organisation that provides or uses AI-based products or services, regardless of size, sector or whether it is public or private. That includes model developers, software companies that embed AI, and organisations that simply deploy third-party AI such as an HR screening tool or a Copilot rollout. If you are starting from zero, our free AI governance assessment shows where you stand across ten areas and writes your AI Governance Framework.
Need help with cloud?
Book a free 30-minute meeting with one of our cloud specialists. We'll analyse your situation and provide actionable recommendations — no obligation, no cost.
How the standard is structured
ISO 42001 uses the Harmonised Structure shared by ISO management system standards. Clauses 1 to 3 cover scope, normative references and terms. The requirements sit in clauses 4 to 10:
| Clause | Topic | What it asks for in AI terms |
|---|---|---|
| 4 | Context of the organisation | Understand internal and external issues, including your role relative to AI systems (for example developer, provider or user), interested parties and the scope of the AIMS. |
| 5 | Leadership | Top management commitment, an AI policy and assigned roles and responsibilities. |
| 6 | Planning | AI risk assessment, AI risk treatment with a statement of applicability, AI system impact assessment, and measurable AI objectives. |
| 7 | Support | Resources, competence, awareness, communication and documented information. |
| 8 | Operation | Run the planned processes: carry out risk assessments, risk treatment and impact assessments at planned intervals and when significant changes occur. |
| 9 | Performance evaluation | Monitoring, measurement, internal audit and management review. |
| 10 | Improvement | Nonconformity, corrective action and continual improvement. |
The AI-specific weight sits in clause 6. Unlike ISO 27001, ISO 42001 requires an AI system impact assessment: an assessment of the potential consequences of AI systems for individuals, groups of individuals and societies. That is the part of the standard that reaches beyond risk to the organisation and looks at the people affected. A practical starting point is a structured AI risk assessment template that covers both organisational and human impacts.
The annexes
- Annex A, reference control objectives and controls. Controls are grouped into nine areas, A.2 to A.10: policies related to AI; internal organisation; resources for AI systems; assessing impacts of AI systems; AI system life cycle; data for AI systems; information for interested parties; use of AI systems; and third-party and customer relationships. The total is usually cited as 38 controls. As with ISO 27001, you decide which controls apply and justify exclusions in a statement of applicability.
- Annex B, implementation guidance for each Annex A control.
- Annex C, potential AI-related organisational objectives and risk sources, such as fairness, security, safety, privacy, transparency, robustness and the level of automation.
- Annex D, use of the AI management system across domains or sectors, including integration with other management system standards.
For the exact wording, normative status of each annex and current amendments, consult the purchased standard. Summaries vary, and only the text counts in an audit.
Related standards in the family
ISO 42001 sits within a wider set of AI standards from SC 42. The ones most often used alongside it:
- ISO/IEC 22989: AI concepts and terminology.
- ISO/IEC 23894: guidance on AI risk management, built on ISO 31000.
- ISO/IEC 42005: guidance on AI system impact assessment, published in 2025.
- ISO/IEC 42006: requirements for bodies that audit and certify AI management systems, published in July 2025. It adds AI-specific competence and audit requirements on top of ISO/IEC 17021-1.
Who ISO 42001 is for
Three groups tend to pursue it first.
- AI product companies and SaaS vendors that are asked by enterprise customers to prove responsible AI practice in procurement. A certificate shortens vendor questionnaires.
- Organisations already certified to ISO 27001 or 27701, which can extend an existing management system with modest extra overhead because the clause structure is the same.
- Regulated organisations deploying AI at scale, such as banks, insurers, healthcare providers and public bodies, that want a defensible, auditable governance framework while EU AI Act obligations phase in.
Smaller organisations using only a few off-the-shelf AI tools often get more value from implementing the core practices first, such as an AI policy, an inventory, risk assessment and vendor checks, before deciding whether formal certification is worth it.
The ISO 42001 certification process
Certification is carried out by an independent certification body. Look for a body accredited for ISO 42001 by a national accreditation body that is a signatory to international recognition arrangements, such as UKAS in the UK, SWEDAC in Sweden or ANAB in the US. Accredited bodies are assessed against ISO/IEC 17021-1 and ISO/IEC 42006. Unaccredited certificates exist and are worth less in procurement.
- Scope. Define which organisational units, AI systems and roles are in scope. A narrow, clear scope is easier to certify and to defend.
- Gap assessment. Compare current practice with clauses 4–10 and Annex A.
- Implementation. Write the AI policy, define roles, run risk and impact assessments, select controls, write the statement of applicability, train staff and start producing records.
- Internal audit and management review. Both are mandatory before certification and must have actually taken place.
- Stage 1 audit. The auditor reviews documentation, scope and readiness, and identifies concerns that could block stage 2.
- Stage 2 audit. The auditor tests whether the system is implemented and effective, through interviews, records and sampling. Nonconformities must be corrected before the certificate is issued.
- Surveillance audits. Normally annual in years two and three.
- Recertification. A recertification audit before the three-year certificate expires.
Effort and timeline
There is no standard price or duration, and anyone quoting one without knowing your scope is guessing. The main factors are:
| Factor | Why it changes the effort |
|---|---|
| Existing management systems | An ISO 27001 or 27701 certified organisation already has document control, internal audit, management review and risk methodology. |
| Scope and number of AI systems | Each in-scope system needs risk and impact assessment and lifecycle controls. |
| Your role | Developers and providers have far more lifecycle and data controls to evidence than organisations that only use third-party AI. |
| Headcount and locations | Certification bodies calculate audit days partly from the number of people in scope and sites. |
| Maturity of AI governance | If you have no AI inventory or policy, foundational work comes first. |
Organisations that build on an existing ISO 27001 system typically move faster because they reuse the management-system machinery and focus on the AI-specific clauses and controls.
ISO 42001 and ISO 27001 compared
| Aspect | ISO/IEC 27001 | ISO/IEC 42001 |
|---|---|---|
| Subject | Information security | Responsible development, provision and use of AI |
| Structure | Harmonised Structure, clauses 4–10 | Harmonised Structure, clauses 4–10 |
| Annex A | 93 controls (2022 edition) | Reference controls in nine objectives, usually cited as 38 |
| Risk focus | Confidentiality, integrity, availability of information | Risks to the organisation plus impacts on individuals, groups and society |
| Distinctive requirement | Information security risk treatment | AI system impact assessment |
The two are complementary. AI security, including prompt injection, model supply chain and data leakage, still relies on information security controls. Many organisations run one integrated management system with shared processes and separate statements of applicability. For context, Opsio's India operations are certified to ISO/IEC 27001 and ISO/IEC 27701; Opsio does not hold ISO/IEC 42001 certification.
ISO 42001 and the EU AI Act
The EU AI Act is binding law with obligations tied to risk tier and role, for example a risk management system and quality management system for providers of high-risk AI. ISO 42001 is a voluntary, organisation-wide management system. Certification does not give a presumption of conformity with the Act; that comes only from harmonised standards whose references are published in the Official Journal under Article 40 of Regulation (EU) 2024/1689, and those are still being developed by CEN-CENELEC as of October 2026. Even so, an AIMS gives you the governance, risk processes and records you will need. The detailed comparison and a requirement-by-requirement mapping are in ISO 42001 vs the EU AI Act.
If you are deciding where to begin, the key pillars of AI governance give a plain overview, and an EU AI Act gap analysis shows how a standards programme and regulatory readiness can be planned together.
Frequently asked questions
What is ISO 42001 in simple terms?
It is an international standard that describes how to run AI responsibly as a managed process. You set an AI policy, assign responsibilities, assess the risks and impacts of each AI system, apply controls, check that they work and keep improving. An independent auditor can certify that your management system meets the standard.
Is ISO 42001 certification mandatory?
No. ISO/IEC 42001 is voluntary. Some customers ask for it in procurement, and it can support regulatory readiness, but no EU law requires certification. The EU AI Act has its own binding requirements, which apply depending on whether you are a provider or deployer and on the system's risk tier.
How long does ISO 42001 certification take?
It depends on scope, the number of AI systems, your role and whether you already run an ISO 27001 management system. You need enough time to implement processes and generate records, run an internal audit and management review, then pass stage 1 and stage 2 audits. Ask certification bodies for an audit-day estimate based on your scope.
Does ISO 42001 certification mean we comply with the EU AI Act?
No. Certification shows that your AI management system meets the standard. The AI Act sets specific legal obligations, such as technical documentation, conformity assessment and registration for high-risk providers, and transparency duties under Article 50. ISO 42001 supports many of them, but you still need to map and meet each obligation.
Who can certify ISO 42001?
Independent certification bodies. Prefer one accredited for ISO/IEC 42001 by a national accreditation body, such as UKAS, SWEDAC or ANAB. Accredited bodies must meet ISO/IEC 17021-1 and the AI-specific ISO/IEC 42006, which sets competence and audit requirements for AI management system certification.
Can I combine ISO 42001 with ISO 27001?
Yes. Both use the Harmonised Structure, so policies, document control, internal audit and management review can be shared in one integrated management system. You maintain separate risk assessments and statements of applicability for each standard's controls.
Start with a governance baseline
Whether or not you pursue certification, the first step is knowing where you stand. Opsio's free AI governance and readiness assessment takes about 40 minutes across 14 steps and scores your maturity across ten governance areas. On submission it writes four editable Word documents from your answers: an AI Governance Framework, an AI Acceptable Use Policy, an AI Vendor Due Diligence Checklist and an AI Risk Assessment Template. Free, no card, no obligation. For hands-on support, see our AI governance consulting.
This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, and the published text of ISO/IEC 42001. Statements are as of October 2026.
Written By
Country Manager, India
Praveena leads Opsio's India operations, bringing 17+ years of cross-industry experience spanning AI, manufacturing, DevOps, and managed services.
Editorial standards: This article was written by cloud practitioners and reviewed by our engineering team. We revise it when the technology or regulation it covers changes; the dates on this page show the latest update. Opsio maintains editorial independence.