ISO 42001: the AI management system standard
ISO/IEC 42001 is the first international standard for an AI management system. It is certifiable, it is built on the same skeleton as ISO 27001, and it is the document a customer will point at when they ask how you govern the AI you are shipping.
ISO/IEC 42001, published in December 2023, sets requirements for an artificial intelligence management system. It is a governance standard, not a technical one. It does not tell you how to train a model, what accuracy to hit, or which architecture to pick. It tells you to decide what your AI is for, work out who it could affect, put controls around the way it is built and operated, check that those controls work, and fix what does not. An accredited certification body can audit you against it and issue a certificate, in the same way one does for ISO 27001.
That is the whole idea in one paragraph, and most of what is written about this standard online is vaguer than that. The rest of this page is what the standard actually contains, who it is genuinely for, and which parts of the picture are still moving.
What the standard covers
ISO 42001 uses the harmonized structure that every modern ISO management system standard uses, so clauses 4 through 10 will look immediately familiar to anyone who has been through ISO 27001 or ISO 9001. The requirements sit in those clauses. Annex A holds a set of reference controls that you consider, select from, and justify, with implementation guidance for them in a further annex.
| Clause | What it asks for |
|---|---|
| 4. Context | Define what the organization does with AI, which role you play, who the interested parties are, and where the boundary of the management system sits. |
| 5. Leadership | An AI policy signed off at the top, and named accountability for AI rather than a diffuse committee. |
| 6. Planning | AI risk assessment and treatment, plus an assessment of the system's impact on individuals and on society. Objectives with owners and dates. |
| 7. Support | Competence, awareness, communication, and control of documented information. The people running the models have to be shown to know what they are doing. |
| 8. Operation | Running the risk treatment and the impact assessment in practice, and controlling the AI system life cycle from design through retirement. |
| 9. Performance evaluation | Monitoring, internal audit, and management review. |
| 10. Improvement | Nonconformity, corrective action, and continual improvement. |
Annex A is where the standard stops looking like a template and starts looking specific to AI. Its controls are grouped under themes including AI policy, internal organization and reporting of concerns, resources for AI systems, assessing the impact of AI systems, the AI system life cycle, data for AI systems, information provided to interested parties, responsible use of AI systems, and third-party and customer relationships.
Two of those groups carry most of the weight in practice. Data for AI systems forces you to write down where training and evaluation data came from, what you are allowed to do with it, how it was prepared, and how its quality is judged. Very few teams can answer that cleanly on day one. Resources for AI systems is an inventory requirement in disguise: data, tooling, compute, and human resources for every AI system in scope. Most organizations discover during this exercise that they have more AI in production than the exec team thought, usually because a feature shipped on a third-party model API without anyone calling it an AI project.
Impact assessment is the part that is genuinely new
ISO 27001 asks what could happen to your information. ISO 42001 also asks what your system could do to the people it is pointed at, and to groups beyond your direct customers. That is a different question, it is answered by different people, and a security team on its own will not answer it well. Expect to involve legal, the product owner, and whoever knows the domain the model is deployed into.
Who actually needs it
Certification is voluntary. Nobody is required by law anywhere to hold an ISO 42001 certificate. The organizations with a real reason to pursue it fall into a few groups, and if you are not in one of them the honest answer is that you are early.
- You sell AI features to enterprise or public-sector buyers. Vendor questionnaires have started carrying AI governance sections, and a certificate answers a whole page of them at once. This is the same commercial logic that drove SOC 2 adoption, arriving about a decade later for a different subject.
- You are a provider or deployer of a high-risk AI system under the EU AI Act and need a management system anyway. More on that below.
- You are already ISO 27001 certified and AI is now material to the product. The marginal effort is far smaller than the first certification was, because the clause 4 to 10 machinery is already running.
- Your board or insurer has asked who is accountable for the model in production and the honest answer is currently nobody.
Who does not need it: a company that uses a commercial AI assistant internally and ships no AI in its own product. Buying software that has AI in it makes you a user, not a builder, and a paragraph in your acceptable use policy plus vendor due diligence covers that case. Certifying an AI management system around somebody else's chatbot is expensive theatre.
How it differs from ISO 27001
The two standards share a spine and diverge on subject and scope of harm. ISO 27001 protects information: confidentiality, integrity, availability, with the organization as the thing being defended. ISO 42001 governs AI systems, and explicitly reaches past the organization to the individuals and societies affected by the output.
| ISO 27001 | ISO 42001 | |
|---|---|---|
| Subject | Information security | AI systems and their governance |
| Published | Current edition 2022 | 2023 |
| Who is protected | The organization and its information | Also individuals and society affected by the system |
| Core risk activity | Information security risk assessment | AI risk assessment plus AI system impact assessment |
| Annex A controls | 93 controls in four themes | Reference controls across AI-specific themes including data, life cycle and third parties |
| Selection document | Statement of Applicability | Statement of Applicability, same mechanism |
| Audit cycle | Stage 1, stage 2, surveillance, three-year recertification | Same cycle |
| Market maturity | Mature, accepted worldwide | Early, and buyers are still learning what to ask for |
Because the management system clauses are shared, an organization with a working ISMS integrates 42001 rather than building beside it. One internal audit program, one management review, one document control process, one risk methodology with AI-specific criteria added to it. Running two parallel management systems is a common and avoidable mistake, and it doubles the ongoing cost forever.
The reverse order is harder. Certifying an AI management system with no information security management system underneath it is possible, but you will end up building most of ISO 27001 anyway, because access control, change management, logging and supplier management all sit under the AI controls too. If you are choosing where to start and you have neither, start with ISO 27001.
How it relates to the EU AI Act
These get conflated constantly, so be precise about it. The EU AI Act is binding law with a risk-tiered structure: some practices are prohibited outright, a defined set of high-risk uses carries heavy obligations, some systems carry transparency duties only, and the rest is largely unregulated. General-purpose AI models have their own obligations. Its requirements phase in over several years from its 2024 entry into force, and the bulk of the high-risk obligations land later than the prohibitions did.
ISO 42001 is a voluntary standard. It is not EU law, it is not written against the Act's articles, and at time of writing it is not a harmonized standard under the Act. That distinction matters: only a harmonized standard cited in the Official Journal gives a presumption of conformity, and the European standards bodies have been developing that separate set of deliverables. An ISO 42001 certificate does not make you compliant with the EU AI Act, and any consultant who tells you otherwise is selling something.
What it does do is real, though. The Act requires providers of high-risk AI systems to operate a quality management system covering documented policies and procedures across the system life cycle, risk management, data governance, post-market monitoring, record keeping and incident reporting. An ISO 42001 management system produces most of that machinery. If you build one honestly you will have done a large fraction of the underlying work, and you will have an audited paper trail to point at. Treat it as the scaffolding, not the certificate of compliance.
Where Canadian rules sit
Canada has no in-force federal statute governing private-sector AI. The Artificial Intelligence and Data Act was introduced as part of Bill C-27 and died on the order paper when Parliament was prorogued in early 2025, so anything written before then describing AIDA as upcoming law should be read with that in mind. What exists instead is a voluntary federal code of conduct for advanced generative systems, and a Treasury Board directive on automated decision-making that binds federal institutions and requires an algorithmic impact assessment. If you sell to the Government of Canada, that directive is the document that will shape the questions you get asked.
Two pieces of existing law bite regardless. Quebec's Law 25 requires organizations to inform an individual when a decision about them is based exclusively on automated processing, and to let them make representations about it. And federal and provincial privacy law applies in full to the personal information that goes into and comes out of a model, which is where PIPEDA obligations around purpose, consent and retention meet a training pipeline that quietly retained everything. An impact assessment under ISO 42001 and a privacy impact assessment overlap enough that they should be scoped together.
What is still settling
Being straight about this is more useful than pretending the picture is finished.
The certification body picture is young. ISO published a companion standard setting requirements for the bodies that audit and certify AI management systems, and national accreditation bodies have been building their programs against it since. The practical effect is that the pool of certification bodies holding accreditation specifically for ISO 42001 is far smaller than the pool for ISO 27001, and it is changing month to month. Do not take a body's word for its accreditation status. Ask which accreditation body granted it, for which standard, and check the accreditation body's own public register before you sign.
Buyer expectations are not standardized. With ISO 27001 or SOC 2 there is a shared understanding of what a procurement team is asking for. With AI governance there is not yet, so questionnaires vary wildly and some ask for things no standard produces. Expect to explain what your certificate covers rather than hand it over and be done.
Scope definition is the hard call. Nothing forces you to put every AI system in scope, and the certificate names what was covered. A narrow first scope around the systems your customers actually ask about is defensible and much faster. A scope so narrow it excludes the thing you are selling is not, and a sharp buyer will read the certificate closely enough to notice.
A sensible sequence
The first move is not to hire anyone. It is to write down every AI system your organization builds, buys or embeds, what each one decides or generates, who it affects, and what data trained it. That inventory is the input to the scope, the risk assessment, the impact assessment and any consultant quote you ask for, and it is the single artifact that determines whether the rest of the project takes six months or eighteen.
After that, decide who owns the management system. It cannot be a part-time side task for whoever built the model, because clause 5 asks for accountability that survives that person changing teams. In smaller organizations this is usually where a fractional security leader takes the role, extending an existing ISMS rather than starting fresh. Then read the certification process, cost and timeline before committing to a date.
Working out whether ISO 42001 is worth it yet
Tell us what your AI does and who is asking about it, and we will tell you whether certification helps you this year or whether a documented governance program is the better answer.
Get matchedCommon questions
Is ISO 42001 certification mandatory anywhere?
No. It is a voluntary standard and no jurisdiction requires a certificate. Obligations that are mandatory, such as those in the EU AI Act for high-risk systems, are set by law and are met by doing what the law says, not by holding a certificate. Certification is a commercial and assurance decision.
Does ISO 42001 make us compliant with the EU AI Act?
No. It is not a harmonized standard under the Act, so it confers no presumption of conformity. It does build most of the management system machinery the Act expects of providers of high-risk systems, including documented life cycle procedures, risk management, data governance and post-market monitoring, so the work is largely reusable even though the certificate is not a legal shield.
Can we certify to ISO 42001 without ISO 27001?
Yes, nothing in the standard requires it. In practice it is harder than it sounds, because the AI controls lean on access control, change management, logging and supplier management that an ISMS would already give you. Organizations that already hold ISO 27001 usually find 42001 a substantially smaller project than their first certification was.
We only use third-party AI tools. Does this apply to us?
The standard recognizes different roles, and using AI is a different position from developing or providing it, with a lighter set of relevant controls. If you ship no AI in your own product, certification is usually not the right spend. Vendor due diligence, an acceptable use policy and a record of which tools touch which data will answer most customer questions at a fraction of the cost.
How is this different from the NIST AI Risk Management Framework?
The NIST framework is voluntary guidance you self-apply, with no certification and no accredited audit behind it. ISO 42001 is a requirements standard that a third party can certify you against. They are compatible, and organizations often use the NIST material to think about risk while using ISO 42001 as the auditable management system.
How long does a first ISO 42001 certification take?
For an organization with an existing ISO 27001 management system, plan on roughly four to eight months from a decision to a stage 2 audit. Starting from no management system at all, nine to fifteen months is more realistic, and the gating item is usually the AI system inventory and the impact assessments rather than anything the auditor does.