ISO 42001: the AI management system standard
ISO/IEC 42001 is the first international standard for an AI management system. It is certifiable, it is built on the same skeleton as ISO 27001, and it is the document a customer will point at when they ask how you govern the AI you are shipping.
ISO/IEC 42001, published in December 2023, sets requirements for an artificial intelligence management system. It is a governance standard, not a technical one. It does not tell you how to train a model, what accuracy to hit or which architecture to pick. It tells you to decide what your AI is for, work out who it could affect, put controls around the way it is built and operated, check that those controls work, and fix what does not. An accredited certification body can audit you against it and issue a certificate, the same way one does for ISO 27001.
Two parts of an AI management system are worth their own page: the AI risk assessment, which is where most implementations stall, and how ISO 42001 compares with the NIST AI Risk Management Framework, which is the question American buyers ask first.
What the standard covers
The clauses, which will look familiar
ISO 42001 uses the harmonized structure every modern ISO management system standard uses, so clauses 4 through 10 will look familiar to anyone who has been through ISO 27001 or ISO 9001. The requirements sit in those clauses. Annex A holds reference controls that you consider, select from and justify, with implementation guidance in a further annex.
| Clause | What it asks for |
|---|---|
| 4. Context | Define what the organization does with AI, which role you play, who the interested parties are, and where the boundary of the management system sits. |
| 5. Leadership | An AI policy signed off at the top, and named accountability for AI rather than a diffuse committee. |
| 6. Planning | AI risk assessment and treatment, plus an assessment of the system's impact on individuals and on society. Objectives with owners and dates. |
| 7. Support | Competence, awareness, communication, and control of documented information. The people running the models have to be shown to know what they are doing. |
| 8. Operation | Running the risk treatment and the impact assessment in practice, and controlling the AI system life cycle from design through retirement. |
| 9. Performance evaluation | Monitoring, internal audit, and management review. |
| 10. Improvement | Nonconformity, corrective action, and continual improvement. |
Annex A, which will not
Annex A is where the standard stops looking like a template. Its controls are grouped under themes including AI policy, internal organization and reporting of concerns, resources for AI systems, assessing the impact of AI systems, the AI system life cycle, data for AI systems, information provided to interested parties, responsible use of AI systems, and third-party and customer relationships.
The two control groups that carry the weight
Two of those groups carry most of the weight. Data for AI systems forces you to write down where training and evaluation data came from, what you are allowed to do with it, how it was prepared and how its quality is judged. Few teams can answer that cleanly on day one. Resources for AI systems is an inventory requirement in disguise: data, tooling, compute and human resources for every AI system in scope. Most organizations find they have more AI in production than the exec team thought, usually because a feature shipped on a third-party model API without anyone calling it an AI project.
Impact assessment is the new part
ISO 27001 asks what could happen to your information. ISO 42001 also asks what your system could do to the people it is pointed at, and to groups beyond your direct customers. Different question, different people. A security team on its own will not answer it well. Involve legal, the product owner and whoever knows the domain the model is deployed into.
Who actually needs it
Certification is voluntary. No law anywhere requires an ISO 42001 certificate. The organizations with a real reason to pursue it fall into a few groups. If you are not in one of them, you are early.
Four reasons that hold up
- You sell AI features to enterprise or public-sector buyers. Vendor questionnaires have started carrying AI governance sections, and a certificate answers a whole page of them at once. Same commercial logic that drove SOC 2 adoption, a decade later and on a different subject.
- You are a provider or deployer of a high-risk AI system under the EU AI Act and need a management system anyway. More on that below.
- You are already ISO 27001 certified and AI is now material to the product. The clause 4 to 10 machinery is already running, so the marginal effort is far smaller than the first certification was.
- Your board or insurer has asked who is accountable for the model in production and the honest answer is currently nobody.
Who does not need it
A company that uses a commercial AI assistant internally and ships no AI in its own product. Buying software with AI in it makes you a user, not a builder. A paragraph in your acceptable use policy plus vendor due diligence covers it. Certifying an AI management system around somebody else's chatbot is expensive theatre.
Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.
How it differs from ISO 27001
The clause-by-clause comparison, the overlap between the two annexes and the cost of an integrated audit against two separate ones are on ISO 42001 compared with ISO 27001.
Same spine, different subject
They share a spine and diverge on subject and scope of harm. ISO 27001 protects information: confidentiality, integrity, availability, with the organization as the thing being defended. ISO 42001 governs AI systems and reaches past the organization to the individuals and societies affected by the output.
| ISO 27001 | ISO 42001 | |
|---|---|---|
| Subject | Information security | AI systems and their governance |
| Published | Current edition 2022 | 2023 |
| Who is protected | The organization and its information | Also individuals and society affected by the system |
| Core risk activity | Information security risk assessment | AI risk assessment plus AI system impact assessment |
| Annex A controls | 93 controls in four themes | Reference controls across AI-specific themes including data, life cycle and third parties |
| Selection document | Statement of Applicability | Statement of Applicability, same mechanism |
| Audit cycle | Stage 1, stage 2, surveillance, three-year recertification | Same cycle |
| Market maturity | Mature, accepted worldwide | Early, and buyers are still learning what to ask for |
Which order to do them in
The management system clauses are shared, so an organization with a working ISMS integrates 42001 rather than building beside it. One internal audit program, one management review, one document control process, one risk methodology with AI-specific criteria added. Running two parallel management systems doubles the ongoing cost forever.
The reverse order is harder. You can certify an AI management system with no ISMS underneath it, but you will build most of ISO 27001 anyway. Access control, change management, logging and supplier management all sit under the AI controls too. If you have neither and are choosing where to start, start with ISO 27001.
How it relates to the EU AI Act
What the Act is
These two get conflated constantly. The EU AI Act is binding law with a risk-tiered structure: some practices are prohibited outright, a defined set of high-risk uses carries heavy obligations, some systems carry transparency duties only, and the rest is largely unregulated. General-purpose AI models have their own obligations. Its requirements phase in over several years from its 2024 entry into force, and the bulk of the high-risk obligations land later than the prohibitions did.
What the certificate does not buy you
ISO 42001 is a voluntary standard. It is not EU law, it is not written against the Act's articles, and at time of writing it is not a harmonized standard under the Act. Only a harmonized standard cited in the Official Journal gives a presumption of conformity, and the European standards bodies have been developing that separate set of deliverables. An ISO 42001 certificate does not make you compliant with the EU AI Act, and any consultant who tells you otherwise is selling something.
What it does buy you
The Act requires providers of high-risk AI systems to operate a quality management system covering documented policies and procedures across the system life cycle, risk management, data governance, post-market monitoring, record keeping and incident reporting. An ISO 42001 management system produces most of that machinery, and leaves you an audited paper trail to point at. Treat it as the scaffolding, not the certificate of compliance.
Where Canadian rules sit
There is no AI statute in force
Canada has no in-force federal statute governing private-sector AI. The Artificial Intelligence and Data Act was introduced as part of Bill C-27 and died on the order paper when Parliament was prorogued in early 2025. Anything written before then describing AIDA as upcoming law should be read with that in mind. What exists instead is a voluntary federal code of conduct for advanced generative systems, and a Treasury Board directive on automated decision-making that binds federal institutions and requires an algorithmic impact assessment. If you sell to the Government of Canada, that directive shapes the questions you get asked.
Two pieces of law that bite today
Two pieces of existing law bite regardless. Quebec's Law 25 requires organizations to inform an individual when a decision about them is based exclusively on automated processing, and to let them make representations about it. And federal and provincial privacy law applies in full to the personal information that goes into and comes out of a model. That is where PIPEDA obligations around purpose, consent and retention meet a training pipeline that quietly retained everything. An impact assessment under ISO 42001 and a privacy impact assessment overlap enough to be scoped together.
What is still settling
The certification body picture is young. ISO published a companion standard setting requirements for the bodies that audit and certify AI management systems, and national accreditation bodies have been building their programs against it since. So the pool of certification bodies holding accreditation for ISO 42001 is far smaller than the pool for ISO 27001, and it changes month to month. Do not take a body's word for its accreditation status. Ask which accreditation body granted it, for which standard, and check that body's own public register before you sign.
Buyer expectations are not standardized. With ISO 27001 or SOC 2 there is a shared understanding of what a procurement team is asking for. With AI governance there is not, so questionnaires vary wildly and some ask for things no standard produces. Expect to explain what your certificate covers rather than hand it over and be done.
Scope definition is the hard call. Nothing forces you to put every AI system in scope, and the certificate names what was covered. A narrow first scope around the systems your customers ask about is defensible and much faster. A scope so narrow it excludes the thing you are selling is not, and a sharp buyer reads the certificate closely enough to notice.
A sensible sequence
Two things to settle first. Whether what a customer means by AI certification is this standard at all, which is on what can and cannot be certified. And whether you are in scope and what it would take, which the readiness check works out from six questions.
Start with the inventory
The first move is not to hire anyone. Write down every AI system your organization builds, buys or embeds, what each one decides or generates, who it affects, and what data trained it. That inventory feeds the scope, the risk assessment, the impact assessment and any consultant quote you ask for, and it decides whether the rest of the project takes six months or eighteen.
Then decide who owns it
Then decide who owns the management system. It cannot be a part-time side task for whoever built the model. Clause 5 asks for accountability that survives that person changing teams. In smaller organizations this is where a fractional security leader takes the role, extending an existing ISMS rather than starting fresh. Then read the certification process, cost and timeline before committing to a date.
Working out whether ISO 42001 is worth it yet
Tell us what your AI does and who is asking about it, and we will tell you whether certification helps you this year or whether a documented governance program is the better answer.
Get matchedCommon questions
Is ISO 42001 certification mandatory anywhere?
No. It is a voluntary standard and no jurisdiction requires a certificate. Obligations that are mandatory, such as those in the EU AI Act for high-risk systems, are set by law and are met by doing what the law says, not by holding a certificate. Certification is a commercial and assurance decision.
Does ISO 42001 make us compliant with the EU AI Act?
No. It is not a harmonized standard under the Act, so it confers no presumption of conformity. It does build most of the management system machinery the Act expects of providers of high-risk systems, including documented life cycle procedures, risk management, data governance and post-market monitoring, so the work is largely reusable even though the certificate is not a legal shield.
Can we certify to ISO 42001 without ISO 27001?
Yes, nothing in the standard requires it. In practice it is harder than it sounds, because the AI controls lean on access control, change management, logging and supplier management that an ISMS would already give you. Organizations that already hold ISO 27001 usually find 42001 a substantially smaller project than their first certification was.
We only use third-party AI tools. Does this apply to us?
The standard recognizes different roles, and using AI is a different position from developing or providing it, with a lighter set of relevant controls. If you ship no AI in your own product, certification is usually not the right spend. Vendor due diligence, an acceptable use policy and a record of which tools touch which data will answer most customer questions at a fraction of the cost.
How is this different from the NIST AI Risk Management Framework?
The NIST framework is voluntary guidance you self-apply, with no certification and no accredited audit behind it. ISO 42001 is a requirements standard that a third party can certify you against. They are compatible, and organizations often use the NIST material to think about risk while using ISO 42001 as the auditable management system.
How long does a first ISO 42001 certification take?
For an organization with an existing ISO 27001 management system, plan on roughly four to eight months from a decision to a stage 2 audit. Starting from no management system at all, nine to fifteen months is more realistic, and the gating item is usually the AI system inventory and the impact assessments rather than anything the auditor does.