What is ISO/IEC 42001?
ISO/IEC 42001 is the international standard for an artificial intelligence management system (AIMS). It specifies how an organization sets up policies, roles, processes, and controls to develop or use AI responsibly, and it is written so that an accredited certification body can audit against it. It was published in 2023 by ISO and IEC, the same standards bodies behind ISO/IEC 27001 for information security.
The standard follows the harmonized structure shared by the other ISO management system standards. Clauses 4 through 10 cover context of the organization, leadership, planning, support, operation, performance evaluation, and improvement. Companies that already hold ISO 27001 or ISO 9001 recognize the shape immediately and can extend their existing management system instead of starting a new one.
How ISO/IEC 42001 works
The clauses require an AI policy signed by top management, defined roles, a risk assessment and an AI system impact assessment for each system in scope, measurable objectives, competent staff, documented operation of the AI lifecycle, internal audit, and management review. Annex A lists the reference controls, grouped into areas such as policies, resources for AI systems, impact assessment, the system lifecycle, data, information for interested parties, responsible use, and third-party relationships. Annex B explains how to implement each control, and Annex C lists common AI objectives and risk sources to consider.
Certification works as it does for ISO 27001. A stage one audit reviews the documentation, a stage two audit checks that the system operates as written, and surveillance audits follow each year with recertification every three years.
Why ISO/IEC 42001 matters
For a company selling AI-enabled products or services, the certificate answers the governance section of a customer’s due diligence questionnaire in one line. For a buyer, it is evidence that a supplier has a working process behind its claims. It also maps well onto the EU AI Act, whose quality management system requirement for providers of high-risk AI systems covers much of the same ground.
A software company that sells a staff scheduling optimizer to hospitals pursues certification because two large health systems made it a condition of renewal. Most of the work turns out to be writing down the impact assessment process the team already follows informally and adding supplier controls for the model API the product depends on.
What to watch for
- Certification proves a management system exists and operates, and says nothing about whether any single model is accurate or fair.
- Scope matters, because a certificate can cover one product line or one site, so read the scope statement on a supplier’s certificate.
- Budget for the internal audit and management review cycle, which is where most first-year programs fall behind.
- If you hold ISO 27001, integrate the two systems, since document control, internal audit, and corrective action can be shared.