ISO/IEC 42001: AI Management System Guide

As AI features move into almost every software product, clients are asking new questions: how do you decide what AI to build, how do you test it, who is accountable when it goes wrong, and how do you use customer data? ISO/IEC 42001 is the first international, certifiable management system standard for artificial intelligence. It gives AI developers, providers and users a structured way to govern AI responsibly and to prove it. This guide explains what ISO 42001 requires, its Annex A controls, how it relates to the EU AI Act, and how IT companies can get certified, especially if they already hold ISO 27001.

What is ISO 42001?

ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organisation. It addresses challenges specific to AI, such as transparency, explainability, bias, autonomy, and continuous learning, through a familiar management system approach.

Full form and definition

The full title is ISO/IEC 42001:2023, Information technology: Artificial intelligence, Management system. An AI management system (AIMS) is the set of policies, objectives, processes and controls an organisation uses to develop, provide or use AI systems responsibly.

Law, standard or certification?

It is a voluntary standard supporting accredited certification. ISO/IEC 42006, published in 2025, sets requirements for bodies that audit and certify AI management systems.

History and background of ISO 42001

ISO and IEC's joint committee on artificial intelligence (ISO/IEC JTC 1/SC 42) developed the standard, publishing it in December 2023. It builds on earlier SC 42 standards, including ISO/IEC 22989 (AI concepts and terminology) and ISO/IEC 23894 (guidance on AI risk management). Accredited certification schemes were launched by national accreditation bodies during 2024 and 2025. ISO/IEC 42005, guidance on AI system impact assessment, was published in 2025.

Why was ISO 42001 introduced?

Organisations were adopting AI faster than they were building governance for it. Regulators were drafting AI laws, and customers wanted assurance. A management system standard gives a repeatable, auditable way to govern AI that works across jurisdictions and alongside other ISO systems.

Main objectives and purpose

• Govern the development, provision and use of AI responsibly.
• Identify and treat AI-specific risks and impacts on individuals and society.
• Embed controls across the AI life cycle, from design to retirement.
• Provide independent assurance to customers and regulators.
• Integrate AI governance with security, privacy and quality management.

Who needs ISO 42001?

• SaaS companies with AI features, such as copilots, chatbots, recommendations and scoring
• AI product companies and model developers
• IT services companies building AI solutions for clients
• Enterprises using AI in HR, finance, customer service or operations
• Companies selling into the EU that want a governance foundation for the EU AI Act

ISO 42001 is international. It is increasingly requested in enterprise procurement in Europe, North America and India, and is relevant to India's AI governance guidelines issued in November 2025.

Key requirements of ISO 42001

Management system clauses

• Context (clause 4): your role (AI developer, provider, user, or several), the intended purpose of AI systems, interested parties, legal requirements and AIMS scope.
• Leadership (clause 5): AI policy, commitment and roles.
• Planning (clause 6): AI risk assessment and treatment, a Statement of Applicability, AI system impact assessment covering consequences for individuals, groups and society, and AI objectives.
• Support (clause 7): resources, competence, awareness, communication and documented information.
• Operation (clause 8): operational planning, carrying out risk treatment and impact assessments.
• Performance evaluation (clause 9): monitoring, internal audit and management review.
• Improvement (clause 10): nonconformity, corrective action and continual improvement.

Annex A control objectives

ISO 42001 Annex A control areas

Area	Examples
Policies related to AI	AI policy and its alignment with other policies
Internal organisation	Roles, responsibilities and reporting of concerns
Resources for AI systems	Data, tooling, computing and human resources
Assessing impacts of AI systems	Impact assessment process and documentation
AI system life cycle	Objectives, design, verification and validation, deployment, operation, monitoring and technical documentation
Data for AI systems	Data acquisition, quality, provenance and preparation
Information for interested parties	Documentation for users, reporting incidents and communication
Use of AI systems	Responsible use processes and intended use
Third-party and customer relationships	Allocating responsibilities with suppliers and customers

Annex B gives implementation guidance, Annex C lists potential AI objectives and risk sources (such as fairness, transparency, robustness, safety and privacy), and Annex D covers use across domains and sectors.

How to implement ISO 42001: step by step

1. Inventory AI systems, including third-party models and AI features in purchased tools.
2. Define your roles and scope: which products, teams and AI uses are in the AIMS.
3. Set an AI policy and governance roles, such as an AI governance committee.
4. Define risk and impact assessment methods covering harms to individuals and society as well as to the business.
5. Assess each AI system and select controls, recording them in the Statement of Applicability.
6. Implement life cycle controls: requirements, data governance, evaluation and testing (accuracy, bias, robustness), human oversight, documentation, monitoring and incident handling.
7. Manage suppliers, including model providers, with clear responsibilities.
8. Train staff on responsible AI and their roles.
9. Monitor AI systems in production and review incidents and drift.
10. Run internal audit and management review, then certify through Stage 1 and Stage 2 audits.

Documentation required

• AIMS scope and AI policy
• Roles and responsibilities
• AI system inventory
• AI risk assessment and treatment plan
• AI system impact assessments
• Statement of Applicability
• Data governance records and technical documentation for AI systems
• Evaluation and testing results
• Monitoring records and AI incident reports
• Supplier agreements and responsibility allocation
• Training records, internal audit reports and management reviews

Audit and certification requirements

Certification follows the standard ISO cycle: Stage 1 and Stage 2 audits, annual surveillance and recertification every three years. Choose a certification body accredited for ISO/IEC 42001. Integrated audits with ISO 27001 and ISO 27701 are common and reduce cost.

Estimated implementation timeline

Typical ISO 42001 timeline

Starting point	Time to certification
Existing ISO 27001 ISMS and a small number of AI systems	4 to 6 months
No ISO management system, several AI products	6 to 9 months
Complex AI portfolio across business units	9 to 12 months

Cost considerations

• Certification body fees
• Consultancy for gap assessment and impact assessment methods
• Evaluation and monitoring tooling for models
• Staff time for AI governance, documentation and testing

Benefits of ISO 42001

• Independent proof of responsible AI governance for customers and partners.
• A practical foundation for EU AI Act and other AI law obligations.
• Fewer AI incidents through structured testing and monitoring.
• Faster AI-related due diligence in enterprise sales.
• Integration with existing security and privacy management systems.

Risks of not having ISO 42001

There are no fines for not certifying. The risks are unmanaged AI harms, failed procurement assessments, and weaker evidence when regulators or customers ask how AI risks are controlled.

Common implementation mistakes

• Leaving third-party AI APIs out of the inventory.
• Copying information security risk assessments without considering impacts on people.
• Treating impact assessment as a one-time document.
• No monitoring of model performance and drift after deployment.
• Assuming ISO 42001 certification equals legal compliance.

Challenges for IT companies

• Limited transparency from foundation model providers.
• Fast-changing AI features and frequent model updates.
• Measuring fairness and robustness meaningfully for each use case.
• Allocating responsibilities with clients in custom AI projects.

Best practices and recommendations

• Integrate ISO 42001 with ISO 27001 and ISO 27701 into one management system.
• Make AI risk and impact assessment part of product discovery.
• Define evaluation criteria and acceptance thresholds before building.
• Keep model cards or similar documentation for each AI system.
• Map AIMS controls to EU AI Act and GDPR obligations.

Tools and technologies that help

• AI governance platforms for inventory, assessments and approvals
• Model evaluation, bias testing and red-teaming tools
• ML observability for drift and performance monitoring
• Data lineage and dataset documentation tools
• GRC platforms supporting integrated ISO evidence

Relationship with other compliance frameworks

ISO 42001 and related frameworks

Framework	Relationship
EU AI Act	ISO 42001 supports risk management, documentation and monitoring duties; it is not a harmonised standard
ISO 27001	Same management system structure; security controls for AI systems
ISO 27701	Privacy management for personal data used in AI
GDPR	Applies to personal data in AI training and inference
NIST CSF	Cybersecurity outcomes that complement AI governance

Real-world implementation examples

The following are illustrative composites based on common patterns, not named clients.

HR SaaS company

An HR software company with AI-assisted candidate matching extended its ISO 27001 ISMS to an AIMS, ran impact assessments covering bias against protected groups, added recruiter override and explanation features, and certified in five months.

IT services company building AI solutions

A services company created a standard AI project playbook with risk and impact assessment templates, evaluation criteria and a responsibility matrix for clients, and certified its AI delivery practice.

Frequently asked questions

What is ISO 42001?

The international standard for AI management systems, published in December 2023, that organisations can be certified against.

Is ISO 42001 mandatory?

No. It is voluntary, though customers increasingly ask for it.

Does ISO 42001 certification mean EU AI Act compliance?

No. It supports compliance with many processes but does not cover every legal requirement.

Who can get ISO 42001 certified?

Any organisation that develops, provides or uses AI systems.

How many controls are in ISO 42001 Annex A?

38 controls grouped under nine control objectives.

What is an AI system impact assessment?

An assessment of the potential consequences of an AI system for individuals, groups and society, required by ISO 42001 and guided by ISO/IEC 42005.

Do we need ISO 27001 before ISO 42001?

No, but having ISO 27001 makes implementation faster and allows integrated audits.

How long does ISO 42001 certification take?

Typically 4 to 9 months, depending on scope and existing management systems.

Does ISO 42001 apply if we only use third-party AI models?

Yes. Organisations that use or integrate AI can implement an AIMS covering their role and responsibilities.

Conclusion and next steps

ISO 42001 gives IT companies a credible, certifiable answer to "how do you govern AI?" It works best when built into product development and integrated with security and privacy management.

1. Inventory AI systems and define your roles.
2. Set an AI policy and governance structure.
3. Run risk and impact assessments.
4. Implement life cycle controls and monitoring.
5. Certify, ideally alongside ISO 27001.

How we keep this guide up to date

We review this guide every six months and whenever ISO/IEC publishes amendments or new supporting AI standards, or AI laws change in ways that affect how ISO 42001 is used.