What is it?
ISO 42001 is a recipe for running AI responsibly as an organisation: have policies, assign responsibility, assess risks, control the lifecycle and keep improving. Companies can be independently audited to show they follow it.
Also known as: ISO 42001, ISO/IEC 42001, AI management system, AIMS, ISO AI standard, ISO 42001 certification, ISO 23894, AI management standard.
Technical definition
Published in December 2023 as ISO/IEC 42001:2023, it follows the harmonised ISO management-system structure and includes controls (annex) addressing AI policy, internal organisation, resources, impact assessment, lifecycle, data, information for interested parties, use, and third-party relationships. Certification is a statement about the organisation's management system, not product performance. Relationship to regulation (for example mapping to the EU AI Act through harmonised standards) is evolving and must be verified.
Entity type: standard · Freshness class: volatile.
When should I use it?
Useful for organisations that need demonstrable, auditable AI governance.
Implementation patterns
- Gap assessment against clauses and Annex controls.
- Integrate with existing ISO 27001/9001 systems.
- Internal audit before certification audit.
- Management review cycles.
Technologies and frameworks
Commonly associated: ISO management-system tooling, accredited certification bodies. Names are examples of what exists, not recommendations, and projects change quickly.
Practical guide
- Define scope and context.
- Gap assess.
- Implement controls.
- Internal audit.
- Certification audit.
Common failure modes
- Assuming certification proves model safety.
- Paper compliance with no operational change.
- Scope drawn too narrowly to be meaningful.
Troubleshooting
- Unclear scope — Define which AI systems and activities are in the management system scope.
Contrasted with
- NIST AI Risk Management Framework — RMF is a voluntary risk framework; ISO 42001 is a certifiable management-system standard.
- EU AI Act — ISO 42001 is voluntary; the Act is binding law.
Questions this page answers
- What is ISO 42001?
- Is ISO 42001 mandatory?
- ISO 42001 vs NIST AI RMF?
- How do I get ISO 42001 certified?
Typical goals: decide whether to pursue ISO 42001 certification; compare ISO 42001 with the NIST AI RMF.
Sources and verification
Status: not independently verified. This entry was authored on 2026-10-06 from general technical knowledge, without live checking of the sources below. Treat every source as a lead to confirm (identifier, title, authorship, current version) before publication or citation.
Freshness class: volatile — Products, versions, protocols, benchmarks, leaderboards, regulations and dates. Verify against the primary source before relying on specifics; re-review every 3 months.
Time-sensitive claims to verify before relying on them:
- Certification landscape and relation to EU harmonised standards.
Canonical sources (unverified leads):
- ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system — iso.org (purchase/summary page)