ISO 42001: The AI Management System Standard

What it is
ISO/IEC 42001 specifies the requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System - an AIMS. It applies to any organisation that provides or uses AI systems, whatever the sector and whatever the size. It is deliberately risk-based: the depth of what you implement follows from your own risk and impact assessments, not from a fixed checklist.

The structure will look familiar
The standard follows the ISO Harmonised Structure, the same clause layout as ISO/IEC 27001 and ISO 9001. If you already run an information security management system, you are not starting from zero - scope, leadership, competence, internal audit, management review and corrective action can largely be extended rather than rebuilt.

Clause 4 sets the context: scope, interested parties, and the roles your organisation plays - provider, deployer, developer, or several at once. Clause 5 puts accountability on top management and requires a documented AI policy. Clause 6 covers planning: AI risk assessment, AI risk treatment, the AI system impact assessment, and measurable objectives. Clause 7 is support - resources, competence, awareness, communication, documented information. Clause 8 is operation. Clause 9 is performance evaluation through monitoring, internal audit and management review. Clause 10 is improvement and nonconformity handling.

Annex A: 38 controls, not a checklist
Annex A lists 38 controls grouped under nine objectives, A.2 to A.10. You select from them, justify inclusions and exclusions, and record the result in a Statement of Applicability - the same mechanic as ISO 27001. Annex B gives implementation guidance and worked examples for each control. Annex C lists typical AI risk sources - bias, security, explainability, data quality, misuse - and organisational objectives to design controls against. Annex D maps the standard onto other frameworks, including ISO/IEC 27001, ISO/IEC 27701 and ISO 9001, and onto sector-specific AI use.

The artefacts you will actually produce
An AI policy signed off by top management. An inventory of AI systems with roles and intended purposes. A documented AI risk assessment and treatment plan. An AI system impact assessment - the assessment of consequences for individuals, groups and society, which is the control that most often surprises organisations coming from a pure security background. A Statement of Applicability. Data governance records covering provenance, quality and preparation. Life-cycle records: design, verification, validation, deployment, monitoring and decommissioning. Competence and awareness records. Supplier and customer arrangements for third-party AI.

How certification works
Certification is by an accredited certification body, in the usual two stages. Stage 1 reviews documentation and readiness. Stage 2 is the on-site or remote audit of the system in operation. A certificate runs for three years, with surveillance audits in years one and two and a recertification audit before the cycle ends. Most organisations run an internal gap assessment first, then a full internal audit cycle, before booking stage 1.

How it relates to the EU AI Act
This is where expectations need to be set carefully. An ISO 42001 certificate is not a conformity assessment under the AI Act and does not by itself create a presumption of conformity - that status is reserved for harmonised standards cited in the Official Journal, which CEN-CENELEC is still developing. What ISO 42001 does give you is the governance machinery the Act assumes you already have: documented roles, an AI inventory, risk and impact assessments, human oversight arrangements, life-cycle records and management review.

In practice the overlap is substantial. Organisations that build an AIMS now find that the Annex III high-risk obligations landing on 2 December 2027 are largely a matter of extending existing records rather than inventing a system under time pressure. For an organisation with no AI governance at all, ISO 42001 is the most direct route to being ready.

Is it worth it for a smaller company?
Certification is not free, and for a company with two AI use cases it may be more than is needed. The standard still earns its keep as a structure: adopt the clause layout and the Annex A catalogue, produce the artefacts, skip the certificate. If your customers are regulated entities - banks, insurers, healthcare - expect the certificate to appear in their supplier questionnaires within the next procurement cycle.

Related
The EU AI Act - deadlines and obligations
Our DORA framework
NIS2 regulatory overview