ISO/IEC 42001 and AI management systems
ISO/IEC 42001 is the international standard for running AI governance as a management system — and the one organisations can be certified against.
Learning objectives
- Explain what ISO/IEC 42001 is and who it applies to
- Map its clauses to Plan–Do–Check–Act
- Describe Annex A control areas and the Statement of Applicability
- Place 42001 within the wider ISO/IEC AI family
- Explain how 42001, NIST AI RMF and the EU AI Act fit together
4.1 What ISO/IEC 42001 is
ISO/IEC 42001:2023, published in December 2023, is the first international standard for an AI management system (AIMS). Like ISO 27001 for information security or ISO 9001 for quality, it specifies requirements for the organisational system that governs AI — and organisations can be independently certified against it.
It applies to any organisation that develops, provides or uses AI, of any size or sector.
4.2 Structure: Plan–Do–Check–Act
ISO/IEC 42001 follows the harmonised structure shared by ISO management system standards, which makes it easy to integrate with ISO 27001 or ISO 9001.
| Clause | Requirement | PDCA |
|---|---|---|
| 4 Context | Understand the organisation, stakeholders' needs, your role(s) in AI, and the AIMS scope | Plan |
| 5 Leadership | Top management commitment, an AI policy, roles and responsibilities | |
| 6 Planning | AI risk assessment and treatment, AI system impact assessment, objectives | |
| 7 Support | Resources, competence, awareness, communication, documented information | Do |
| 8 Operation | Operational planning and control; carrying out risk assessments, treatments and impact assessments | |
| 9 Performance evaluation | Monitoring, measurement, internal audit, management review | Check |
| 10 Improvement | Nonconformity, corrective action, continual improvement | Act |
4.3 Annex A controls
Annex A provides reference controls, which organisations select based on their risk assessment and justify in a Statement of Applicability. Control areas include:
- Policies related to AI
- Internal organisation (roles, reporting concerns)
- Resources for AI systems (data, tools, systems, people)
- Assessing impacts of AI systems on individuals, groups and society
- AI system lifecycle (requirements, design, verification, deployment, operation, monitoring)
- Data for AI systems (quality, provenance, preparation)
- Information for interested parties (documentation, incident communication)
- Use of AI systems (responsible use, intended use)
- Third-party and customer relationships
Annexes B–D give implementation guidance, possible AI objectives and risk sources, and sector considerations.
4.4 The wider ISO/IEC AI family
| Standard | Covers |
|---|---|
| ISO/IEC 22989 | AI concepts and terminology |
| ISO/IEC 23894 | Guidance on AI risk management (building on ISO 31000) |
| ISO/IEC 42005 | AI system impact assessment (published 2025) |
| ISO/IEC 42006 | Requirements for bodies that audit and certify AI management systems |
| ISO/IEC 27001 | Information security management — often implemented alongside 42001 |
4.5 42001, NIST and the EU AI Act
- ISO/IEC 42001 tells you how to run an AI management system — and lets you prove it through certification.
- NIST AI RMF gives detailed, practical guidance on managing AI risks — useful content for the processes 42001 requires.
- The EU AI Act sets legal requirements. Harmonised European standards are being developed to give a presumption of conformity; 42001 doesn't automatically mean compliance, but a well-run AIMS provides much of the structure needed (risk management, documentation, monitoring, quality management).
4.6 Should you certify?
Certification can reassure customers and regulators, but it takes time and money. Many organisations align with 42001 first, then certify when customer demand or regulation makes it worthwhile. Start with scope: which parts of the organisation and which AI activities will the AIMS cover?
Key takeaways
- ISO/IEC 42001:2023 specifies requirements for a certifiable AI management system.
- Clauses 4–10 follow Plan–Do–Check–Act and integrate with ISO 27001.
- Annex A controls are selected by risk and justified in a Statement of Applicability.
- ISO/IEC 23894 (risk) and 42005 (impact assessment) complement it.
- 42001 is how you run governance; NIST guides risk work; the EU AI Act sets legal duties.