Short answer: ISO/IEC 42001 is the international standard for an AI management system (AIMS): the policies, roles, risk processes, and controls an organization uses to develop, provide, or use AI responsibly. It was published in December 2023 and follows the same management-system structure as ISO/IEC 27001, so companies that already run an information security program can reuse much of it. Certification is issued by an accredited, independent certification body after an audit. Most mid-sized companies should start with a gap analysis, an AI inventory, and an AI policy before deciding whether formal certification is worth it.
What is ISO/IEC 42001?
ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system. It applies to any organization that develops, provides, or uses AI-based products or services, not only AI vendors.
The standard doesn’t tell you which AI tools to use or ban. It requires you to run AI the way a mature organization runs security or quality: with defined scope, accountable leadership, documented risk decisions, and evidence that controls work.
Like other ISO management-system standards, it has two parts:
- Clauses 4–10 (mandatory requirements): context, leadership, planning, support, operation, performance evaluation, and improvement.
- Annex A (reference controls): a catalogue of AI-specific controls. You select the ones that apply and justify any exclusions in a Statement of Applicability. Annexes B–D give implementation guidance and context.
What does ISO/IEC 42001 require?
| Area | What you need in practice |
|---|---|
| Context and scope | Which AI systems, business units, and roles the AIMS covers; your role (developer, provider, or user of AI) |
| Leadership and AI policy | A documented AI policy approved by top management, with assigned roles and responsibilities |
| AI risk assessment | A repeatable method to identify and evaluate AI risks such as data exposure, bias, unreliable output, and misuse |
| AI system impact assessment | An assessment of how an AI system could affect individuals, groups, and society |
| Controls and treatment | Selected Annex A controls, a Statement of Applicability, and a risk treatment plan |
| AI system life cycle | Defined practices for design, data, testing, deployment, monitoring, and retirement of AI systems |
| Data for AI | Controls over data quality, provenance, and preparation |
| Third parties | Rules for AI suppliers, customers, and shared responsibilities |
| Performance evaluation | Monitoring, internal audit, and management review |
| Improvement | Corrective actions and continual improvement |
How does ISO 42001 relate to ISO 27001 and the NIST AI RMF?
ISO/IEC 27001 protects information. ISO/IEC 42001 governs AI systems and their effects. Because both use the same clause structure, you can run them as one integrated program: one management review, one internal audit schedule, one document control process, and a shared risk method. If you already have ISO 27001, expect a meaningful head start. See our ISO 27001 consulting page for that side.
The NIST AI Risk Management Framework (AI RMF 1.0) is voluntary US guidance organized into four functions: Govern, Map, Measure, and Manage. It isn’t certifiable. Many organizations use the AI RMF to shape their risk practices and ISO/IEC 42001 as the auditable management system around them. The two fit together well. The frameworks we support page shows how they overlap.
Do mid-sized companies need ISO 42001 certification?
Usually not right away. Certification makes sense when:
- Customers require it. Enterprise buyers increasingly ask AI vendors for evidence of AI governance in security questionnaires and contracts.
- You sell AI-enabled products or services and want a recognized, third-party signal of responsible AI practices.
- You already hold ISO 27001 and can extend the program at lower marginal cost.
If none of those apply, building the core of the standard without certifying still pays off: an AI inventory, an AI policy, a risk assessment process, and clear ownership. That foundation answers most customer questions and makes certification much faster later. Start with an AI acceptable use policy and a broader AI governance program.
How does ISO 42001 certification work?
Certification follows the familiar ISO pattern:
- Readiness. Gap analysis, AIMS design, policies, risk and impact assessments, and Statement of Applicability.
- Operate the system. Run the processes long enough to produce evidence, including an internal audit and a management review.
- Stage 1 audit. The certification body reviews your documentation and readiness.
- Stage 2 audit. The certification body tests whether the AIMS is implemented and effective.
- Surveillance. Periodic audits keep the certificate valid, with recertification on a multi-year cycle.
Choose a certification body that is accredited to certify ISO/IEC 42001. Consultants who help you prepare should be independent of the body that audits you.
A practical readiness path
| Step | Output |
|---|---|
| 1. Inventory AI | A list of AI tools, features, and systems in use or in development, including unapproved “shadow AI” |
| 2. Define scope and role | Which systems and teams are in scope; whether you develop, provide, or use AI |
| 3. Write the AI policy | Leadership-approved policy plus an acceptable use policy for staff |
| 4. Assess risk and impact | AI risk register entries (see cybersecurity risk register) and impact assessments for higher-risk systems |
| 5. Select controls | Annex A mapping and Statement of Applicability |
| 6. Operate and measure | Evidence, monitoring, internal audit, and management review |
| 7. Decide on certification | Go to Stage 1, or keep the AIMS as an uncertified program |
For companies that build LLM or agent-based features, the life-cycle controls benefit from a structured design review. The OWASP Top 10 for LLM Applications is a useful checklist for that work.
Frequently Asked Questions
Is ISO/IEC 42001 mandatory?
No. It’s a voluntary standard. It becomes effectively required when a customer, partner, or contract asks for it, which is becoming more common for companies that sell AI-enabled products.
How long does ISO 42001 readiness take?
It depends on how many AI systems are in scope and whether you already run a management system such as ISO 27001. Organizations with an existing ISO 27001 program can reuse much of their structure, which shortens the timeline considerably.
Can we combine ISO 42001 and ISO 27001 audits?
Often, yes. Because both standards share the same clause structure, many certification bodies can audit them together or on an aligned schedule. Confirm the approach with your certification body.
Does ISO 42001 apply if we only use AI tools and don’t build them?
Yes. The standard covers organizations that use AI as well as those that develop or provide it. For AI users, the focus is on approved tools, data handling, supplier review, and oversight of how AI output is used.
How USCIBER can help
USCIBER’s AI Security & Governance service prepares organizations for ISO/IEC 42001: AI inventory, gap analysis, AI policies, risk and impact assessment processes, Statement of Applicability, and audit readiness. We prepare you for certification, which is issued by an accredited certification body. If you also need ISO 27001, both programs can be built together. AI work is scoped after a short call. Engagements are led by security leadership holding CISSP, CISA, and CISM credentials. Book a free consultation.
Sources
- ISO — ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system
- ISO — ISO/IEC 27001, Information security management systems
- NIST — AI Risk Management Framework (AI RMF 1.0)
This article is general information, not legal advice.