ISO/IEC 42001
ISO/IEC 42001: requirements, controls and certification
In short
ISO/IEC 42001:2023 is the international standard for an artificial intelligence management system (AIMS). It sets requirements for establishing, implementing, maintaining and continually improving how an organisation governs the AI it develops, provides or uses. It is certifiable by accredited third-party auditors, and it was published in December 2023.
Key takeaways
- ISO/IEC 42001 certifies a management system across your organisation, not an individual AI product or model.
- It follows the ISO harmonised structure (clauses 4 to 10) and adds Annex A, with 38 controls in nine control objectives.
- Annex A controls are a reference set. You justify what applies in a Statement of Applicability, much as with ISO/IEC 27001.
- Certification does not equal EU AI Act compliance. The standard is not cited as a harmonised standard under the Act.
- Certification bodies are held to ISO/IEC 42006:2025, and ISO/IEC 42005:2025 gives guidance on AI system impact assessment.
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is the first international management-system standard for AI. Edition 1 was published in December 2023 by ISO and IEC. It is for organisations that provide or use AI-based products or services, and it applies whatever their size or sector.
It is a management-system standard, so it asks whether you have the policies, roles, processes and records to govern AI consistently. It does not test whether a given model is accurate or safe. It is voluntary, but customers, procurement teams and regulators increasingly ask about it.
The standard text is licensed and sold by ISO and national standards bodies. Buy it from ISO or your national body before building a programme on it.
What are the ISO 42001 requirements?
The mandatory requirements sit in clauses 4 to 10, which follow the common ISO harmonised structure used by ISO/IEC 27001 and ISO 9001. An organisation seeking certification must meet all of them.
| Clause | Topic | What it asks for |
|---|---|---|
| 4 | Context of the organisation | Understand internal and external issues, interested parties, and the scope and boundaries of the AIMS |
| 5 | Leadership | Top-management commitment, an AI policy, defined roles and authorities |
| 6 | Planning | AI risk assessment and treatment, AI system impact assessment, objectives, planned changes |
| 7 | Support | Resources, competence, awareness, communication, documented information |
| 8 | Operation | Operational planning and control, risk assessments and impact assessments carried out and recorded |
| 9 | Performance evaluation | Monitoring and measurement, internal audit, management review |
| 10 | Improvement | Continual improvement, nonconformity and corrective action |
Clauses 1 to 3 cover scope, normative references and terms. The requirements start at clause 4.
What are the ISO 42001 Annex A controls?
Annex A is a reference set of 38 controls grouped into nine control objectives (A.2 to A.10). You decide which apply through your risk and impact assessments and record the reasoning in a Statement of Applicability. Annex B gives implementation guidance for the controls.
| Objective | Subject | Controls |
|---|---|---|
| A.2 | Policies related to AI | 3 |
| A.3 | Internal organisation | 2 |
| A.4 | Resources for AI systems | 5 |
| A.5 | Assessing impacts of AI systems | 4 |
| A.6 | AI system life cycle | 9 |
| A.7 | Data for AI systems | 5 |
| A.8 | Information for interested parties | 4 |
| A.9 | Use of AI systems | 3 |
| A.10 | Third-party and customer relationships | 3 |
Control counts per objective come from secondary summaries of the standard. Check them against your licensed copy.
How does ISO 42001 certification work?
An accredited certification body audits your AIMS against the standard and issues a certificate if it conforms. The process follows the usual ISO management-system pattern, and timelines depend on scope and maturity.
- Define the scope of the AIMS: which AI systems, business units and roles.
- Run a gap assessment, then build the AI policy, risk and impact assessment methods, and the controls you need.
- Complete the Statement of Applicability and gather operating records.
- Carry out an internal audit and a management review.
- Stage 1 audit: the certification body reviews documentation and readiness.
- Stage 2 audit: it tests whether the system is implemented and effective. Nonconformities must be closed before certification.
- Surveillance audits follow, normally annually, and the certificate is typically renewed at three-year intervals. Confirm the cycle with your chosen body.
Does ISO 42001 make you compliant with the EU AI Act?
No. ISO/IEC 42001 certification is not proof of compliance with the EU AI Act. A presumption of conformity under Article 40 applies only to harmonised standards cited in the Official Journal. ISO/IEC 42001 is not part of the EU's harmonisation programme, and the Commission's AI Office signalled in 2024 that it was not fully aligned with the final text.
CEN-CENELEC's JTC 21 is drafting European standards for the Act. The quality management system standard prEN 18286 entered public enquiry on 30 October 2025. As of mid-2026 reporting, no harmonised standard supporting the Act had been cited in the Official Journal. Check current status before relying on a standard.
The overlap is still useful. Management-system discipline, risk and impact assessment, documentation and monitoring map onto parts of Article 9 (risk management) and Article 17 (quality management). Mapping is evidence of good practice, not a legal defence. Ask a lawyer where it matters.
How does ISO 42001 differ from the NIST AI RMF?
ISO/IEC 42001 is a certifiable management-system standard with auditable requirements. The NIST AI Risk Management Framework, released on 26 January 2023, is voluntary guidance organised around Govern, Map, Measure and Manage, with no certification scheme.
Many organisations use both: NIST for risk practice and vocabulary, ISO/IEC 42001 for a structure an auditor can assess.
How AIGovernr helps
AIGovernr includes an ISO/IEC 42001 readiness view that lists the standard's controls with their implementation status and an evidence reference, and shared controls let one control support several frameworks. It holds reference metadata and guidance, not the text of the licensed standard. A readiness result is not certification, which only an accredited certification body can grant.
Frequently asked questions
Is ISO 42001 mandatory?
No. ISO/IEC 42001 is voluntary. No law requires certification. Organisations adopt it to show customers and partners that AI is governed in a structured, auditable way, or to answer procurement and due-diligence questions. Regulations such as the EU AI Act have their own obligations that certification does not replace.
How many controls are in ISO 42001?
Annex A lists 38 controls in nine control objectives, numbered A.2 to A.10. They are reference controls rather than a checklist. You select those that apply based on your risk and impact assessments and record any exclusions, with reasons, in a Statement of Applicability.
How long does ISO 42001 certification take?
It varies with scope, size and existing maturity. Organisations with an ISO/IEC 27001 system can reuse much of its structure, which shortens the work. The audit itself has two stages. Plan for months of preparation, and ask certification bodies for their own estimates.
Who can certify an organisation to ISO 42001?
An accredited certification body. Under ISO/IEC 42006:2025, these bodies must meet AI-specific competence, impartiality and audit requirements on top of ISO/IEC 17021-1. Check the body's accreditation scope covers ISO/IEC 42001 before you engage it. An internal audit or a vendor attestation is not certification.
Is ISO 42001 the same as ISO 27001?
No, but they share the same management-system structure. ISO/IEC 27001 covers information security. ISO/IEC 42001 covers AI governance, including impact assessment, the AI system lifecycle, data quality and responsible use. Organisations with 27001 can often integrate the two systems and reuse audit and review processes.
Does ISO 42001 apply to organisations that only use AI?
Yes. The standard covers organisations that develop, provide or use AI systems. A company deploying third-party AI tools can certify its AIMS around how it selects, approves, uses and monitors them, including controls for third-party and customer relationships under Annex A.10.
Is ISO 42001 a harmonised standard under the EU AI Act?
No. It is not a harmonised standard and is not cited in the Official Journal, so it gives no presumption of conformity under Article 40. Reporting up to mid-2026 found no harmonised AI Act standards cited yet. Check the Commission's pages for the current position.
Sources
Facts on this page were checked against these primary sources on 3 October 2026. This guide is general information, not legal advice.
- ISO/IEC 42001:2023, AI management systems (ISO catalogue)
- ISO/IEC 42006:2025, requirements for AIMS audit and certification bodies (ISO catalogue)
- ISO/IEC 42005:2025, AI system impact assessment (IEC webstore)
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex
- European AI Office, European Commission
- NIST AI Risk Management Framework
Put this into practice
Register your AI systems, see which obligations apply, and keep controls and evidence in one workspace.
Start free