ISO/IEC 42001, published in December 2023, is the first international standard for an AI management system (AIMS). It does for AI what ISO/IEC 27001 does for information security: it gives organisations a structured, auditable way to manage AI responsibly, and a certificate to prove it.
What is an AI management system?
An AI management system is the set of policies, processes, roles and controls an organisation uses to develop, provide or use AI responsibly, and to keep improving how it does that. It isn’t software. It’s how the organisation runs AI.
Who it’s for
Any organisation that develops, provides or uses AI, of any size and in any sector. It’s especially relevant if:
- You sell AI products or AI-powered services and customers ask for assurance.
- You already hold ISO/IEC 27001 and want to extend the same discipline to AI.
- You want a recognised structure to support compliance with laws like the EU AI Act.
How the standard is structured
ISO/IEC 42001 follows the same high-level structure as other ISO management system standards, so it fits alongside 27001 or 9001. The main clauses cover:
- Context of the organisation: your AI role, stakeholders and the scope of the system.
- Leadership: top management commitment, an AI policy, and roles and responsibilities.
- Planning: AI risk assessment, risk treatment, AI system impact assessment and objectives.
- Support: resources, competence, awareness, communication and documented information.
- Operation: running the planned processes, including risk treatment and impact assessments.
- Performance evaluation: monitoring, internal audit and management review.
- Improvement: corrective actions and continual improvement.
Annex A lists reference controls, covering areas such as AI policies, internal organisation, resources, impact assessment, the AI system lifecycle, data, information for interested parties, responsible use and third-party relationships. Annexes B to D give implementation guidance and context. Like 27001, you justify which controls apply in a Statement of Applicability.
What’s different from ISO/IEC 27001
- Impact assessment. You assess the impact of AI systems on individuals, groups and society, not just risks to the organisation.
- Lifecycle focus. Controls cover the whole AI lifecycle, from design and data through deployment and retirement.
- Data quality and provenance get explicit attention.
- Responsible use and transparency to affected people are built in.
Certification: is it worth it?
Certification is done by an accredited certification body through an external audit, similar to 27001. Whether it’s worth it depends on your situation:
- Worth it if you sell AI to enterprises or regulated sectors where buyers ask for proof, or if you already run 27001 and can extend it efficiently.
- Maybe later if you’re early in AI adoption. Build the practices first, using the standard or the NIST AI RMF as a guide, and certify once the system is mature.
Even without certification, the standard is a solid blueprint.
Does ISO/IEC 42001 make you EU AI Act compliant?
Not on its own. It supports compliance, because many practices overlap, such as risk management, documentation and human oversight. But the Act has specific legal obligations that a management system standard doesn’t automatically satisfy. Treat 42001 as the engine and the law as the destination.
Getting started
- Define your scope: which AI systems and which parts of the organisation.
- Build your AI inventory and decide your role for each system.
- Write an AI policy and assign responsibilities.
- Run a risk assessment and an impact assessment for your most significant systems.
- Pick your Annex A controls and record them in a Statement of Applicability.
- Operate it, audit it internally, review it, then decide on certification.
Official sources
- ISO/IEC 42001: the AI management system standard (paid)
- ISO/IEC 23894: ISO guidance on AI risk management (paid)
- NIST AI Risk Management Framework: the framework and its supporting documents
More primary sources, with a short note on each, are on our Sources page.
Last reviewed October 2026. Summary of ISO/IEC 42001:2023. Read the official standard for its exact requirements. This article is general information.