What is ISO 42001? Requirements, Annex A controls and the path to certification
A SaaS company sells an AI feature that summarises support tickets for its customers. The product works, the pipeline is full, and then a large prospect sends its vendor questionnaire. Section 7 is new: “Do you hold ISO/IEC 42001 certification? If not, describe your AI management system and your timeline.” The sales lead has two questions for the CTO: what is ISO 42001, and how long does it take?
These questions come up more and more often. The trigger is usually the same: a customer, an investor or a regulator wants evidence that AI is used and built under control.
Key takeaways
- ISO/IEC 42001:2023 is the first certifiable standard for an AI management system (AIMS). It was published in December 2023.
- It applies to any organisation that develops, provides or uses AI, regardless of size or sector.
- It follows the same structure as ISO 27001, clauses 4 to 10, which makes an integrated management system and a combined audit possible.
- Annex A contains 38 controls in nine areas, from AI policy and impact assessment to data, the AI life cycle and third parties.
- Certification follows the usual pattern: stage 1 and stage 2 audits, then annual surveillance in a three-year cycle.
- It supports EU AI Act compliance, but it is not a harmonised standard under the Act and does not by itself give a presumption of conformity.
What is ISO 42001?
ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. The standard describes how to run an organisation that develops or uses AI responsibly, with clear policies, defined roles, assessed risks, controlled processes and evidence that all of this works.
The standard is deliberately neutral about technology and role. A start-up that builds a language model, a bank that buys a credit scoring tool and a manufacturer that uses computer vision on the shop floor can all certify. What changes between them is the scope and which controls apply.
The structure: clauses 4 to 10
ISO 42001 uses the harmonised structure that ISO management system standards share. If you know ISO 27001, the outline is familiar:
- Clause 4, context: internal and external issues, interested parties, the scope of the AIMS and your role, for example as AI provider, producer or customer.
- Clause 5, leadership: commitment of top management, the AI policy, roles and responsibilities.
- Clause 6, planning: AI risk assessment (6.1.2), AI risk treatment with a Statement of Applicability (6.1.3) and the AI system impact assessment (6.1.4). AI objectives and how to reach them.
- Clause 7, support: resources, competence, awareness, communication and documented information.
- Clause 8, operation: carrying out the planned processes, risk assessments, risk treatment and impact assessments.
- Clause 9, performance evaluation: monitoring, internal audit and management review.
- Clause 10, improvement: nonconformities, corrective action and continual improvement.
Two elements are specific to AI. The AI risk assessment (6.1.2) covers risks to the organisation's AI objectives, including consequences for individuals and society. The AI system impact assessment (6.1.4) looks specifically at what one AI system can do to individuals, groups and society, and its results feed into the risk assessment. The results then go into the Statement of Applicability, where you justify which Annex A controls you apply and which you exclude.
Annex A: 38 controls in nine areas
Annex A lists the reference controls. As with ISO 27001, you do not have to implement all of them, but you have to justify every exclusion. Annex B gives implementation guidance for each control, Annex C lists possible AI-related objectives and risk sources, and Annex D describes how the standard applies across domains and sectors.
Most of the work sits in five areas:
- A.5, impact assessment: a documented process to assess how an AI system can affect individuals, groups and society, repeated when the system or its use changes.
- A.6, life cycle: the largest area, covering objectives for responsible development, requirements, design, verification and validation, deployment, operation, monitoring and technical documentation.
- A.7, data: where data comes from, its quality, provenance and preparation, for training as well as operation.
- A.8, interested parties: what users and others need to know about the system, including how to report adverse effects.
- A.10, third parties: responsibilities when you buy models or services from suppliers, or when customers use your AI.
ISO 42001 and ISO 27001
Because both standards share clauses 4 to 10, most companies with an ISO 27001 certificate do not start from zero. Document control, internal audit, management review, corrective action and the risk process already exist. What is added is the AI-specific layer: the AI policy, the AI system inventory, impact assessments, life cycle and data controls, and the information duties towards users.
Certification bodies can audit both standards together. In practice that means one management review, one internal audit programme and one set of shared controls, with ISO 42001 building on what ISO 27001 already covers.
ISO 42001 and the EU AI Act
The AI Act is law, with duties that depend on the risk class of each AI system and on your role as provider or deployer. ISO 42001 is a voluntary management system standard that applies to all AI in scope, whatever its risk class.
ISO 42001 is not a harmonised standard under the AI Act. A certificate therefore does not create a presumption of conformity with the Act’s requirements for high-risk systems. It covers much of the governance the Act expects: an AI inventory, risk management, documented impact assessments, defined human oversight and a process that keeps all of it current. For companies that will have high-risk systems from December 2027, it is a sensible frame to build the specific AI Act duties into.
The path to certification
In the stage 1 audit, the auditor reviews your documentation and checks whether you are ready: scope, AI policy, risk and impact assessments, Statement of Applicability, internal audit and management review. In the stage 2 audit, the auditor tests whether the system works in practice, with interviews, samples and evidence. After certification, surveillance audits follow every year, and recertification after three years.
Choose a certification body that is accredited for ISO/IEC 42001. Since July 2025, ISO/IEC 42006 sets additional requirements for bodies that certify AI management systems, including the AI competence of their auditors. Ask about it before you sign.
Getting started
- Define the scope: which AI systems, which products, which locations, and your role for each.
- Build the AI inventory, including AI features in tools you buy.
- Run a Gap Audit against clauses 4 to 10 and Annex A, starting from your ISO 27001 controls if you have them.
- Write the AI policy and get it approved by top management.
- Carry out risk and impact assessments for each AI system in scope.
- Prepare the Statement of Applicability with a reason for every included and excluded control.
- Let the system run for a few months, with an internal audit and a management review, before stage 1.
- Pick an accredited certification body and plan a combined audit with ISO 27001 where it makes sense.
Where AIMS projects go wrong
Treating it as a model audit. ISO 42001 certifies a management system. Auditors look at processes, decisions and evidence across the organisation.
An inventory that only lists your own models. AI you buy and AI features inside existing software are part of the scope as soon as you use them.
Skipping the impact assessment. It is the element most specific to ISO 42001, and auditors expect one for every AI system in scope.
Building a second system next to ISO 27001. Two document sets, two review cycles and two audit programmes double the effort without adding control.
FAQ: ISO 42001
How long does ISO 42001 certification take?
It depends on the scope and on what already exists. The certification audit has two stages, and the management system must have run long enough to produce records such as an internal audit and a management review. With an existing ISO 27001, much of the system can be reused.
Is ISO 42001 mandatory?
No. It is a voluntary standard. Customers, investors and procurement teams increasingly ask for it as evidence that AI is under control.
Do I need ISO 27001 first?
No. ISO 42001 can be certified on its own. Because both standards share the same structure, many companies run them as one integrated system.
