ISO/IEC 42001

ISO/IEC 42001:2023 is the international standard for artificial intelligence management systems, titled Information technology — Artificial intelligence — Management system. It sets out what an organisation must have in place to develop, provide or use AI responsibly: leadership, policy, risk assessment, impact assessment, controls, evidence, audit and improvement.

It is the first AI standard an organisation can actually be certified against, and the first to treat AI governance as a management system rather than a set of principles.

December 2023, as a first edition of 51 pages, by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 42, Artificial intelligence. The project had been registered in August 2020. It was approved as a European Standard, EN ISO/IEC 42001:2026, by CEN on 13 March 2026.

Annex A contains 38 controls organised into nine control objectives, numbered A.2 to A.10: policies related to AI, internal organization, resources for AI systems, assessing impacts of AI systems, AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships.

The number matters less than people think. Annex A is a reference set, not a checklist — the standard states that not all of its objectives and controls are required to be used.

No, and this is the most common misunderstanding about the standard. Under Clause 6.1.3 you select controls that treat the risks your own assessment identified, compare your selection against Annex A to check you have not missed anything necessary, and then produce a Statement of Applicability justifying both inclusion and exclusion. You may also design controls of your own where Annex A does not reach.

In practice most organisations implement the majority of Annex A, because AI risk is broad and the controls are pitched at a high level. That should be a conclusion you reach, not an assumption you start from.

The document required by Clause 6.1.3 that lists the controls you have determined necessary and justifies why each is included or excluded. Exclusions can be justified where your risk assessment does not deem a control necessary, or where external requirements do not require it or provide an exception.

It is the spine of the audit. A certification body will confirm there is at least one Statement of Applicability per certification scope, and will test whether your risk assessment genuinely supports what it says.

No. ISO/IEC 42001 is not a harmonised standard cited in the Official Journal of the European Union, so it confers no presumption of conformity. The European position is explicit that 42001 does not cover the full set of the AI Act's quality management requirements, and a separate European standard — prEN 18286 — is being developed to fulfil them.

What is true is that Article 17 requires providers of high-risk AI systems to run a quality management system, and that a well-implemented AIMS gives you a great deal of the organisational machinery an AI Act QMS needs, already audited. Treat it as a head start, not a finish line.

Through a two-stage audit by an accredited certification body. Determine your scope and your role under Clause 4.1; run an AI risk assessment and an AI system impact assessment; select controls and write the Statement of Applicability; implement clauses 4 to 10 and the controls you selected; run an internal audit and a management review; then Stage 1, which tests readiness and documentation, and Stage 2, which tests whether the system actually operates. Surveillance audits follow, then recertification.

ISO/IEC 42006:2025 governs the certification bodies themselves. It is worth reading before you choose one.

It depends on what already exists. An organisation certified to ISO/IEC 27001 has the harmonised-structure scaffolding — scope, leadership, internal audit, management review — and is mostly adding the AI-specific parts. An organisation starting from nothing is building a management system as well as an AI one.

Audit duration is not a matter of opinion: ISO/IEC 42006 sets out how a certification body calculates audit time from the number of people involved in the AI life cycle, then adjusts it for the number of AI systems, how many are high-risk or sensitive, how many regulatory frameworks you sit under, how many third-party agreements are in scope, and how many controls you carry beyond Annex A.

ISO/IEC 27001 manages information security; ISO/IEC 42001 manages artificial intelligence. They share the Harmonized Structure, so clauses 4 to 10 have the same shape and audits can be combined, and both use a risk assessment feeding a Statement of Applicability against an Annex A of reference controls.

The substance differs where it matters. 42001 requires you to determine your role with respect to AI systems, and requires an AI system impact assessment — an assessment of consequences for individuals, groups and societies, not risk to your organisation. Information security has no direct equivalent of that obligation.

No. It certifies the management system that governs your AI, not the AI itself. A certificate says a third party checked that you run a system for managing AI risk and that you follow it. It says nothing about whether a particular model is accurate, fair or safe.

That distinction is worth defending, because a certificate presented as a safety guarantee is exactly the sort of claim a regulator or a well-briefed procurement team will take apart.

ISO/IEC JTC 1/SC 42, the joint ISO and IEC subcommittee for artificial intelligence established in 2017. Unlike smaller standards drafted by a handful of editors, a management system standard passes through working groups, two committee draft consultations, comment resolution and an international ballot, with every participating national body voting through its own mirror committee — BSI's ART/1 in the United Kingdom.

Experts participate in a personal and expert capacity, nominated through their national standards body.

From ISO, from the IEC, or from your national standards body — in the UK, BSI, as BS EN ISO/IEC 42001:2026. It is a copyrighted document and this site does not reproduce it. The list price from ISO at the time of writing is CHF 406.