ISO 42001
Also called ISO/IEC 42001:2023, AI management system standard
ISO 42001 is the international standard for an artificial intelligence management system. Published by ISO and IEC in December 2023, it sets out how an organisation should govern the AI it builds or uses, covering policy, risk assessment, impact assessment, controls and continual improvement. Independent auditors can certify firms against it.
How it works
A firm sets the scope of its AI management system, names owners and writes an AI policy. It then assesses the risks and impacts of each AI system, chooses controls from the standard's annex and records them in a statement of applicability. Internal audits and management reviews follow. An accredited certification body audits the system in two stages before issuing a certificate.
The standard follows the same structure as ISO 27001, so firms with an information security system can extend existing processes. Certification gives clients, auditors and supervisors evidence that AI is governed in a repeatable way. Banks and insurers increasingly ask AI suppliers for it in due diligence. It does not by itself prove compliance with the EU AI Act.
The rules
Sets requirements for establishing, running, maintaining and continually improving an AI management system, and is certifiable by accredited third parties.
Any organisation that develops, provides or uses AI systemsCommon questions
Is ISO 42001 certification mandatory?
No. ISO 42001 is a voluntary standard. No law in the UK, EU or US requires certification. Firms adopt it to show clients, auditors and supervisors that AI is governed through a defined and audited management system.
How does ISO 42001 relate to the EU AI Act?
The two overlap on risk management, documentation and oversight, but certification is not proof of AI Act compliance. The AI Act sets legal duties by risk category, while ISO 42001 describes a management system that can support meeting them.
How long does ISO 42001 certification last?
Certificates usually run for three years. The certification body carries out surveillance audits during that period, and the firm must pass a recertification audit at the end of the cycle to keep the certificate.
Who can issue ISO 42001 certificates?
Certification bodies accredited by a national accreditation body issue the certificates. ISO itself does not certify organisations. Buyers often check that the certifier holds accreditation for ISO 42001 specifically.
