ISO/IEC 42001, AI management system standard

ISO/IEC 42001 follows the harmonised structure that ISO uses for all modern management system standards (Annex SL). That means it shares its top-level architecture with ISO/IEC 27001 (information security), ISO 9001 (quality), and ISO 14001 (environmental management): context, leadership, planning, support, operation, performance evaluation, and improvement. An organisation already certified against one of those standards can extend its management system to cover AI without rebuilding the underlying framework.

The core requirements ask an organisation to define the context in which it uses or develops AI, identify interested parties, assess AI-specific risks and impacts, establish an AI policy with leadership commitment, define objectives and controls, allocate resources and competence, operate the system under documented procedures, monitor performance, and continually improve. Annex A of the standard lists 38 reference controls covering topics such as policies for AI development, AI risk assessment, data quality, human oversight, transparency to users, third-party relationships, and lifecycle management. The controls are not mandatory in the ISO 27001 sense; the organisation selects controls appropriate to its risk assessment and documents the rationale in a Statement of Applicability equivalent.

The standard is complemented by ISO/IEC 23894:2023 (AI risk management guidance) and ISO/IEC 22989:2022 (AI concepts and terminology). Together they form a coherent reference set: 42001 is the auditable management system, 23894 is the risk methodology it draws on, 22989 is the shared vocabulary.

Certification against ISO/IEC 42001 requires an audit by a body accredited under an ISO/IEC 17021-1 scheme. As of 2026, accreditation for 42001 is being rolled out by national accreditation bodies gradually, some certificates in the market have been issued by bodies that are not yet accredited for 42001 specifically. That distinction matters: an unaccredited certificate is a document a certification body issued, but its equivalence to the market baseline is undefined.

An ISO/IEC 42001 certificate on a provider signals that the organisation has an AI management system: an AI policy, a documented risk-assessment process, defined controls, evidence that the system operates and is periodically reviewed. It says nothing directly about the properties of any specific AI system the provider ships. A provider certified against 42001 may still ship a model that is inaccurate, biased, or non-compliant with EU AI Act obligations, the certificate covers management practice, not system outcomes.

That said, 42001 is a useful procurement filter for a different reason: the requirements it imposes on the provider (documented risk assessments, defined competence, records of decisions) produce artefacts that a buyer can request during due diligence. A provider running an AI project under a 42001-compliant AIMS can be asked to show the AI risk assessment for the project, the control selections, and the operating records. A provider without any management system typically cannot.

For procurement in regulated sectors, treat 42001 as a management-system baseline that complements, not replaces, sector-specific verification: EU AI Act risk-tier classification for European systems, HIPAA Business Associate coverage for US healthcare, SOC 2 for operational security, GDPR data-processing agreements for personal data. A 42001 certificate does not substitute for any of these.

The value of an ISO/IEC 42001 certificate depends heavily on the accreditation status of the issuing body, the scope of the certification, and how integrated the AIMS is with the organisation's actual delivery work. A certificate covering an isolated internal AI use case is not the same as one covering the provider's commercial AI-implementation practice. A certificate issued by an unaccredited body is not equivalent to one issued by an accredited body. The questions below surface the difference.

Trustgent's provider profiles include an ISO/IEC 42001 readiness attribute. At L2 cross-reference level and above, the attribute is checked against evidence outside the provider's own marketing: the accredited certification body's public register, references to 42001 in client-side documentation, or third-party publications that describe the certification scope. We do not perform 42001 audits (that is the certification body's role) but we do distinguish, using our verification spectrum, between a provider who claims 42001 readiness and one whose claim is corroborated.