What is ISO 42001?
ISO/IEC 42001 is the international standard for an Artificial Intelligence Management System (AIMS). Published in December 2023 by ISO and IEC, it sets out how an organisation should govern the AI systems it develops, provides or uses — covering AI policy, risk and impact assessment, data, transparency, human oversight and continual improvement. It is the first AI standard that organisations can be independently certified against.
In plain terms: ISO 27001 proves you protect information; ISO 42001 proves you manage AI responsibly. As customers, regulators and boards ask harder questions about AI — and as the EU AI Act phases in — ISO 42001 gives organisations a recognised, auditable way to answer them.
This guide explains how the standard is structured, who needs it, how it connects to the EU AI Act, and the practical steps to certification.
How ISO 42001 is structured
ISO 42001 follows the same harmonised structure as ISO 27001, ISO 9001 and other management-system standards, so organisations that already run an ISMS will recognise most of it. Clauses 4 to 10 contain the certifiable requirements; the annexes add controls and guidance.
| Part | What it requires |
|---|---|
| Clause 4 — Context of the organisation | Define your role (AI provider, developer or user), interested parties and the scope of the AIMS |
| Clause 5 — Leadership | Top-management commitment, an AI policy and clear roles and responsibilities |
| Clause 6 — Planning | AI risk assessment, AI risk treatment, AI system impact assessment and AI objectives |
| Clause 7 — Support | Resources, competence, awareness, communication and documented information |
| Clause 8 — Operation | Run the planned processes, risk treatment and impact assessments across the AI life cycle |
| Clause 9 — Performance evaluation | Monitoring, internal audit and management review |
| Clause 10 — Improvement | Corrective action and continual improvement |
The 38 Annex A controls
Annex A lists 38 controls grouped under 9 control objectives. Like ISO 27001, you select the controls that apply and justify exclusions in a Statement of Applicability.
| Annex A area | Focus |
|---|---|
| A.2 Policies related to AI | AI policy and its alignment with other policies |
| A.3 Internal organisation | Roles, responsibilities and reporting of AI concerns |
| A.4 Resources for AI systems | Data, tooling, computing and human resources |
| A.5 Assessing impacts of AI systems | Impact assessment on individuals, groups and society |
| A.6 AI system life cycle | Responsible design, development, verification, deployment and monitoring |
| A.7 Data for AI systems | Data quality, provenance and preparation |
| A.8 Information for interested parties | Transparency, documentation and incident communication |
| A.9 Use of AI systems | Responsible and intended use, human oversight |
| A.10 Third-party and customer relationships | Suppliers, customers and shared responsibilities |
Annex B gives implementation guidance for each control, Annex C lists typical AI objectives and risk sources (such as fairness, security, transparency and robustness), and Annex D covers use of the AIMS across sectors.
Who needs ISO 42001?
Any organisation that builds, sells or relies on AI can use ISO 42001 — it is not limited to tech companies. It matters most for:
- AI product and SaaS companies whose enterprise customers ask for proof of responsible AI
- IT services and consulting firms delivering AI solutions to clients in Europe, the US and the GCC
- Banks, insurers, healthcare and HR-tech providers using AI in decisions that affect people
- Organisations already certified to ISO 27001 that want to extend governance to AI
- Public-sector bodies and their suppliers adopting AI
Benefits of ISO 42001 certification
- Trust and sales: an independent certificate answers customer AI due-diligence questionnaires and RFP requirements.
- Regulatory readiness: a structured way to organise the risk management, documentation and oversight that AI laws expect.
- Fewer AI incidents: systematic risk and impact assessment catches bias, data, security and misuse issues earlier.
- Clear accountability: defined roles, policies and reporting lines for AI across the business.
- Integration: fits alongside ISO 27001, ISO 27701 and ISO 9001, so you can run one integrated management system.
ISO 42001 and the EU AI Act
The EU AI Act is the European Union's law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages. Prohibited AI practices and AI-literacy duties have applied since February 2025, and obligations for general-purpose AI models since August 2025. Under the Digital Omnibus amendments adopted in 2026, the main obligations for high-risk AI systems listed in Annex III now apply from 2 December 2027, and those for AI in regulated products (Annex I) from 2 August 2028.
ISO 42001 is not the same as EU AI Act compliance, and certification alone does not make an organisation compliant. But it gives you the management system — risk management, impact assessment, data governance, documentation, human oversight, monitoring and supplier control — that the Act's high-risk requirements depend on. Organisations that start an AIMS now will be far better placed when the high-risk deadlines arrive.
Dates are as of October 2026; check the latest EU guidance before relying on them for compliance planning.
How to get ISO 42001 certified: 8 steps
- Get leadership buy-in and appoint an AIMS owner with authority across IT, data, legal and risk.
- Define the scope — which AI systems, teams and locations, and whether you act as an AI provider, developer or user.
- Inventory your AI systems, including third-party and embedded AI tools such as generative AI assistants.
- Run a gap assessment against clauses 4–10 and the 38 Annex A controls.
- Assess AI risks and impacts for each system, then choose controls and write the Statement of Applicability.
- Implement and document the AI policy, procedures, controls, training and monitoring.
- Run an internal audit and management review to prove the system works.
- Book a certification audit with an accredited certification body: Stage 1 reviews documentation, Stage 2 tests implementation. Certificates are typically valid for three years with annual surveillance audits.
Timelines vary with size and AI maturity; organisations with ISO 27001 in place usually move faster because the management-system foundation already exists.
Related standards to know
| Standard | Role alongside ISO 42001 |
|---|---|
| ISO/IEC 23894 | Guidance on AI risk management, built on ISO 31000 |
| ISO/IEC 42005:2025 | Guidance on AI system impact assessments |
| ISO/IEC 42006:2025 | Requirements for bodies that audit and certify AI management systems |
| ISO/IEC 22989 | AI concepts and terminology |
| ISO 31000 | The general risk management framework behind AI risk practice |
| ISO/IEC 27001 | Information security management — the most common partner standard |
When choosing a certification body, check that it is accredited for ISO 42001 by a national accreditation body; certificates from accredited bodies can be verified on IAF CertSearch.
ISO 42001 training paths
| Course | Best for | You will be able to |
|---|---|---|
| ISO 42001 Lead Implementer | AI, data, risk and compliance leads; CISOs; consultants | Plan, build and run an AIMS ready for certification |
| ISO 42001 Lead Auditor | Internal and external auditors; ISO 27001 auditors moving into AI | Plan and lead AIMS audits to ISO 19011 principles |
| ISO 31000 Risk Manager | Risk professionals | Apply the risk framework that underpins AI risk management |
| AI Manager | Managers leading AI initiatives | Lead AI strategy, projects and governance |
Frequently asked questions
Is ISO 42001 mandatory?
No. ISO 42001 is voluntary. Organisations adopt it to show responsible AI governance to customers, partners and regulators, and to prepare for laws such as the EU AI Act.
How many controls are in ISO 42001?
Annex A contains 38 controls under 9 control objectives, covering AI policy, organisation, resources, impact assessment, the AI life cycle, data, transparency, use of AI and third-party relationships.
Does ISO 42001 certification make us EU AI Act compliant?
Not on its own. ISO 42001 provides the management system the Act's requirements rely on, but compliance depends on meeting the Act's specific legal obligations for your AI systems.
Can we combine ISO 42001 with ISO 27001?
Yes. Both use the same harmonised structure, so policies, internal audit, management review and document control can be shared in one integrated management system.
Who can certify us to ISO 42001?
An accredited certification body. ISO/IEC 42006 sets the requirements these bodies must meet when auditing AI management systems.
What is the difference between ISO 42001 Lead Implementer and Lead Auditor?
Lead Implementer teaches you to build and run an AIMS; Lead Auditor teaches you to audit one. Implementers often take the auditor course later, and many consultants hold both.
Start your ISO 42001 journey
WiseLearner delivers ISO 42001 Lead Implementer and ISO 42001 Lead Auditor training live online for learners worldwide, with corporate batches tailored to your organisation. Call +91 99084 55513 or email [email protected] for the next batch dates.
Sources checked October 2026: ISO/IEC 42001 Annex A overview (RiskProfs), ISO/IEC 42005 publication (Freevacy), ISO/IEC 42006 (TCSA), EU AI Act Digital Omnibus dates (Orrick).
