🌐International · Management System Standard

ISO 42001

ISO/IEC 42001:2023

Published December 2023

Chapter 01

Overview & Purpose

The World's First AI Management System Standard

What is ISO/IEC 42001?

ISO/IEC 42001:2023 is the world's first international standard specifically designed for Artificial Intelligence Management Systems (AIMS). Published in December 2023 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), it provides a structured framework for organizations to develop, implement, maintain, and continually improve their AI management practices.

Unlike voluntary guidance frameworks such as the NIST AI RMF, ISO 42001 is designed for formal certification. Organizations can be audited and certified as compliant, providing external assurance to customers, regulators, and stakeholders that their AI governance meets international standards.

Plan-Do-Check-Act Methodology

ISO 42001 follows the widely used Plan-Do-Check-Act (PDCA) methodology, which is familiar to organizations already certified under other ISO management system standards such as ISO 27001 (information security) or ISO 9001 (quality management).

**Plan** — Establish AI management policies, objectives, processes, and procedures relevant to managing risk and improving AI system trustworthiness.

**Do** — Implement and operate the AI management system, including risk treatments and controls.

**Check** — Monitor and measure processes and AI systems against policies, objectives, and practical experience, and report results.

**Act** — Take corrective and preventive actions based on the results of monitoring and review to continually improve the AIMS.

Chapter 02

Core Clauses (4–10)

Mandatory Requirements for AI Management

Clause 4: Context of the Organization

Organizations must understand their internal and external context as it relates to AI. This includes identifying interested parties (stakeholders), understanding their needs and expectations, and determining the scope of the AIMS. The organization must consider regulatory requirements, industry standards, ethical considerations, and the specific risks associated with its AI systems.

Clause 5: Leadership

Top management must demonstrate leadership and commitment to the AIMS. This includes establishing an AI policy, ensuring that roles and responsibilities are assigned and communicated, and providing adequate resources. Leadership must ensure that AI governance is integrated into the organization's business processes and that a culture of responsible AI use is promoted.

Clause 6: Planning

Organizations must plan how to address risks and opportunities related to AI. This includes conducting AI risk assessments, setting AI management objectives, and planning actions to achieve those objectives. Planning should consider the full AI lifecycle and the potential impacts of AI systems on individuals, groups, and society.

Clauses 7–8: Support and Operation

**Support (Clause 7)** — Organizations must determine and provide the resources needed for the AIMS, including competent personnel, awareness programs, communication processes, and documented information. Staff involved in AI development and deployment must have appropriate training and qualifications.

**Operation (Clause 8)** — Organizations must plan, implement, and control the processes needed to meet AIMS requirements. This includes implementing risk treatments, managing changes to AI systems, and controlling outsourced processes. Operational controls should address data quality, model development, testing, deployment, and monitoring.

Clauses 9–10: Performance and Improvement

**Performance Evaluation (Clause 9)** — Organizations must monitor, measure, analyze, and evaluate the AIMS and AI system performance. This includes conducting internal audits and management reviews to assess the effectiveness of the AIMS.

**Improvement (Clause 10)** — Organizations must address nonconformities, take corrective actions, and continually improve the suitability, adequacy, and effectiveness of the AIMS. This creates a cycle of continuous improvement that strengthens AI governance over time.

Chapter 03

Annexes A & B

Reference Controls and Implementation Guidance

Annex A: Reference Control Objectives and Controls

Annex A provides a comprehensive set of reference control objectives and controls that organizations can select based on their risk assessment. Key areas include:

**AI System Impact Assessment** — Controls for assessing the potential impacts of AI systems on individuals, groups, organizations, and society.

**Data Governance** — Controls for ensuring data quality, provenance, privacy, and appropriate use throughout the AI lifecycle.

**Transparency and Explainability** — Controls for ensuring that AI system decisions can be understood and explained to relevant stakeholders.

**Third-Party Management** — Controls for managing risks associated with third-party AI components, services, and data sources.

**AI System Lifecycle Management** — Controls covering the full lifecycle from design and development through deployment, monitoring, and decommissioning.

Annex B: Implementation Guidance

Annex B provides detailed implementation guidance for the controls listed in Annex A. It offers practical advice on how to implement each control, including examples, considerations, and references to related standards. This guidance is particularly valuable for organizations that are new to AI management systems or are seeking to improve their existing practices.

The implementation guidance is designed to be flexible and adaptable to different organizational contexts, sizes, and AI maturity levels.

Chapter 04

Certification Path

Achieving and Maintaining ISO 42001 Certification

The Certification Process

ISO 42001 certification involves a formal audit by an accredited certification body. The process typically includes:

**Stage 1 Audit (Documentation Review)** — The auditor reviews the organization's AIMS documentation, policies, and procedures to assess readiness for the full audit.

**Stage 2 Audit (Implementation Assessment)** — The auditor conducts an on-site (or remote) assessment of the AIMS implementation, including interviews, observation, and evidence review.

**Certification Decision** — Based on the audit findings, the certification body decides whether to grant certification.

**Surveillance Audits** — Annual surveillance audits ensure continued compliance.

**Recertification** — Full recertification is typically required every three years.

Benefits of Certification

Achieving ISO 42001 certification provides several benefits:

**Regulatory Alignment** — Demonstrates compliance readiness for emerging AI regulations, including the EU AI Act.

**Stakeholder Trust** — Provides external assurance to customers, partners, and regulators that AI governance meets international standards.

**Competitive Advantage** — Differentiates the organization in markets where AI trustworthiness is a selection criterion.

**Operational Improvement** — The structured approach to AI management often reveals inefficiencies and risks that can be addressed proactively.

**Integration** — ISO 42001 is designed to integrate with other ISO management system standards, reducing duplication of effort for organizations already certified under ISO 27001, ISO 9001, or similar standards.

February 2026