ISO 42001 Explained

ISO 42001 (formally ISO/IEC 42001) is the international standard for an AI management system: the policies, roles, risk and impact assessments, controls and reviews an organization uses to develop, provide or use AI responsibly. It is the first AI standard you can be certified against, and it is built on the same structure as ISO 27001, so organizations that already run an information security management system can extend it rather than start over. This guide explains what the standard requires, how it is organized, how it relates to ISO 27001 and NIST AI RMF, who should pursue certification and what a realistic roadmap looks like.

What ISO 42001 is

ISO/IEC 42001 was published jointly by the International Organization for Standardization and the International Electrotechnical Commission through their joint AI committee. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (often abbreviated AIMS) inside an organization. The standard applies to any organization of any size that develops AI, provides AI products or services, or uses AI in its operations, in any sector.

Three things distinguish it from guidance documents. First, it is written as requirements (“the organization shall”), which is what makes it auditable. Second, it follows the Harmonized Structure that ISO uses for all its management system standards, so clauses 4 to 10 look and behave like the equivalent clauses in ISO 27001, ISO 9001 and ISO 27701. Third, it comes with an Annex A list of AI-specific controls that you select from, document in a Statement of Applicability, and justify, in the same way ISO 27001 handles its own Annex A.

The standard sits inside a family. ISO/IEC 22989 defines AI concepts and terminology. ISO/IEC 23894 gives guidance on AI risk management. ISO/IEC 42005 gives guidance on AI system impact assessment, which 42001 requires you to perform. ISO/IEC 42006 sets requirements for the bodies that audit and certify AI management systems. You do not need to buy the whole family to implement 42001, but 23894 and 42005 are the two most useful companions.

Structure (clauses, Annex A)

Clauses 1 to 3 cover scope, references and terms. The requirements start at clause 4. If you have seen ISO 27001, the headings will be familiar; the content is where AI differs.

Clause	Title	What it requires in practice
4	Context of the organization	Define your role (developer, provider, user), the internal and external issues that affect AI, the interested parties and their expectations, and the scope of the AI management system
5	Leadership	Top management commitment, an AI policy approved and communicated by leadership, and assigned roles, responsibilities and authorities
6	Planning	A method for AI risk assessment and risk treatment, an AI system impact assessment process, measurable AI objectives and plans to reach them, and planned change management
7	Support	Resources, competence, awareness, communication and documented information: who needs what skills, what records you keep and how you control them
8	Operation	Running the processes planned in clause 6: performing AI risk assessments, applying risk treatments and carrying out AI system impact assessments at planned intervals and on significant change
9	Performance evaluation	Monitoring and measurement, internal audit of the management system, and management review by leadership
10	Improvement	Continual improvement, and handling nonconformities with corrective action

Annex A controls

Annex A lists control objectives and controls organized into themes. You decide which apply, record the decision and the reason in a Statement of Applicability, and implement what you keep. Annex B gives implementation guidance for each control, Annex C lists organizational objectives and risk sources to consider, and Annex D discusses using the management system across domains and sectors. The themes are:

• Policies related to AI. A documented AI policy aligned with other organizational policies, and its review.
• Internal organization. Roles, responsibilities and a way to report concerns about AI systems.
• Resources for AI systems. Documenting the data, tooling, system, computing and human resources each AI system depends on.
• Assessing impacts of AI systems. A process for assessing impacts on individuals, groups and society, and documenting the results.
• AI system life cycle. Objectives for responsible development, requirements and specification, design, verification and validation, deployment, operation and monitoring, and technical documentation.
• Data for AI systems. Data acquisition, quality, provenance and preparation, with records.
• Information for interested parties. Documentation and communication for users and others affected, including incident reporting.
• Use of AI systems. Processes for responsible use, objectives for use, and intended use.
• Third-party and customer relationships. Allocating responsibilities with suppliers and customers across the supply chain.

The control count is modest compared with ISO 27001, but several controls (impact assessment, life cycle documentation, data provenance) require real engineering work for AI you build, and real vendor work for AI you buy.

Relationship to ISO 27001 and NIST AI RMF

ISO 42001 was written to be run alongside ISO 27001, not instead of it. Both follow the Harmonized Structure, so the context, leadership, planning, support, performance evaluation and improvement clauses can be implemented once as an integrated management system with a single policy set, a single internal audit program and a single management review. What differs is the subject: 27001 manages information security risk; 42001 manages the broader risks of AI, including impacts on people, bias, transparency and accountability. Security of AI systems is in scope for both, which is where the integration pays off.

Aspect	ISO/IEC 27001	ISO/IEC 42001	NIST AI RMF
Type	Certifiable management system standard	Certifiable management system standard	Voluntary framework; no certification
Subject	Information security	Responsible development, provision and use of AI	AI risk, organized by outcomes
Core structure	Clauses 4 to 10 plus Annex A security controls	Clauses 4 to 10 plus Annex A AI controls	Govern, Map, Measure, Manage
Risk method	Information security risk assessment and treatment	AI risk assessment, treatment and AI system impact assessment	Map and Measure functions; impact characterization
Evidence	Statement of Applicability, records, audits	Statement of Applicability, impact assessments, life cycle records, audits	Profiles, Playbook actions, documentation you choose
Typical use	Security assurance for customers and regulators	AI assurance for customers, partners and regulators	Structuring an internal AI risk program

The practical pairing most organizations land on is NIST AI RMF to structure the risk work, because it is free and outcome-based, and ISO 42001 as the certifiable wrapper when customers ask for proof. Crosswalks between the two exist, and the mapping in our guide to building an AI governance framework shows how the pieces line up. Our NIST AI RMF guide covers the framework itself.

Who should pursue certification

Certification is a commercial decision, not a safety one. A well-run AI management system without a certificate protects you just as well; the certificate is for people outside the organization who need proof. It is worth pursuing when:

• You sell AI products or AI-enabled services to enterprises, healthcare systems or government buyers whose procurement teams ask for third-party assurance.
• You already hold ISO 27001 and your customers are starting to ask AI questions; extending the integrated management system is a smaller step than it looks.
• You operate in a regulated sector where demonstrating a documented AI risk and impact assessment process is becoming an expectation.
• You want a defensible, externally audited answer to the AI sections of security questionnaires and vendor assessments.

It is usually premature when your AI use is limited to purchased tools and general-purpose assistants, when nobody has asked for it, or when you have not yet done the basics (policy, inventory, risk tiers). In those cases, build the management system to the standard without certifying, and keep the audit for when it will win or keep business. ISO 42001 consulting should start with that question, not with an audit date.

Roadmap

A certification roadmap follows the same arc as ISO 27001. The calendar depends on how much AI you run and how much of a management system you already have; organizations with an existing ISO 27001 program move fastest.

1. Gap analysis. Compare current practice with clauses 4 to 10 and Annex A. Decide whether to integrate with an existing management system or stand one up.
2. Scope and context. Define your role for each AI system (developer, provider, user), the systems in scope, interested parties and the boundary of the management system.
3. Policy and roles. Leadership approves the AI policy; roles, responsibilities and a concern-reporting path are assigned and communicated.
4. Risk and impact assessment method. Write the AI risk assessment, risk treatment and impact assessment procedures, then run them on the in-scope systems and record the results.
5. Controls and Statement of Applicability. Select Annex A controls, justify inclusions and exclusions, implement what is missing and collect evidence.
6. Operate and document. Run the processes for long enough to produce records: assessments, reviews, training, incidents, changes.
7. Internal audit and management review. An independent internal audit of the management system, then a leadership review with documented decisions and corrective actions.
8. Certification audit. A stage 1 review of documentation and readiness, then a stage 2 audit of implementation, followed by periodic surveillance audits to keep the certificate.

Auditors will ask to see the scope statement, the AI policy, the role assignments, the risk and impact assessment procedure and the completed assessments for each in-scope system, the Statement of Applicability with evidence for each applicable control, life cycle and data records for AI you build, supplier agreements for AI you buy, training records, internal audit reports and management review minutes. Build the evidence folder as you go rather than assembling it before the audit.

If you have been through SOC 2, the rhythm will be familiar: define, implement, operate, collect evidence, audit. Our SOC 2 readiness checklist shows how much of that evidence can serve both programs. Certification requirements and accreditation rules change; check the current official text of the standard and your certification body’s scheme before planning dates. This is general information, not legal advice.

Where PS3G fits

PS3G runs ISO 42001 gap analyses and readiness programs as part of its AI governance consulting service, and integrates them with the SOC 2, HIPAA and ISO 27001 work in our IT compliance consulting service so you maintain one control set. We work for organizations of every size, from a product company preparing its first certification to a compliance team extending an existing management system. We do not issue certificates; accredited certification bodies do. We govern the AI features in our own HIPAA-compliant EHR and telehealth platform, DocVilla, under the same management-system discipline we set up for clients.

Related reading

• NIST AI RMF Explained: Govern, Map, Measure, Manage
• AI Governance Framework: How to Build One (Structure + Examples)
• SOC 2 Readiness Checklist: What to Do Before You Call an Auditor
• AI governance consulting services
• IT compliance consulting

Frequently asked questions

What is ISO 42001 certification?

An accredited certification body audits your AI management system against ISO/IEC 42001 and, if it conforms, issues a certificate that is maintained through periodic surveillance audits. The certificate covers a defined scope: specific AI systems, locations and activities. It proves the management system exists and operates, not that any particular AI output is correct or fair.

How long does ISO 42001 certification take?

It depends on how much AI you run and whether you already operate a management system such as ISO 27001. The work is measured in months rather than weeks, because the standard requires records produced by operating the processes, not just documents describing them. A gap analysis at the start gives you a realistic plan.

Do we need ISO 27001 before ISO 42001?

No. ISO 42001 stands on its own. Holding ISO 27001 makes implementation faster because the two share the same management system structure and can be audited together, and because security of AI systems is required by both. Many organizations pursue them as an integrated management system.

Is ISO 42001 required by law?

No law we are aware of requires ISO 42001 certification, but some regulations describe AI risk management and impact assessment obligations that the standard’s processes are designed to satisfy, and customers increasingly ask for it in procurement. Check the current official text of the laws that apply to you. This is general information, not legal advice.

What does ISO 42001 consulting include?

A gap analysis, scoping, the AI policy and role definitions, the risk and impact assessment procedures and their first run, Annex A control selection and a Statement of Applicability, documentation and evidence collection, internal audit and management review, and support through the certification audit. Good consulting also tells you when certification is premature.