ISO/IEC 42001 vs ISO/IEC 42005

Side by side

When each applies

Reach for ISO/IEC 42001 when you need an auditable, organization-wide system for governing AI. It covers policy, roles, risk assessment and treatment, impact assessment, controls, internal audit, management review and continual improvement. It follows the Plan-Do-Check-Act cycle, so it can sit beside ISO/IEC 27001 in one integrated system. A certificate gives customers and partners independent assurance. See the ISO/IEC 42001 hub.

Reach for ISO/IEC 42005 when you need to assess a specific AI system. ISO's summary describes guidance for organizations that develop, provide or use AI. It covers how to assess the effects of an AI system and its foreseeable applications on individuals, groups and society. It also covers when to assess during the life cycle and how to document the results. It is designed to fit into an organization's AI risk management and AI management system.

They work as a pair. ISO/IEC 42001 requires an AI system impact assessment as part of planning. Its Annex A also includes a control area on assessing impacts. It sets the requirement but not a detailed method. ISO/IEC 42005 supplies the method. A third standard, ISO/IEC 23894, gives guidance on AI risk management for the organization. Impact assessment looks outward at people and society.

Neither equals legal compliance. Under Art. 40 of the EU AI Act, a presumption of conformity comes only from harmonized standards published in the Official Journal. A deployer's fundamental rights impact assessment under Art. 27 remains a separate legal duty. A 42005-style assessment can feed it.

Worked example

Ostrander Software, a fictional HR-tech company, sells a candidate-ranking tool to EU employers. Its customers ask for proof of good AI governance.

Ostrander builds an AI management system against ISO/IEC 42001. It writes an AI policy, assigns roles and sets up AI risk assessment. It prepares a Statement of Applicability for the Annex A controls and schedules internal audits. After a year of operation, an accredited certification body audits and certifies it.

The 42001 system requires impact assessments, so Ostrander designs its procedure using ISO/IEC 42005 as guidance. For the ranking tool, the assessment looks at affected groups, such as candidates with career gaps or disabilities. It examines benefits and harms, fairness testing results and the human review available to employers. The findings feed Ostrander's risk treatment plan and the information it gives customers.

Ostrander's EU customers that are public bodies will owe their own FRIA once Annex III duties apply on 2 December 2027. Ostrander's documented assessment gives them useful input. It cannot do their FRIA for them. Ostrander's 42001 certificate also does not make the tool conform to the AI Act. As provider, it still needs the Act's own conformity assessment.

The exam trap

The classic trap offers certification against ISO/IEC 42005. Only 42001 is certifiable among the core ISO AI standards.

The tells:

• "Organization-wide," "certifiable," "management system" or "Statement of Applicability" points to 42001.
• "How to assess one system's effects on people and society" points to 42005.
• Organizational AI risk management guidance points to ISO/IEC 23894, not 42005.
• Shared terminology points to ISO/IEC 22989.
• A 42001 certificate is not EU AI Act conformity, and a 42005 assessment is not a FRIA.

A memory aid: 22989 is the words, 42001 the system and 42005 the impact. Practice in lesson II.D.4, and compare frameworks in NIST AI RMF vs ISO/IEC 42001.