Law and framework guide

ISO/IEC 42001

Written with AI from the sources below and checked against our facts sheet. Last checked 7 Nov 2026. How this site is made · Spot an error?

ISO/IEC 42001:2023 is the international standard for an AI management system (AIMS). An AIMS is the set of policies, roles, risk and impact assessments, controls and reviews an organization uses to govern AI. Any organization that provides or uses AI can adopt the standard, whatever its size or sector. Published in December 2023, it is the main ISO AI standard that accredited bodies certify against. Certification is voluntary.

In short

A management-system standard: it governs an organization's processes for AI, not a single product.
Certifiable by accredited certification bodies, but voluntary. No law requires it.
Follows ISO's harmonized structure (clauses 4 to 10) and Plan-Do-Check-Act, so it fits beside ISO/IEC 27001.
Annex A lists 38 reference controls; a Statement of Applicability records which ones apply and why.
Certification is evidence of good governance, not EU AI Act conformity.

Key facts
Full name	ISO/IEC 42001:2023 Information technology, Artificial intelligence, Management system
Published	December 2023 (edition 1)
Developed by	ISO/IEC JTC 1/SC 42, the joint ISO and IEC committee on artificial intelligence
Type	Requirements standard for an AI management system (AIMS)
Certifiable	Yes, by accredited certification bodies; ISO/IEC 42006:2025 sets requirements for those bodies
Mandatory	No, it is voluntary
Annex A	38 reference controls in nine areas, from AI policies to third-party relationships

What is ISO/IEC 42001?

ISO/IEC 42001 is the international standard for an AI management system (AIMS). It sets requirements for how an organization establishes, runs, maintains and continually improves the way it governs AI. ISO/IEC 42001:2023 was published in December 2023 by JTC 1/SC 42, the joint ISO and IEC committee on artificial intelligence.

A management system is the set of policies, roles, processes and records an organization uses to meet its objectives. ISO/IEC 42001 does for AI what ISO/IEC 27001 does for information security. It governs the organization's processes, not a single product.

Its published abstract says it is meant for any organization that provides or uses AI-based products or services, of any size or sector. Our lesson on ISO/IEC 22989, 42001 and 42005 covers the three core standards together.

Who can be certified against ISO/IEC 42001, and how?

Any organization can be certified, from a start-up to a multinational, whether it builds AI or only uses it. ISO/IEC 42001 is a requirements standard, so an independent auditor can check conformity against it. Of the three core ISO AI standards, it is the only certifiable one.

ISO writes the standard but does not certify anyone. Accredited certification bodies do. ISO/IEC 42006, published in July 2025, sets extra requirements for those bodies on top of the general certification rules in ISO/IEC 17021-1.

A typical path to certification:

Define the scope: which parts of the organization and which AI systems the AIMS covers.
Run a gap analysis against the clauses and the Annex A controls.
Build the AIMS: AI policy, roles, risk and impact assessments, controls and a Statement of Applicability.
Operate it, then run an internal audit and a management review.
Engage an accredited certification body for the certification audit.
Keep the certificate through periodic surveillance audits and recertification.

Certification is voluntary. No EU or US law requires it, though customers may ask for it in procurement.

What does an AI management system include?

ISO/IEC 42001 follows ISO's harmonized structure for management-system standards, clauses 4 to 10. That shared layout lets it sit beside ISO/IEC 27001 and ISO/IEC 27701 in one integrated system. It runs on the Plan-Do-Check-Act (PDCA) cycle.

Clause	Theme	What it asks for, in brief	PDCA
4	Context	Understand the organization, its stakeholders and its role with AI; set the AIMS scope	Plan
5	Leadership	Top management commitment, an AI policy and clear roles	Plan
6	Planning	AI risk assessment and treatment, AI system impact assessment, objectives	Plan
7	Support	Resources, competence, awareness, communication and documented information	Do
8	Operation	Run the planned processes and controls across the AI life cycle	Do
9	Performance evaluation	Monitoring, measurement, internal audit and management review	Check
10	Improvement	Fix nonconformities and continually improve	Act

Annex A lists 38 reference controls in nine areas. The areas are AI policies, internal organization, resources, impact assessment, the AI system life cycle and data. The rest cover information for interested parties, use of AI systems, and third-party and customer relationships.

The Statement of Applicability records which Annex A controls the organization applies and why any are excluded. Auditors use it as a map of the AIMS.

PDCA is a loop. The Act step feeds the next Plan step, which is why certification depends on continual improvement rather than a one-time snapshot.

How does ISO/IEC 42001 relate to ISO/IEC 42005 and 22989?

The core trio works together. A simple memory aid: 22989 is the words, 42001 the system, 42005 the impact.

Standard	What it is	Certifiable?	Reach for it when
ISO/IEC 22989:2022	AI concepts and terminology	No	You need shared definitions, stakeholder roles and life-cycle stages
ISO/IEC 42001:2023	AI management system requirements	Yes	You want an auditable, organization-wide system for governing AI
ISO/IEC 42005:2025	Guidance on AI system impact assessment	No	You need to assess how one AI system affects individuals, groups and society

ISO/IEC 42001 requires AI system impact assessments; ISO/IEC 42005 explains how to do them well. ISO/IEC 22989 supplies the vocabulary both rely on, such as AI system, AI provider, AI subject and life-cycle stages. ISO/IEC 23894 adds guidance on AI risk management, adapting ISO 31000 to AI.

How does ISO/IEC 42001 relate to the EU AI Act?

ISO/IEC 42001 certification is not EU AI Act conformity. Under Art. 40 of the AI Act, a presumption of conformity comes from harmonized standards whose references are published in the Official Journal. ISO/IEC 42001 is not one of them.

The two still overlap. Both expect risk management, data governance, documentation, human oversight, monitoring and clear accountability. An organization with an AIMS will already run many processes a provider's quality management system needs under Art. 17. It must still map them to the Act's specific requirements.

Impact assessment is a good example. A deployer's fundamental rights impact assessment under Art. 27 is a legal duty with set contents. An ISO/IEC 42005-style assessment can feed it but does not replace it. See the EU AI Act hub for the full duties.

US law has leaned on the standard too. Colorado's original AI Act, SB 24-205, named ISO/IEC 42001 and the NIST AI RMF in its affirmative defense. The 2026 replacement law dropped that defense; see the Colorado AI Act hub. For how it compares with NIST's framework, see NIST AI RMF vs ISO/IEC 42001 and the NIST AI RMF hub.

How does the AIGP exam test ISO/IEC 42001?

Only 42001 is certifiable. Any option offering 42005 or 22989 certification is a trap.
Requirement vs guidance. 42001 requires an impact assessment; 42005 tells you how to perform one.
Standards support compliance; they don't equal it. A 42001 certificate is not EU AI Act conformity.
PDCA and the Statement of Applicability are 42001 signatures.
Organization-wide assurance. When a scenario asks for independent proof of AI governance across a whole company, 42001 certification is usually the best fit.

Change log

7 Nov 2026: Page published.

Pages in this guide

Frequently asked questions

Is ISO 42001 certification mandatory?

No. ISO/IEC 42001 is a voluntary standard, and no EU or US law requires certification. Organizations pursue it to give customers, regulators and partners independent assurance that they govern AI responsibly. Some customers may ask for it in procurement or vendor due diligence.

Does ISO 42001 certification mean EU AI Act compliance?

No. The EU AI Act grants a presumption of conformity only for harmonized standards referenced in the Official Journal (Art. 40). ISO/IEC 42001 is not one of them. A 42001 certificate is strong evidence of good AI governance and overlaps with many AI Act duties. High-risk providers still need the Act's own conformity assessment.

What is the difference between ISO 42001 and ISO 42005?

ISO/IEC 42001 sets certifiable requirements for an organization-wide AI management system. ISO/IEC 42005, published in 2025, is guidance on assessing how one AI system affects individuals, groups and society. 42001 requires impact assessments; 42005 explains how to do them well. Only 42001 can be certified.

How many controls are in ISO 42001 Annex A?

Annex A lists 38 reference controls in nine areas. They range from AI policies, resources and impact assessment to the AI system life cycle, data and third-party relationships. Organizations record which controls they apply, and why any are excluded, in a Statement of Applicability.

Who issues ISO 42001 certificates?

Accredited certification bodies, not ISO. ISO publishes the standard but does not certify organizations. ISO/IEC 42006, published in July 2025, sets requirements for the bodies that audit and certify AI management systems. It builds on the general certification rules in ISO/IEC 17021-1.

Sources

Spot an error? Tell us