ISO 42001: The AI Management System Standard Explained

What is ISO 42001?

ISO/IEC 42001:2023 is a management system standard for artificial intelligence, published in December 2023. It is often referred to simply as ISO 42001. Like other management system standards, it does not prescribe a particular technology. It asks an organisation to establish, implement, maintain and continually improve a documented system for governing AI, so that AI is developed, provided or used in a responsible and accountable way.

The standard is published by ISO and IEC and can be purchased and previewed on the ISO website. It applies to organisations of any size and sector that develop, provide or use AI-based products or services. Because it is a management system standard, it is certifiable: an accredited certification body can audit your AI management system against its requirements.

What does an AI management system contain?

ISO 42001 follows the harmonised structure used by other ISO management standards, with clauses 4 to 10 setting the core requirements.

• Context and scope (clause 4). Understand internal and external issues, interested parties and the boundaries of the AI management system.
• Leadership (clause 5). Top management commits to an AI policy and assigns roles and responsibilities.
• Planning (clause 6). Assess AI risks and opportunities, carry out AI system impact assessments, and set measurable objectives.
• Support (clause 7). Resources, competence, awareness, communication and controlled documented information.
• Operation (clause 8). Run the processes that implement the plans across the AI system lifecycle.
• Performance evaluation (clause 9). Monitoring, internal audit and management review.
• Improvement (clause 10). Handle nonconformities and corrective action, and improve continually.

Annex A lists reference controls grouped into control objectives, covering topics such as AI policies, internal organisation, resources, impact assessment, the AI system lifecycle, data, information for interested parties, responsible use and third-party relationships. You select the controls relevant to your risks and justify any you exclude in a statement of applicability.

Who needs ISO 42001?

No law currently requires ISO 42001 certification on its own. It is a voluntary standard, so the question is who benefits from it. In practice it suits three groups.

• AI providers and developers that sell AI products or services and are asked by enterprise customers to show structured governance.
• Regulated organisations that use AI, such as banks, insurers, healthcare and public sector bodies, which need defensible oversight of models, data and vendors.
• Organisations facing regulation such as the EU AI Act that want a recognised management framework on which to build their evidence.

Small organisations with limited AI use may not need certification, but can still use the standard as a checklist. A sensible first step is an inventory of AI systems and a candid view of where governance is weak, before deciding on scope and on whether to pursue an audit.

How does ISO 42001 relate to ISO 27001?

ISO 42001 and ISO/IEC 27001:2022 share the same high-level structure, so clauses on context, leadership, planning, support, operation, evaluation and improvement line up. An organisation that already runs an information security management system can reuse its document control, internal audit, management review and corrective action processes, which usually reduces the effort of adding an AI management system.

The two standards answer different questions. ISO 27001 protects the confidentiality, integrity and availability of information. ISO 42001 addresses wider AI concerns such as transparency, fairness, human oversight, data quality, impact on individuals and the AI system lifecycle. Security of AI systems still depends on a sound information security programme, so the two work best together. Many organisations integrate them into one management system with a shared audit cycle.

How does ISO 42001 certification work?

ISO 42001 certification follows the usual pattern for management system standards. You define the scope, implement the system, run an internal audit and a management review, then engage an accredited certification body. The external audit is normally carried out in two stages: a review of documentation and readiness, followed by an assessment of implementation and effectiveness. A certificate is typically valid for three years with surveillance audits in between.

Certification attests to the management system within the stated scope. It does not certify that an individual AI model is accurate, fair or safe, and it does not equal legal compliance. Check that your certification body is accredited for ISO/IEC 42001. ISO/IEC 42006, published in 2025, sets additional requirements for bodies that audit and certify AI management systems, so ask which accreditation applies.

How does ISO 42001 fit with the EU AI Act and the NIST AI RMF?

The EU AI Act is binding law with specific obligations by risk tier. ISO 42001 is a voluntary management framework. Implementing it does not by itself satisfy the Act, and the Act's text does not treat certification as automatic proof of conformity, although harmonised standards may later give a presumption of conformity. Still, risk management, documentation, data governance and oversight processes built for ISO 42001 produce much of the evidence a regulator will ask for. See our guide to the EU AI Act for the legal requirements.

The NIST AI Risk Management Framework, released as version 1.0 in January 2023, is also voluntary and organises work into four functions: Govern, Map, Measure and Manage. It is a risk framework rather than a certifiable standard, and the two are complementary. Organisations frequently use the NIST functions to structure risk work and ISO 42001 to give it an auditable management wrapper.

How should you prepare for ISO 42001?

1. Build an inventory of AI systems you develop, provide or use, including third-party tools staff adopt on their own.
2. Define the scope of the AI management system and the roles you play, such as developer, provider or user.
3. Assess risks and impacts, then select Annex A controls and record your reasoning.
4. Write the AI policy, assign owners and set objectives that can be measured.
5. Operate the controls long enough to generate records, then run an internal audit and a management review.

Keep the system proportionate. Auditors look for controls that work in your organisation, not for volumes of paperwork.

How Krasper helps

Krasper Technologies is an AI governance and cybersecurity firm based in Meydan, Dubai, serving regulated organisations in the UAE, the GCC and the EU. Our AI governance consulting supports scoping, gap assessment, AI inventory, impact assessment design and policy drafting for an AI management system.

Krasper Raigate is a self-hosted AI governance firewall that enforces AI policy, redacts PII and logs governed requests to the database. Those logs can support operational evidence for monitoring and control requirements. Raigate does not certify an organisation, and certification decisions rest with an accredited certification body.

Sources

• ISO/IEC 42001:2023, Artificial intelligence, Management system
• ISO/IEC 27001, Information security management systems
• NIST AI Risk Management Framework
• European Commission, regulatory framework for AI