ISO 42001 AI Governance: A Practical Business Guide

AI adoption creates responsibilities that extend beyond technology teams. Your organisation needs clear ownership, proportionate controls and evidence that AI-related risks are being managed to support stakeholder trust.

ISO 42001 AI governance provides a structured framework for responsible AI through an artificial intelligence management system. It supports responsible decision-making, but certification doesn't guarantee that every AI system is safe, ethical or legally compliant.

The starting point is understanding what the standard governs.

Key Takeaways

• ISO/IEC 42001 provides a management system for organisations that develop, provide or use AI. Its effectiveness depends on clear ownership, proportionate controls and ongoing improvement.

• AI risk assessment considers risks to organisational objectives, while an AI system impact assessment examines effects on people, groups and society. Both should inform deployment conditions and oversight.

• Annex A contains 38 reference controls. Organisations select controls through risk treatment and document their applicability, implementation status and justified exclusions in a Statement of Applicability.

• Certification assesses the AIMS within its defined scope; it doesn't approve every AI system or guarantee safety, ethical outcomes or legal compliance. Keep regulatory obligations, including any applicable EU AI Act duties, under separate assessment.

What ISO/IEC 42001 covers

Published jointly by ISO and the IEC in December 2023, ISO/IEC 42001:2023 is the first international AI management system standard. It applies to organisations that develop, provide or use AI-related products and services.

An AI management system, or AIMS, brings policies, responsibilities, risk processes and operational controls into one framework, supporting transparency and accountability. ISO's explanation of the standard describes requirements for establishing, implementing, maintaining and continually improving that system.

The scope matters. An organisation might include particular business units, services or AI activities within its AIMS. Procurement teams should check whether a supplier's certificate covers the activities they intend to purchase.

Certification assesses the management system within its defined scope. It doesn't approve every model or validate every output, and meeting the standard doesn't replace applicable legislation or wider regulatory compliance duties. Organisations can also implement the standard without seeking certification.

How ISO 42001 AI governance becomes operational

ISO/IEC 42001 sets out its requirements in Clauses 4 to 10. Together, these clauses connect leadership decisions with operational evidence and improvement, making the AI management system practical.

Clauses 4 to 7 establish direction and accountability

Clause 4 requires organisations to understand their context, interested parties and AIMS scope. Clause 5 addresses leadership, the AI policy and assigned responsibilities, supporting responsible AI through clear ownership.

Clause 6 covers planning, including AI risk assessment, risk treatment, objectives and planned changes. Clause 7 addresses the resources, competence, awareness, communication and documented information needed to support implementation.

For business leaders, this means assigning decision-making authority and providing adequate resources. A policy has limited value if nobody owns deployment approvals, supplier oversight or risk acceptance.

Training should reflect each role. Developers, procurement teams and business users need different guidance.

Clauses 8 to 10 establish evidence and improvement

Clause 8 brings planning into operation through controlled processes, risk assessments, treatment activities and an AI system impact assessment.

Clause 9 requires performance evaluation, including monitoring, an internal audit and a management review. Clause 10 addresses nonconformities, corrective action and continuous improvement.

An effective AIMS retains evidence of decisions and outcomes, supporting transparency and accountability. That includes assessment records, approvals, monitoring results and corrective actions.

Reviews should examine whether controls remain suitable as models, suppliers and business uses change. Audit findings then support clear improvement actions with named owners.

Assessing AI risks and impacts

AI risk assessment and AI system impact assessment are related, but they examine different questions. Both support informed decisions, responsible AI and effective AI risk management throughout the AI lifecycle.

Assess risks to operations and organisational objectives

AI risk assessment considers what could prevent an organisation from achieving its objectives. Relevant issues include inaccurate outputs, security weaknesses, privacy failures, data governance, supplier dependence and inappropriate use.

The assessment should consider intended use, operating conditions and foreseeable misuse. A model's technical performance doesn't explain every business risk associated with its deployment.

Risk treatment may involve testing, bias mitigation, access restrictions, staff training, supplier requirements or human oversight. Record who accepts residual risk and the reasons for that decision.

Assess effects on individuals and society

Impact assessment examines how an AI system could affect people, groups and society. Relevant considerations include discrimination, exclusion, loss of privacy and barriers to challenging decisions.

An AI system impact assessment should examine affected groups and guide bias mitigation where needed. For organisations using AI in recruitment, lending or healthcare, overall accuracy alone is insufficient.

Results should inform deployment conditions and oversight. Review them when intended use, data or system behaviour changes.

Turning Annex A controls into deployment evidence

Annex A provides 38 reference controls across nine control objectives. These Annex A controls cover policies, internal organisation, resources, impacts, the AI lifecycle, data governance, stakeholder information, AI use and external relationships.

Controls are selected through the organisation's risk treatment process. Organisations must compare their choices with Annex A and document applicability, implementation status and justified exclusions in a Statement of Applicability. Additional controls may be necessary.

These examples connect control references with operational records.

Control reference	Deployment activity	Useful evidence
A.7.4, quality of data	Assess data suitability for the intended use	Data-quality criteria, provenance records and assessment results
A.6.2.4, verification and validation	Test against defined acceptance criteria and assess bias mitigation	Test plans, subgroup results and recorded approval
A.6.2.6, operation and monitoring	Monitor behaviour after release	Performance measures, review records and incident actions
A.10.3, suppliers	Assess external AI dependencies	Due diligence, contracts and supplier review records

The objective is traceable control operation that supports transparency and accountability, rather than collecting documents for an audit.

  A supplier's certification doesn't remove your responsibility to assess how its AI service will be used within your organisation.  

A practical starting point for smaller organisations

Smaller organisations can implement ISO 42001 AI governance proportionately. Start by understanding existing AI use and assigning workable responsibilities within an AI management system.

Inventory AI use and define a manageable scope

Create an inventory of AI systems, embedded software features and externally hosted services. Include tools used by individual teams, not only centrally approved deployments.

Record each system's purpose, owner, supplier, data inputs, affected users and decision-making authority. Use this inventory to inform AI risk management, an AI system impact assessment and scope decisions.

Define an AIMS boundary that reflects business priorities and material risks. Don't exclude significant dependencies simply to reduce the apparent workload.

Then assess existing practices against the standard. A prioritised gap analysis should identify actions, accountable owners and evidence required for completion.

Build controls into existing business processes

Use procurement reviews, change approvals and incident processes where they already work. Add AI-specific criteria rather than creating a separate administrative process for every decision.

Develop an AI policy and procedures around actual responsibilities. Give teams clear instructions on permitted use, sensitive data, escalation and deployment approval.

AKRUP's ISO 42001 consultancy and implementation supports gap assessments, risk and impact assessments, tailored documentation and certification readiness.

Operate the controls long enough to generate meaningful evidence. Internal audits and management reviews should test effectiveness and support continuous improvement before external assessment.

Integrating ISO 42001 with existing frameworks

ISO/IEC 42001 follows the Harmonized Structure used in ISO/IEC 27001. Organisations can share management processes, including document control, internal audit, management review, corrective action and continuous improvement.

The standards address different priorities. ISO 27001 focuses on information security, including confidentiality, integrity and availability. ISO 42001 adds governance for AI-related risks and impacts.

An established ISMS provides useful foundations, but security controls alone don't address unfair outcomes or unsuitable AI use. AKRUP's ISO 27001 certification support can help organisations strengthen those shared foundations.

The voluntary NIST AI Risk Management Framework offers another complementary resource. Its four functions are Govern, Map, Measure and Manage.

Certification, costs and realistic planning

Certification provides an independent assessment of an AIMS against ISO/IEC 42001. ISO publishes the standard, while a certification body conducts the external audit.

Prepare for independent assessment

Before external assessment, complete implementation, internal audit and management review. Address identified weaknesses and retain evidence that the management system operates.

The external audit generally involves a Stage 1 review of readiness and documented arrangements, followed by Stage 2 assessment of implementation and effectiveness. Nonconformities require an appropriate response before certification can be granted.

Accredited certification offers assurance about a certification body's competence within its accredited scope. UKAS announced BSI's first UKAS accreditation for this certification on 15 January 2026.

Check the certification body's current accreditation and relevant scope before arranging the external audit. Confirm that the accredited certification covers your needs. Consultancy support and independent certification are different services, and only the latter includes a third-party audit.

Budget around scope and readiness

There is no universal implementation timetable or certification price. Scope, workforce size, AI complexity, existing controls and audit arrangements influence both.

Request a quotation based on your proposed scope. Separate implementation support, certification audit fees, surveillance costs and internal staff time.

Existing management systems may reduce duplicated work. However, unresolved risks, incomplete supplier evidence or weak monitoring can extend preparation.

Plan for continuing maintenance after certification. Surveillance assessments, periodic reviews and corrective actions remain part of the commitment. A credible budget includes ongoing governance work and continuous improvement, rather than treating certification as a one-off project.

Supporting EU AI Act readiness without overstating compliance

ISO 42001 AI governance, based on ISO/IEC 42001, can support regulatory preparation through documented responsibilities, risk processes, supplier oversight and operational evidence.

The EU AI Act creates separate legal obligations. Its application depends on factors including an organisation's role, system classification and relevant activities. UK organisations should assess whether the EU AI Act applies when they supply or deploy AI in covered circumstances.

The European Commission's AI Act guidance explains the regulatory framework and phased application of the EU AI Act. Planning should identify the relevant EU AI Act obligations and dates for each system.

ISO 42001 certification doesn't itself confer a presumption of conformity under the EU AI Act. For conformity assessment, the EU AI Act mechanism relates to relevant harmonised standards cited in the EU Official Journal and the requirements they cover.

Maintain a separate legal obligations assessment for regulatory compliance. Map applicable duties to controls and evidence, then identify remaining gaps. These may include documentation, registration, transparency or conformity-assessment requirements.

Data protection and sector-specific duties also require their own assessment. Certification doesn't replace legal advice.

Frequently Asked Questions

What does ISO/IEC 42001 cover?

It sets requirements for establishing, implementing, maintaining and continually improving an artificial intelligence management system. It applies to organisations that develop, provide or use AI-related products and services.

Does ISO 42001 certification prove that an AI system is safe or legally compliant?

No. Certification assesses the management system within its defined scope, not every model or output, and it doesn't replace applicable legislation or other compliance duties.

What is the difference between an AI risk assessment and an AI system impact assessment?

A risk assessment considers what could prevent the organisation from achieving its objectives, such as inaccurate outputs or security weaknesses. An impact assessment considers potential effects on people, groups and society, including discrimination or loss of privacy.

Do smaller organisations need to implement every Annex A control?

Organisations select controls through their risk treatment process and document applicability, implementation status and justified exclusions in a Statement of Applicability. Additional controls may be needed to address the organisation's particular risks.

Does ISO 42001 certification demonstrate compliance with the EU AI Act?

No. The EU AI Act creates separate legal obligations, and certification doesn't itself confer a presumption of conformity. Organisations should assess which requirements apply to each system and identify any remaining gaps.

Building governance that remains effective

ISO/IEC 42001 gives organisations a practical structure for managing AI responsibilities, risks and impacts. Its value depends on effective implementation, supported by accountable leadership, operational evidence and responsible AI practices that build stakeholder trust.

Begin with a clear scope and prioritised gap assessment. Maintain legal assessments alongside the AIMS to support regulatory compliance, and use audits and reviews for continuous improvement.

If you would like to find out more information or require any of our services please Contact Us and complete the contact form.