ISO 42001 Explained: A Practical Guide to AI Management Systems
AI is moving into customer services, recruitment, software development and everyday decision-making. If your organisation uses these systems, you need to know who owns the risks and how decisions are checked. Good intentions aren't enough when customers, staff or regulators ask for evidence.
ISO 42001 provides a structured approach to AI governance, whether you build systems or buy them. The practical starting point is to identify where AI is used and what could go wrong.
What is ISO 42001?
ISO/IEC 42001:2023, published in December 2023, is the international standard for an artificial intelligence management system (AIMS). It sets requirements for establishing, maintaining and improving how an organisation governs AI.
An AIMS connects policies, responsibilities, risk assessments, controls and management review. It covers the organisation's approach to AI rather than prescribing one model architecture or software product.
That matters because a technically secure system can still produce unfair outcomes, use poor-quality data or be deployed without adequate human oversight. The standard helps organisations address those issues as part of normal business decisions, with records that show what was assessed and why.
Following the standard and holding a certificate are different choices. You can implement its requirements without seeking an external certification audit.
Who should use the standard, and who needs certification?
ISO 42001 applies to organisations that develop, provide or use AI systems. The work involved depends on your role. A developer may need to govern training data, testing and model changes. A company using a third-party AI tool needs to assess its intended use, supplier information, staff access and oversight.
Formal certification is voluntary under the standard. It may make commercial sense when customers request independent assurance, procurement questionnaires repeatedly ask about AI governance, or several teams need a consistent approach. Before choosing a certification body, ask whether its auditors can assess your intended scope. An internal AIMS may be the proportionate first step for a smaller organisation with limited AI use.
Set the scope before deciding. Which business units, products, services and AI activities will the AIMS cover? A certificate applies to its stated scope; it shouldn't be taken as assurance for every AI tool an organisation uses.
What does ISO 42001 require?
Clauses 4 to 10 provide the management structure
The main requirements follow Annex SL, the common structure used by management-system standards. They cover organisational context, leadership, planning, support, operation, performance evaluation and improvement.
In practice, this means defining the AIMS scope, assigning authority, setting objectives and providing resources. It also means establishing processes for risk management and assessment.
You must also evaluate whether the system works. Internal audits and management reviews should lead to corrective action when processes fail or circumstances change. A policy stored in a folder won’t demonstrate effective operation on its own.
Annex A connects controls to AI-specific risks
Annex A controls include 38 reference controls across nine areas. They address AI policy, resources, the AI lifecycle, data governance, information for interested parties, responsible AI, impact assessment and third-party relationships.
These controls require applicability decisions, not automatic adoption of every measure. The Statement of Applicability (SoA) records which controls are needed, why they’re included or excluded, and how selected controls are implemented.
Keep requirements and recommendations distinct. The standard requires an appropriate risk treatment process and an SoA. A particular spreadsheet layout, committee name or assessment scoring scale is an implementation choice.
How to assess AI risks and impacts
A useful AI risk assessment begins with the system's actual purpose. The risk of generating draft meeting notes differs from the risk of screening job applications. Assessments should reflect those differences rather than give every tool the same rating.
Start with an AI inventory
Record each system's owner, supplier, intended use, users, data inputs, data governance arrangements, affected people and links to other processes. Include pilots and embedded AI features in purchased software, not only systems built by your technical team.
For each entry, identify decisions the AI influences and where a person can challenge or override an output. This inventory gives you a defensible basis for setting priorities. It also exposes uses that haven't passed through procurement or security review.
Assess organisational risk and human impact
Responsible AI requires examining security, privacy, reliability, algorithmic bias, misuse and legal obligations. Then conduct an impact assessment of effects on people and groups, including those who may be disadvantaged by poor data quality or inappropriate use. These perspectives overlap, but they are not interchangeable.
For an applicant-screening system, review whether the input data reflects the applicants being assessed, test outcomes across relevant groups and document how a recruiter reviews recommendations. Rate the likelihood and severity of identified harms using criteria agreed in advance. Record the evidence, treatment decision, remaining risk and person authorised to accept it.
A low technical failure rate cannot, by itself, demonstrate that an AI-assisted decision is fair or suitable for its intended use.
Repeat the assessment throughout the AI lifecycle when a supplier changes its model, a new data source is added or the system is used for a different decision.
How to implement an AI management system
Implementation works best as a sequence of decisions with named owners and usable evidence. You don't need a large consultancy project to begin, but you do need management time and access to the people who operate the systems.
Establish scope, ownership and a baseline
Define the scope and AI policy. Set out responsible AI principles, which activities are covered, what uses need approval and who can accept risk.
Compare current practice with the requirements. Use a gap assessment to review procurement, security, data protection, development and incident processes before writing new ones.
Assign responsibilities. Give each AI system an operational owner. Identify who approves its use, reviews impacts, manages supplier queries and reports concerns to leadership.
The output should be a prioritised action plan, not a collection of generic policies. Organisations with an existing security management system, such as ISO 27001, can reuse relevant governance processes, then add the AI-specific decisions those processes don't cover.
Turn assessments into controls and evidence
Complete risk and impact assessments across the AI lifecycle for systems in scope. Select treatments, then review the Annex A controls and create a statement of applicability (SoA). For each applicable control, record an owner, implementation status and evidence location. For an exclusion, document the reasoning clearly enough for someone outside the team to follow.
Evidence for audit readiness might include data governance and quality checks, test results, supplier reviews, approval records, staff training and procedures for handling problematic outputs. Keep records close to the work that creates them. If your teams cannot maintain a control after the audit, simplify its design.
An independent gap review or ISO 42001 gap analysis and internal audit can help test whether the arrangements operate as described.
How does ISO 42001 fit with other frameworks and laws?
The frameworks address different questions. Comparing them prevents duplicated work and helps avoid claims a certificate cannot support.
Framework or law | Main purpose | Practical relationship to an AIMS |
|---|---|---|
ISO 42001 | Govern AI through an auditable management system | Sets requirements for oversight, assessment and improvement |
ISO 27001 | Manage information security risks | Existing security processes can support AI governance |
EU AI Act | Set legal duties for AI within its scope | Requires a separate assessment of roles and obligations |
NIST AI RMF | Guide AI risk management | Offers concepts that can inform assessment methods |
ISO 42001 and ISO 27001 use compatible management-system structures, including the common Annex SL approach. If you already have an ISMS, you can build on its audit, document-control and management-review arrangements. AI impact assessment still needs dedicated attention; ISO 27001 implementation support addresses the security foundation, not every AI outcome.
The European Commission's AI Act guidance explains that the legislation became generally applicable on 2 August 2026, subject to exceptions and transition arrangements. Duties depend on the system, your organisation's role and applicable transition arrangements. An ISO certificate doesn't establish legal compliance or protect against penalties. Use ISO 42001 within a wider compliance framework, not as proof of regulatory compliance. For organisations using the NIST approach, its AI RMF crosswalk resources can help compare frameworks without treating them as equivalent.
Keep the system working after launch
A review cycle supports continuous improvement as use cases, suppliers and data governance arrangements change across the AI lifecycle. Monitor complaints, output quality, incidents and overrides to check responsible AI controls, and whether staff follow approval routes. Agree what triggers reassessment, and retain records of decisions and corrective actions.
An internal audit should sample real systems and test whether stated controls work. Management review should examine results, outstanding risks, resources and progress against objectives. Where a control fails, identify the cause, make a change and check it was effective.
For organisations without a dedicated AI governance lead, virtual CISO governance support can help maintain clear oversight alongside existing security responsibilities.
What happens during ISO 42001 certification?
Prepare for an independent audit
Choose an accredited certification body that can assess your intended scope. Confirm the certification body's accreditation status and scope of accreditation. UKAS's AIMS information provides a starting point for understanding accredited certification in the UK.
Before booking, complete an internal audit and management review. Resolve gaps and gather evidence that the AIMS has operated, including assessments, SoA decisions, monitoring records and actions taken when issues were found.
Plan for Stage 1, Stage 2 and ongoing reviews
Certification normally involves a Stage 1 review of readiness and documentation, followed by a Stage 2 assessment of implementation. Findings may require corrective action before a certificate is issued. Certification then involves surveillance audits and later recertification.
There is no reliable universal price or implementation timeline. Ask for quotes against a defined scope and allow for internal staff effort as well as audit fees. Your number of AI systems, existing processes and assessment maturity will affect the work required.
Key takeaways
ISO 42001 gives organisations a repeatable way to govern AI development and use.
Risk and impact assessments should drive control choices and a reasoned Statement of Applicability.
Certification provides independent assurance of a defined scope, but it doesn't replace legal compliance work.
Frequently asked questions
Is ISO 42001 mandatory for organisations using AI?
No. The standard and its certification are voluntary. Your organisation may still face contractual requirements or legal duties under legislation such as the EU AI Act, where applicable.
Do we need to develop our own AI model to apply it?
No. Organisations using third-party systems can apply an AIMS to supplier selection, approved use, oversight, incident handling and impact assessment.
Can an existing ISO 27001 system cover the requirements?
It can provide useful processes and evidence, but it doesn't remove the need to address AI-specific risks, impacts and Annex A applicability decisions.
Build assurance around the AI you use
The first test of AI governance is simple: can you identify your systems, explain their risks and show who is responsible for decisions? ISO 42001 turns those answers into a management system that can be reviewed and improved. Clear ownership and evidence matter more than a certificate alone.
If you would like to find out more information or require any of our services please Contact Us.
Comments