Glossary · ISO and management systems
ISO/IEC 42001 gives AI governance an auditable shape.
The 2023 international standard setting requirements for an AI management system, which organizations that develop, provide or use AI can be certified against.
Back to the glossary01 · In plain words
In plain words
The 2023 international standard setting requirements for an AI management system, which organizations that develop, provide or use AI can be certified against.
ISO/IEC 42001 is to AI roughly what ISO/IEC 27001 is to security. It sets out how to run an AI management system: policy, roles, risk and impact assessment, controls over data and the model life cycle, and regular review. A certification body can audit an organization against it.
Spelled out: ISO/IEC 42001:2023, Information technology: Artificial intelligence: Management system.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Customers buying AI products want proof that someone is accountable for how the system was built and how it behaves. ISO/IEC 42001 gives a common yardstick that works across sectors and borders. It follows the same clause structure as other ISO management system standards, so a company with an ISMS can extend existing processes. It is voluntary. It is not a substitute for laws such as the EU AI Act, though its records can support evidence for some of their duties.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Clauses 4 to 10
- The management system requirements, the same skeleton used by ISO/IEC 27001.
- Annex A
- A reference set of AI controls grouped under objectives such as data, life cycle and third parties.
- AI product due diligence
- Buyers of AI features ask whether the supplier is certified or working toward it.
- Board and risk committee papers
- Used as a reference frame when directors ask how AI is governed.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: an insurer adding an AI claims triage tool
A mid-sized insurer in Mumbai deploys a vendor model that sorts motor claims by likely fraud. It already runs an ISMS. Rather than build a separate structure, it extends its internal audit and management review to cover AI, then adds what is new: an inventory of AI systems, an assessment of how the triage tool could affect claimants, rules for human review of flagged claims, and monitoring of the vendor's model updates. The certification audit later samples the human-review records as evidence that the control runs.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- ISO/IEC 42005
- Guidance on assessing the impact of AI systems. ISO/IEC 42001 is the certifiable management system that requires impact work to happen.
- EU AI Act
- A regulation with legal duties and penalties. ISO/IEC 42001 is a voluntary standard.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Inventory your AI systems and note whether you develop, provide or use each one.
- Reuse your existing ISMS processes where the clause structure matches.
- Run impact assessments on the systems that affect people most.
- Check whether your chosen certification body is accredited for ISO/IEC 42001.
- GuideISO 42001 certification guideSix steps, Stage 1 and Stage 2, and where first audits go wrong.
- GuideISO 42001 Annex A controlsAll 38 controls across nine objectives, A.2 to A.10.
- GuideISO 42001 and the EU AI ActLaw vs standard, the risk tiers, dates, and the article-by-article map.
Sources: public ISO summary of ISO/IEC 42001:2023; Regulation (EU) 2024/1689 (Artificial Intelligence Act).
Questions about ISO/IEC 42001
Who should consider ISO/IEC 42001?
Any organization whose AI affects customers or decisions.
It applies to developers, providers and users of AI. Companies selling AI features to enterprises often adopt it first, because their buyers ask for evidence of governance.
Does ISO/IEC 42001 certification satisfy the EU AI Act?
No, though it can support the evidence.
The Act sets legal obligations that depend on your role and the system's risk level. An AIMS can produce records that help, but it is not a declaration of conformity. Counsel should confirm how the Act applies to you.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.