What is ISO/IEC 42001?
ISO/IEC 42001 is the international standard for governing artificial intelligence. Learn what it requires, how its clauses and controls fit together, and what an auditor will examine.
What to know
- ISO/IEC 42001:2023 was published in December 2023. It is the first certifiable AI management-system standard. It sets out how an organisation should govern the AI it develops, provides or uses.
- The standard has two connected parts. Clauses 4 to 10 set out the management system you must run. Annex A contains 38 AI-specific controls to consider when deciding how to treat the risks you have identified.
- The clauses provide the structure: leadership, planning, responsibilities, documented information, internal audit and continual improvement. If you have been through ISO 27001, the overall shape will be familiar.
- Annex A contains the AI-specific detail, including AI policy, impact assessment, data, transparency, responsible use and third parties. You do not automatically have to implement all 38 controls. Your organisation selects the controls that address its identified risks and records the reasoning.
- The requirements depend on what you do with AI. ISO/IEC 42001 distinguishes between developing, providing, deploying and using AI. The role your organisation holds affects the evidence an auditor will expect to see.
What the standard covers
ISO/IEC 42001 is a management-system standard. It does not prescribe which models to use, how to build them, or what accuracy to achieve. It asks you to run a system that identifies the AI you are responsible for, considers its effects on people, manages the risks, records the decisions, checks that the arrangements work, and improves them.
The standard has two connected parts. Clauses 4 to 10 set out how your AI management system operates. Annex A contains 38 AI-specific controls to consider when deciding how to treat the risks you have identified. The clauses provide the operating structure; Annex A gives you controls to assess against your particular AI activities and risks.
That applies whether you develop models yourself or use a third-party model. An organisation that uses an external model to make decisions about people still has responsibilities under ISO/IEC 42001, even if it wrote none of the code.
The clause structure follows the format used across ISO management-system standards. Organisations familiar with ISO 27001 or ISO 9001 will recognise the overall shape, with AI-specific requirements added. The distinct focus appears in Annex A and in the impact assessment, which asks you to consider consequences for individuals and society as well as risks to your organisation.
The clauses
A clause is a numbered section of the standard containing requirements you need to address. ISO/IEC 42001 has ten clauses, with clauses 4 to 10 forming the part assessed during certification. Together, they cover the full management system: defining its scope, assigning responsibility, assessing risks, running controls, checking performance and making improvements.
-
01
Clause 4 · Context
Set out what your organisation does with AI, who may be affected and what the AI management system covers. These scope decisions shape the rest of the audit. -
02
Clause 5 · Leadership
Set an AI policy, assign roles and responsibilities, and show that management is actively involved. Naming someone as accountable is not enough on its own. -
03
Clause 6 · Planning
Assess risks and opportunities, plan how to treat AI risks, complete an AI system impact assessment and set objectives. Clause 6.1.3 is where you use Annex A to select controls that address your identified risks. -
04
Clause 7 · Support
Provide the resources, competence, awareness, communication and documented information the system needs. You also need evidence that the people managing AI understand their responsibilities and have the right knowledge. -
05
Clause 8 · Operation
Put the management system into practice across the AI life cycle, from design and development through to use and retirement. This includes managing relevant third parties and suppliers. -
06
Clause 9 · Performance evaluation
Monitor the system, run internal audits and hold management reviews. Before a Stage 2 certification audit, an auditor will expect to see evidence of a completed internal audit cycle. -
07
Clause 10 · Improvement
Record nonconformities, take corrective action and improve the system over time. The evidence should show that findings lead to changes rather than simply being filed away.
The Annex A controls
A control is a measure you put in place to manage a risk or meet an objective. Examples include setting an AI policy, documenting how a system works, assessing its impact on people, managing its data and setting expectations for suppliers.
Annex A contains 38 controls, grouped under nine objectives numbered A.2 to A.10. They cover the policy and internal organisation needed to manage AI, the resources AI systems use, impact assessment, the AI life cycle from design through to retirement, data and its provenance, information for people affected by AI, responsible use, and relationships with suppliers and other third parties.
Treating the 38 controls as a checklist misses the point. Under Clause 6.1.3, you first determine the risk treatments your organisation needs. You then compare them with Annex A to check that you have not overlooked anything relevant. If you exclude a control, you need a reason for doing so.
Annex B provides implementation guidance for each control. Annex C lists AI-related objectives and risk sources to consider. Annex D explains how the standard can be applied across different domains and sectors.
Which role you hold
ISO 42001 gives different organisations different responsibilities. Your role determines what you need to manage and what an auditor will examine. You might build an AI system, provide one to customers, deploy someone else's system internally, or use its outputs in decisions.
| Role | What it means | What the audit focuses on |
|---|---|---|
| AI provider | You supply an AI system or service to other organisations or people | The information you give customers and the obligations you pass to suppliers and other parties |
| AI producer | You design, build or test AI systems | Controls across the AI life cycle, data provenance and evidence from testing |
| AI developer | You create the models and software behind an AI system | Design decisions, model documentation and control over changes |
| AI deployer | You introduce an AI system into your organisation's own operations | Impact assessment, ongoing monitoring and human oversight |
| AI user | You use an AI system's output to support or make decisions | Staff competence, oversight and the action you take when the output is wrong |
Where adoption stands
-
DEC 2023
The standard is published
ISO/IEC 42001:2023 is published as the first certifiable AI management-system standard.
-
SEP 2024
First accredited certification body
Schellman becomes the first certification body accredited for ISO/IEC 42001, after ANAB grants accreditation in the United States.
-
2026
UK accreditation opens
UKAS concludes its pilot and grants BSI the first UK accreditation for ISO/IEC 42001. NQA, LRQA and Alcumus ISOQAR follow.
-
NOW
Certificates in the hundreds
More than two hundred organisations publicly hold an ISO/IEC 42001 certificate. Twelve further bodies are progressing through UKAS accreditation.
Questions people ask
Is ISO 42001 mandatory?
+
No. ISO/IEC 42001 is voluntary. Organisations usually pursue certification because enterprise buyers and public bodies increasingly ask suppliers to show how they govern AI. A certificate provides a concise way to evidence that work.
Does it satisfy the EU AI Act?
+
No. The EU AI Act is law, while ISO/IEC 42001 is a management-system standard. Certification can provide much of the governance evidence the Act expects, but it does not discharge the Act's specific obligations for high-risk systems.
We buy AI rather than build it. Does it apply?
+
Yes. The standard can apply when you deploy a third-party model to make decisions about people. An audit will examine your impact assessment, human oversight and supplier controls. It will focus less on your code.
How many controls do we have to implement?
+
You need the controls required by your risk treatment. Annex A lists 38 controls as a completeness check, rather than a mandatory set. If you exclude a control, document the reason.
Do we need ISO 27001 first?
+
No. ISO 27001 helps because the two standards share many management-system requirements. An organisation already certified to ISO 27001 will have addressed much of clauses 4 to 10.
Read next
The parts people ask about before they commit.
Ready to pick a certification body?
Eight certification bodies, scored against our published criteria, with the evidence behind each result.