What is ISO 42001?

Why AI needs a management system

Artificial intelligence now sits inside hiring tools, credit decisions, customer chatbots, medical software and everyday business automation, and the consequences of a poor decision are no longer confined to an internal report. A biased output, an unexplained decision or a leaked training dataset can harm a person, trigger a regulator and cost a hard-won client.

In the scope of ISO/IEC 42001, published by ISO and IEC in December 2023, an organization addresses this through a management system rather than through good intentions. Who approves a new AI use case? Who checks the data it was trained on? Who is told when it behaves unexpectedly? The standard makes these questions systematic, in the same way that ISO 9001 does for quality and ISO 27001 does for information security.

What is an AI management system?

An AI management system (AIMS) is the connected set of policies, roles, processes, controls and records used to manage AI responsibly across its lifecycle. It applies to organizations that develop, provide or use AI-based products or services, whatever their size or sector.

It is easiest to understand by contrast with ISO 27001. ISO 27001 protects information: confidentiality, integrity and availability. ISO 42001 addresses what is specific to AI, such as bias and fairness, transparency, explainability, data quality, human oversight and the impact of an AI system on individuals and society. Both follow the same High Level Structure, so an organization that already runs an ISMS will find the clause order and vocabulary familiar.

The structure: clauses 4 to 10

The certifiable requirements of ISO/IEC 42001 sit in clauses 4 to 10, and they follow the Plan-Do-Check-Act cycle. The organization is mandated to meet the following requirements.

• Context of the organization (clause 4): determine internal and external issues, the needs of interested parties such as customers, regulators and employees, and the scope of the AIMS. For example, a software house would decide whether the scope covers the AI features it sells, the AI tools it uses internally, or both.
• Leadership (clause 5): top management demonstrates commitment, establishes the AI policy and assigns roles, responsibilities and authorities. Is AI governance owned by someone with real authority, or is it left to individual developers?
• Planning (clause 6): determine risks and opportunities, perform AI risk assessment and AI risk treatment, assess the impact of AI systems on individuals and groups, and set measurable AI objectives.
• Support (clause 7): provide resources, competence, awareness, communication and controlled documented information.
• Operation (clause 8): plan and control the processes that develop, deploy and maintain AI systems, and carry out the risk assessments, treatments and impact assessments at planned intervals.
• Performance evaluation (clause 9): monitor, measure, analyse and evaluate the AIMS, conduct internal audits and hold management reviews.
• Improvement (clause 10): handle nonconformities, take corrective action and continually improve the suitability and effectiveness of the system.

Annexes A to D and the AI controls

Beyond the clauses, ISO/IEC 42001 contains annexes that provide most of the detailed guidance. The organization selects controls in the scope of clause 6.1.3 and documents its decisions in a Statement of Applicability.

• Annex A: a reference set of controls for AI governance, grouped into control objectives covering AI policies, internal organization, resources, impact assessment, the AI system lifecycle, data, information for interested parties, responsible use and third-party relationships
• Annex B: implementation guidance for the Annex A controls, including how to approach data management and the lifecycle
• Annex C: examples of AI-related organizational objectives and sources of AI risk that help in identifying what to assess
• Annex D: guidance on applying the AIMS across domains and sectors and integrating it with other management system standards

Roles in the AI ecosystem

Effective implementation starts with identifying where the organization sits in the AI value chain, because the roles decide which controls matter most. Related AI standards such as ISO/IEC 22989 define the terminology. The usual roles are:

• AI provider: offers products or services that use one or more AI systems, including AI platforms and AI-enabled products
• AI producer: designs, develops, tests and deploys AI systems, such as model designers, developers and verifiers
• AI user: uses an AI product or service, either directly or through a provider
• More than one role: many organizations are several at once. A company that builds a model and also uses a third-party AI tool internally holds both producer and user responsibilities

Why organizations adopt ISO 42001

Few organizations look forward to another audit, but the reasons for moving early are practical. A vigorous AIMS can deliver benefits that a one-off policy cannot. These depend on the system actually being used; a certificate alone does not create trust.

• Managed AI risk: a systematic way to identify, evaluate and treat risks that are specific to AI
• Buyer and tender confidence: evidence for customers who ask how AI is governed, which is increasingly common in enterprise due diligence
• Earlier detection of weaknesses in data, models and processes, reducing the financial and reputational cost of AI failures
• Clear accountability, because roles, approvals and records are defined
• A foundation for meeting regulatory expectations such as the EU AI Act
• Integration with an existing ISO 27001, ISO 27701 or ISO 9001 system

ISO 42001 and the EU AI Act

The EU AI Act sets legal obligations for AI systems according to their risk level, including requirements on risk management, transparency, data governance and human oversight for high-risk systems. ISO 42001 is a voluntary management system standard, not a law, and it is not a substitute for conformity with the Act.

However, the two are closely related in intent. ISO 42001 gives the organization a repeatable process for risk management, documentation, monitoring and improvement, which makes it easier to demonstrate that obligations are being managed rather than answered ad hoc when a regulator or customer asks. Whether a specific system falls under the Act, and what it must do, remains a legal question to confirm with qualified advice.

How to implement ISO 42001 in a small or growing business

A practical sequence follows the logic of the standard. Start from the AI you actually build and use, not from a template.

• Scope and inventory: list the AI systems you develop, provide and use, and decide what the AIMS covers
• Roles and policy: determine your role, assign accountability and issue the AI policy
• Risk and impact assessment: assess risks and the impact of each AI system on individuals and groups, and decide treatments
• Control selection: choose Annex A controls, justify inclusions and exclusions in the Statement of Applicability
• Lifecycle and data controls: put controls on design, data quality, testing, deployment, monitoring and retirement
• Competence and awareness: train the people who build, approve and use AI
• Operate and record: run the system and keep evidence
• Internal audit and management review: check the system, then correct findings and arrange the certification audit if required

Documents and certification

ISO 42001 uses the term documented information. Required items include the scope of the AIMS, the AI policy, the AI risk assessment and treatment process and results, the Statement of Applicability, AI objectives, evidence of competence, AI system impact assessment results, monitoring and measurement results, internal audit results, management review results, and nonconformity and corrective action records. Confirm the exact list against the published standard.

An accredited certification body assesses the AIMS within a defined scope. The assessment normally has Stage 1 (documentation and readiness) and Stage 2 (main audit), followed by surveillance audits and recertification. Certification covers the management system, not the safety of every AI model, and ISO itself does not issue certificates. Because the standard is recent, check that your certification body is accredited for ISO/IEC 42001.

How ComplyEncrypt helps with ISO 42001

ISO 42001 is on the ComplyEncrypt roadmap. ComplyEncrypt is built to bring AI inventories, risk and impact assessment records, Statement of Applicability, policies and internal-audit preparation into an AI-assisted workflow, and to connect them with ISO 27001, ISO 27701 and GDPR evidence so that work is not duplicated.

AI assistance applies to documentation work. People still decide the organization's role, judge AI risk and impact, oversee the systems and implement corrective actions, and certification remains the decision of an accredited body. Who would wish to document the same control three times? See the ISO 42001 framework page for current availability.