ISO/IEC 42001:2023 is the international standard for artificial intelligence management systems. It provides a framework for organisations to establish, implement, maintain, and continually improve responsible AI management. Like ISO 27001 for information security, it is a management system standard rather than a technical standard.

Who should get ISO 42001 certified?

ISO 42001 is relevant for any organisation that develops, provides, or uses AI systems. It is particularly valuable for organisations selling AI to enterprise customers who require governance evidence; organisations operating in regulated industries; and organisations wanting a structured framework for AI governance that is internationally recognised.

How does ISO 42001 relate to ISO 27001?

ISO 42001 follows the same high-level structure (HLS) as ISO 27001 and ISO 9001, making it easier to integrate with existing management systems. Organisations with ISO 27001 can leverage their existing management system infrastructure, policies, audit processes, document control, and extend it to cover AI-specific requirements.

Does ISO 42001 satisfy EU AI Act requirements?

ISO 42001 aligns closely with EU AI Act requirements but does not provide automatic compliance. Certification to ISO 42001 demonstrates a mature AI governance posture that addresses many EU AI Act requirements, but EU AI Act conformity assessment for high-risk AI has additional specific technical documentation and registration requirements.

Standard Reference · Updated 2026

What Is ISO 42001?

ISO/IEC 42001:2023 is the international standard for AI management systems, published by the International Organization for Standardization in December 2023. It provides a structured framework for organisations to establish, implement, maintain, and continuously improve responsible AI governance, regardless of the type or scale of AI they use.

Key point: ISO 42001 is a management system standard, not a technical standard. It specifies what governance processes, policies, and accountability structures an organisation should have, not how to build an AI model. The target audience is the organisation managing AI, not the data scientist building it.

Definition

ISO/IEC 42001, the international management system standard for artificial intelligence, published in December 2023, against which organisations can be independently certified.

ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining, and continually improving an AI Management System (AIMS). It follows the same Annex SL structure as ISO 27001 and ISO 9001, making it integrable with existing management systems. APRA's 30 April 2026 industry letter implicitly positioned it as the de facto answer to its expectation of "globally recognised control frameworks" for AI.

Source: ISO/IEC 42001:2023

What ISO 42001 covers

The standard follows the same ten-clause high-level structure as ISO 27001 and ISO 9001, covering:

Clauses 1-3

Scope, references, definitions

Defines what the standard covers and key AI governance terms.

Clause 4

Context of the organisation

Understanding internal and external context; identifying interested parties and their AI-related expectations.

Clause 5

Leadership

Top management commitment; AI governance policy; roles and responsibilities.

Clause 6

Planning

AI risk and opportunity assessment; AI objectives and planning to achieve them.

Clause 7

Support

Resources; competence; awareness; communication; documented information.

Clause 8

Operation

AI impact assessment; AI system lifecycle controls; data governance; supplier relationships.

Clause 9

Performance evaluation

Monitoring and measurement; internal audit; management review.

Clause 10

Improvement

Nonconformity and corrective action; continual improvement.

Annex A: the 38 reference controls

Alongside the ten management clauses, ISO 42001 carries a normative Annex A of 38 reference controls grouped under nine control objectives, numbered A.2 to A.10. Organisations do not implement all 38 by default: they select the applicable controls through a Statement of Applicability driven by their AI risk and impact assessment, the same mechanism ISO 27001 uses for information security.

A.2

Policies related to AI

Management direction and a documented AI policy.

A.3

Internal organization

Roles, responsibilities and reporting lines for AI.

A.4

Resources for AI systems

Data, tooling, compute and human resources for AI.

A.5

Assessing impacts of AI systems

Assessing AI system impacts on individuals, groups and society.

A.6

AI system life cycle

Responsible design, development and deployment controls.

A.7

Data for AI systems

Data quality, provenance and governance across the pipeline.

A.8

Information for interested parties

Transparency and documentation for users and affected parties.

A.9

Use of AI systems

Responsible, intended use and operating controls.

A.10

Third-party and customer relationships

Allocating AI responsibilities across the supply chain.

What certification involves

ISO 42001 is certified by independent third-party certification bodies, not self-declared. Those bodies are accredited against ISO/IEC 42006:2025, the standard that sets AI-specific requirements for auditing and certifying AI management systems (published July 2025). Certification runs as a two-stage audit: Stage 1 reviews the documented management system and readiness, and Stage 2 tests whether the controls are implemented and effective in practice. The certificate is valid for three years, maintained by annual surveillance audits, with recertification before it expires.

ISO 42001 vs EU AI Act

The two frameworks are complementary rather than equivalent. ISO 42001 provides the governance management system; the EU AI Act provides the legal compliance requirements. An organisation with ISO 42001 certification has strong AI governance, but still needs to assess and address EU AI Act obligations separately.

ISO 42001 provides

Management system framework
Internal governance structure
Voluntary certification
Applicable globally
Evidence of governance maturity

EU AI Act requires additionally

Conformity assessment for high-risk AI
EU AI database registration
Incident reporting to authorities
Fundamental rights impact assessment
CE marking for high-risk providers

Sources

This page is general information about ISO/IEC 42001 and AI management system certification, not legal, regulatory, or professional advice, and it does not capture every nuance, exception, or certification-body-specific requirement. Standards, accreditation rules, and how ISO 42001 interacts with laws like the EU AI Act can change and are often fact-specific. Always verify current requirements against ISO, an accredited certification body, and your own qualified legal counsel before relying on it.