What is ISO 42001?

What is ISO/IEC 42001?

ISO/IEC 42001 is the international standard for an Artificial Intelligence Management System (AIMS). Published in December 2023, it is the first certifiable management-system standard dedicated to governing how organizations develop, provide, or use AI systems responsibly.

Like ISO 27001 for information security, ISO 42001 is not a model “score” or a one-off ethics checklist. An AIMS defines how AI is inventoried and scoped, how AI-related risks and impacts are assessed and treated, how roles and human oversight work, how data for AI is governed, how suppliers and third parties are managed, and how you produce audit-ready evidence that the system actually operates — then improves over time.

What ISO 42001 covers

An AIMS under ISO/IEC 42001 typically addresses:

  • AI lifecycle governance — from concept and design through development, deployment, operation, monitoring, and retirement or change.
  • Risk and impact — identifying AI-related risks and impacts (including on individuals and organizations), then treating them with documented controls and accountability.
  • Human oversight — where people must remain in the loop for decisions, escalations, and use of AI outputs — mapped to how work actually flows, not only to policy text.
  • Data for AI — quality, provenance, access, retention, and other data controls that affect model and system behavior.
  • Vendors and third parties — managing AI suppliers, platforms, and integrated models so your risk does not stop at your org chart.
  • Evidence and continual improvement — policies, impact assessments, monitoring, internal audit, corrective action, and management review that stand up to external scrutiny.

The standard is designed so organizations can seek certification by an accredited body for a defined scope of AI systems and services — the same management-system logic buyers already understand from ISO 27001.

Why companies need ISO 42001

AI is now part of product roadmaps, enterprise deals, and board risk agendas. Buyers and regulators increasingly ask how AI is governed — not whether a slide deck says “responsible AI.”

  • Enterprise and product sales — security and AI questionnaires ask how models are managed, monitored, and overseen; an AIMS gives a structured answer.
  • Customer due diligence — trust centers and procurement teams are starting to request ISO 42001 or equivalent AI governance evidence alongside SOC 2 / ISO 27001.
  • Board oversight of AI risk — directors need clarity on inventory, residual risk, incidents, and accountability — not scattered tool policies.
  • EU AI Act readiness — ISO/IEC 42001 can help demonstrate organized AI governance and risk management practices. It is not, by itself, an automatic presumption of conformity under the EU AI Act. Organizations still need to map obligations by AI system risk category, role (e.g. provider vs. deployer), and applicable legal requirements; treat the standard as a useful management framework, not a substitute for legal conformity assessment.

Advantages of implementing ISO 42001

  • Structured AI risk management — risks and impacts are assessed and treated systematically across the AI lifecycle.
  • Clearer accountability — ownership for AI systems, oversight, and vendor relationships is defined and reviewable.
  • Audit-ready evidence — documentation and operating records that support customer audits, internal audit, and certification.
  • Early-mover trust — relative to ISO 27001, the certified population is still early; credible AIMS work can differentiate in enterprise conversations when scopes are accurate and current.
  • Complement to security and privacy programs — many organizations layer ISO 42001 on top of an existing ISMS (ISO 27001) and privacy controls rather than building governance in isolation.

Who uses ISO 42001

Public adoption is growing but remains earlier than ISO 27001. Organizations that have publicly announced ISO/IEC 42001 certification for in-scope AI systems or services include, for example, Amazon Web Services (e.g. Amazon Bedrock and related services in announced scope), Microsoft (Copilot and related AI services per their compliance materials), and Anthropic. Scopes vary; always verify current certificates and in-scope products. Certification of a vendor’s AI service does not certify your organization or your use of that service. Treat these as a market signal that major AI providers are investing in certifiable AIMS practices — not as an endorsement or a substitute for your own governance.

How Alayer helps

Alayer provides human-led AI governance and ISO 42001 readiness — PECB-certified, ISACA member auditors who assess how AI actually runs in your workflows, then map gaps to a certification-ready AIMS. We use AI to accelerate evidence and control mapping; auditors remain accountable for judgment and sign-off.

Typical engagement paths:

  • Pre-assessment — inventory AI systems in scope, surface governance and evidence gaps, and set a realistic roadmap.
  • ISO 42001 readiness — policies, risk/impact processes, oversight design, vendor controls, and documentation aligned to the standard.
  • Broader AI governance — alignment work that also considers frameworks such as the EU AI Act and your existing security/privacy stack (e.g. ISO 27001).

Download the free ISO 42001 Readiness Checklist, or request a pre-assessment to see where your AI management system stands before you commit to a certification timeline.

Related: Most AI programs also need a solid security baseline — see What is ISO 27001? (information security management system).

FAQ

Is ISO 42001 only for companies that build foundation models?

No. It applies to organizations that develop, provide, or use AI systems within a defined scope — including product companies embedding AI features, enterprises deploying vendor models, and providers offering AI-enabled services. Scope design matters.

Does ISO 42001 certification mean we are compliant with the EU AI Act?

Not automatically. ISO 42001 can support governance and evidence that help with readiness, but the EU AI Act has its own obligations, risk categories, and conformity pathways. Use the standard as a management-system foundation and obtain legal/regulatory advice for Act-specific conformity.

How does ISO 42001 relate to ISO 27001?

They are complementary management systems. ISO 27001 focuses on information security; ISO 42001 focuses on AI management (lifecycle, impact, oversight, AI-specific risk). Many organizations run both, with shared evidence where controls overlap.

Disclaimer: This page is an educational overview of ISO/IEC 42001 for general information. It is not legal, regulatory, or certification advice. Certification requires an accredited audit of your organization against the standard for a defined scope. References to vendor certifications are based on public announcements and may change; always verify current certificates. ISO 42001 does not by itself create a presumption of conformity under the EU AI Act. Engage qualified professionals for decisions that affect compliance or contracts.