Customer trust
A recognised answer to AI due diligence from customers and partners.
Certification support
ISO/IEC 42001 AI Management System
Current edition: ISO/IEC 42001:2023
The first certifiable management system standard for artificial intelligence. It helps organisations that develop, provide or use AI systems govern them responsibly: assessing risks and impacts, applying controls and showing customers and regulators that AI is under management.
AI ActRegulation
AI governance is now a regulatory expectation
The EU AI Act entered into force in August 2024, with obligations phasing in from 2025 for prohibited practices, general-purpose AI and, later, high-risk systems. ISO/IEC 42001 does not replace the Act, but an AI management system gives you the governance, risk management and documentation it expects. Certification bodies now audit AI management systems to the requirements of ISO/IEC 42006.
What the standard covers
Requirements, clause by clause
ISO/IEC 42001 sets the management system for AI. Annex A lists reference controls you select from, justified in your Statement of Applicability.
4
Context
Your role in the AI life cycle, interested parties, scope of the AIMS.
5
Leadership
Commitment, AI policy, roles and responsibilities.
6
Planning
AI risk assessment and treatment, AI system impact assessment, objectives, changes.
7
Support
Resources, competence, awareness, communication, documented information.
8
Operation
Operational planning, AI risk and impact assessments carried out, risk treatment.
9
Performance evaluation
Monitoring, internal audit, management review.
10
Improvement
Nonconformity, corrective action and continual improvement.
Clauses 4 to 10 follow the harmonized structure shared with ISO/IEC 27001 and ISO/IEC 27701, so AI, security and privacy can run as one system.
AI policies
Policies for responsible development and use of AI.
Internal organisation
Roles, responsibilities and reporting of AI concerns.
Resources
Data, tooling, computing and human resources documented.
Impact assessment
Impacts of AI systems on individuals, groups and society assessed.
AI system life cycle
Requirements, design, verification, deployment and monitoring controlled.
Data for AI
Data quality, provenance and preparation managed.
Information for interested parties
Documentation and transparency for users and affected parties.
Third parties
Responsibilities with suppliers, partners and customers allocated.
Why organisations implement it
What a working AI management system delivers
Regulatory readiness
Governance and documentation aligned with the EU AI Act and similar rules.
Controlled risk
AI risks and impacts assessed before deployment and monitored after.
Clear accountability
Named owners for each AI system and decision.
Supplier control
Third-party AI models and services brought under management.
Integrated governance
Runs with ISO/IEC 27001 and ISO/IEC 27701 in one system.
How we work
Path to certification
One AEC methodology from first assessment to certificate, delivered by registered lead auditors.
- AssessGap assessment against ISO/IEC 42001, scope and roadmap
- DesignProcesses, risk register, policy and documented information
- ImplementProcesses embedded with coaching for process owners
- TrainAwareness for all staff and internal auditor development
- VerifyInternal audit, management review and mock certification audit
- Certify & sustainStage 1 and Stage 2 support, then surveillance readiness
Full implementation
No existing system. We design and implement from the ground up.
Typically 6 to 9 monthsGap remediation
Some documentation in place. We close the gaps and prove effectiveness.
Typically 4 to 6 monthsUpgrade & integration
We add AI governance to your existing ISMS and privacy system.
Typically 3 to 5 months
Who certifies
Independent certification, chosen to fit your market
ISO/IEC 42001 certificates are issued by independent certification bodies accredited to audit AI management systems, working to ISO/IEC 17021-1 and ISO/IEC 42006. AEC prepares you for that audit; the certification decision is theirs.
CB-neutral
We help you select an accredited certification body that suits your customers and markets.
Audit-ready
Impact assessments, Statement of Applicability and mock audit completed before Stage 1.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Where it applies
ISO/IEC 42001 by industry
IT services · AI developers and SaaS providers
Finance · credit, fraud and customer models
Healthcare · clinical decision support and imaging
Government · public sector AI use
Manufacturing · quality inspection and predictive maintenance
Education · AI in teaching and assessment
Related standards
Training Academy
View the Training Academy
AI governance training
Delivered by registered lead auditors with AI governance experience. In-house, public, virtual or hybrid.
- Awareness (half day) for leadership and AI teams
- Implementer (2 to 3 days) for AI governance owners
- Internal Auditor (2 to 3 days) in line with ISO 19011
- AI impact assessment workshops
Questions
ISO/IEC 42001 FAQ
Does AEC issue the ISO/IEC 42001 certificate?
No. Certificates are issued by independent certification bodies accredited to audit AI management systems. AEC prepares your organisation for that audit and supports you through Stage 1 and Stage 2.
Does ISO/IEC 42001 make us compliant with the EU AI Act?
No standard does that on its own. ISO/IEC 42001 provides the governance, risk management and documentation the Act expects, and we map your system to the obligations that apply to your AI systems. Our ISO/IEC 42001 readiness checklist sets out where the standard stands relative to the Act.
We only use AI from vendors. Does ISO/IEC 42001 apply?
Yes. The standard applies to organisations that use AI as well as those that develop it. The scope and controls reflect your role in the AI life cycle.
Can ISO/IEC 42001 be combined with ISO/IEC 27001?
Yes. Both use the harmonized structure and similar risk and control approaches, so many organisations add ISO/IEC 42001 to their ISMS.
Start your ISO/IEC 42001 programme
Tell us your AI systems, your role in developing or using them and your markets. We reply with a proposal covering impact assessment, implementation and certification support.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.