ISO 42001: what it is and whether you need it

What is ISO 42001?

ISO/IEC 42001:2023 is the international standard for an AI management system. ISO and IEC published it at the end of 2023. The standard does not describe technology. It describes how an organisation keeps its AI under control: who is responsible, how you assess risks, how you monitor applications and how you improve.

It follows the same cycle as other management system standards, such as ISO 9001 and ISO 27001:

1. Plan: scope, policy, roles, risks and objectives.
2. Do: introduce measures and develop or buy applications as agreed.
3. Check: measure, audit internally, have management review.
4. Act: improve where it does not work.

An accredited certification body can audit your management system against the standard.

Who is it worthwhile for?

ISO 42001 pays off most for organisations that:

• develop AI applications themselves or deliver them to customers;
• take part in tenders where demonstrable AI governance counts;
• have customers who ask for it explicitly;
• already hold ISO 27001 or ISO 9001 and want to manage their AI within the same structure.

If your organisation only uses standard tools such as Copilot, a full management system is usually too heavy. In that case a clear AI policy and AI literacy are enough.

ISO 42001 and the AI Act

A standard is not a law. The AI Act sets legal requirements; ISO 42001 is a voluntary way to organise yourself. They do support each other:

	AI Act	ISO 42001
Nature	Law, with supervision and fines	Voluntary standard, with certification
Focus	The AI system and its risk class	The organisation that manages AI
Risk management	Mandatory for high-risk AI	For all AI within scope
Documentation and logging	Mandatory for high-risk AI	Part of the management system
Oversight	Human oversight for high risk	Roles and responsibilities recorded

ISO 42001 is not a harmonised European standard. A certificate therefore gives no automatic presumption that you comply with the AI Act. The European standards that do are being drafted by CEN and CENELEC; only once they are published in the Official Journal of the EU do they give that presumption. With ISO 42001 in place, however, you have laid a large part of the foundation.

ISO 42001 alongside ISO 27001

Both standards use the same high-level structure. If you hold ISO 27001, you reuse a lot: the policy cycle, internal audits, management review, document control and supplier management. What you add are the AI-specific parts: an impact assessment of AI on people and groups, the quality and origin of data, transparency and oversight of outcomes.

What a project looks like

1. Set the scope: which AI applications, departments and locations it covers.
2. Baseline: what you already have, and what is missing compared with the standard.
3. Risk and impact assessment: per application, the risks to the organisation and to the people the AI affects.
4. Set up: policy, roles, procedures and measures.
5. Run and measure: use the system for a while, audit internally and have management review it.
6. Certification audit: by an accredited body, in two stages.

How long that takes depends on your scope and what you already have. We lay that out in the first conversation.

What AI Heroes does here

Sources

• ISO/IEC 42001:2023, Artificial intelligence, Management system, ISO
• AI Act standardisation, European Commission