What Is ISO/IEC 42001? The AI Management System Standard, Explained Plainly

ISO/IEC 42001:2023 is the international standard that sets requirements for an artificial intelligence management system (AIMS). ISO and IEC first published it on 18 December 2023 (ISO/IEC 42001:2023 on iso.org). It applies to any organization that develops, provides or uses AI systems. Organizations can be certified against it by an accredited certification body. It is voluntary.

In plain terms, ISO/IEC 42001 tells an organization how to run AI responsibly as a managed, audited system: who is accountable, how AI risks and impacts are assessed, which controls apply, and how the whole thing is checked and improved. It does not tell you how to build a model. ISO’s own listing calls it “the world’s first AI management system standard”. The current version is the first edition, and iso.org lists no amendment.

ISO/IEC 42001 at a glance

ISO/IEC 42001 is a 51-page management system standard from the joint ISO and IEC committee on artificial intelligence, sold by ISO for CHF 225. The table gives each attribute with its source.

Sources: iso.org standard and committee pages and the ISO/IEC 42001:2023 official preview (iTeh Standards).

The committee’s secretariat sits in the US. In October 2026, the ISO/IEC JTC 1/SC 42 committee page listed ANSI as secretariat, a 2017 creation date and 44 published standards, with 51 more in development.

What does ISO 42001 require an organization to do?

ISO/IEC 42001 requires an organization to establish, implement, maintain and continually improve an AI management system. That means a defined scope, an AI policy, assigned roles, AI risk and impact assessments, chosen controls, competent people, controlled records, internal audits and management reviews.

A management system is the set of interrelated elements an organization uses to set policies and objectives, plus the processes to achieve them (definition 3.4). For AI, the standard’s introduction says organizations should focus the requirements “on features that are unique to AI”, such as continuous learning or a lack of explainability. An AI management system (AIMS) is that set of elements applied to how an organization develops, provides or uses AI.

Source: clause titles from ISO/IEC 42001:2023 (official preview, table of contents, clause 4 text). The output column is an AI Training Skool summary.

Clause 8 repeats the three assessments from clause 6. Planning sets them up, and operation makes you run them again as systems change. Many summaries miss that repeat. The phases, records and auditor checks for each clause are set out in operating and improving an AI management system. The records themselves are what the standard calls “documented information”.

Who is ISO 42001 for?

ISO/IEC 42001 is for organizations, not individuals. Clause 1 says it applies to “any organization, regardless of size, type and nature” that provides or uses products or services that use AI systems. A company that only buys AI tools is in scope as much as one that trains models.

Clause 4.1 makes you decide your role for each AI system. The roles it lists include AI providers, AI producers (developers, testers, deployers and others), AI customers and users, AI partners such as integrators and data providers, AI subjects, and relevant authorities. ISO/IEC 22989 describes these roles in detail. Your role changes which requirements and controls apply. As an illustrative example, a US bank that buys a vendor’s credit model is an AI customer for that system. It can also count as an AI provider if it offers its own customers a service that uses the model.

Clause 4.2 then has you identify the people and organizations that can affect, or be affected by, your AI decisions. The standard calls them interested parties. Clause 4.1 also asks you to consider the intended purpose of each AI system, which you then manage across the AI system life cycle.

How is ISO 42001 structured?

ISO/IEC 42001 has ten clauses and four annexes. Clauses 1 to 3 cover scope, references and definitions. Clauses 4 to 10 hold the requirements. Annex A lists the reference controls and Annex B the guidance for them.

Source: ISO/IEC 42001:2023 (official preview, table of contents and clause 3). Annex A numbering: the NIST AI Resource Center crosswalk, written against the final draft text; the nine area titles match the IAPP’s June 2024 summary.

The harmonized structure means identical clause numbers and titles across ISO management system standards. The standard says this eases use alongside standards for quality, safety, security and privacy. Annex A controls are selected through risk treatment and recorded in a Statement of Applicability. Published summaries commonly count 38 controls in nine objective areas, a count ISO does not state on any free page. Each area and its controls are covered in ISO 42001 reference controls explained.

Which AI problems is ISO 42001 meant to manage?

ISO/IEC 42001 targets the ways AI differs from ordinary IT. The introduction names three: automated decisions that can be non-transparent, systems designed from data rather than hand-written logic, and systems that keep learning and change behavior in use.

From those come the trustworthiness concerns the standard lists for management processes: security, safety, fairness, transparency, data quality and system quality across the life cycle. The broader idea is often called responsible AI.

Two operational problems turn up in almost every AIMS. A model that keeps learning, or that meets changing data, can degrade without anyone noticing, a problem called model drift. Someone also has to be able to check or override an AI output where it matters, a safeguard called human oversight of AI.

Is ISO 42001 mandatory?

No. ISO/IEC 42001 is a voluntary standard, and no US federal or state law we reviewed requires certification to it. The instruments we reviewed include Texas TRAIGA, Colorado SB 26-189, California SB 942 and AB 2013, and the NIST AI Risk Management Framework (AI Training Skool review of instrument texts, September 2026).

It becomes required in practice when a buyer or partner makes it a condition: an enterprise customer’s security questionnaire, a procurement policy, or a contract clause. Texas TRAIGA, effective 1 January 2026, gives an affirmative defense to a defendant that substantially complies with the NIST Generative AI Profile or another recognized AI risk management framework. It does not name or require ISO/IEC 42001.

What does ISO 42001 certification mean, and who certifies?

ISO/IEC 42001 certification means an accredited certification body has audited your AI management system and found that it conforms to the standard, for a stated scope. ISO does not issue the certificate. ISO’s statement on certification says it “does not perform certification or issue certificates”.

Certification bodies are themselves checked by accreditation bodies. In the US, ANAB, the ANSI National Accreditation Board, is one of the bodies that accredit ISO 42001 certification bodies, with a program running since January 2024. Since July 2025, bodies that audit an AIMS also have a dedicated standard, ISO/IEC 42006, which builds on ISO/IEC 17021-1.

A company certificate follows a cycle: a Stage 1 and Stage 2 audit, annual surveillance audits and recertification in year three.

Can an individual be ISO 42001 certified?

No. A person cannot be certified to ISO/IEC 42001, because it certifies management systems, not people. Individuals earn personnel credentials such as Lead Implementer or Lead Auditor, which training and certification schemes issue, not ISO. Before you compare personnel credentials, read what an ISO 42001 Lead Implementer certificate proves.

If you want to be the person who builds an AIMS, an ISO 42001 Lead Implementer course online is one route. AI Training Skool’s course is CPD accredited by the CPD Standards Office (UK), an accreditation that covers the training. It is not an ISO/IEC 17024 personnel certification; ISO/IEC 17024 accreditation applies to a certification body and its named schemes. If an employer requires 17024, choose a 17024 route.

How much does ISO 42001 cost?

The ISO/IEC 42001 standard itself costs CHF 225 from ISO, for the PDF and ePub (iso.org, October 2026). Certification for an organization costs far more, because it adds readiness work and audit fees that depend on scope and size.

Legitimate copies come from ISO and national standards bodies, and free official previews show the table of contents and the first clauses. Sources and license terms are covered in where to buy the official ISO/IEC 42001 standard. An organization’s budget lines run from gap analysis to surveillance audits.

Which standards belong to the ISO/IEC 42001 family?

ISO/IEC 42001 is the requirements standard at the center of a family of AI standards from SC 42. The others give terminology, guidance or rules for auditors, and none of them is certifiable on its own.

Source: iso.org standard pages and the SC 42 catalog.

Two of these feed straight into clause 6 work. ISO/IEC 23894 helps with the risk assessment method, shown step by step in ISO/IEC 23894 guidance in an AI risk method. ISO/IEC 42005 helps with the impact assessment, and you can see how ISO/IEC 42005 structures an AI impact assessment in practice. The full list is in the ISO/IEC JTC 1/SC 42 published standards catalog.

How does ISO 42001 differ from ISO 27001?

ISO/IEC 27001 manages information security risk, while ISO/IEC 42001 manages AI risk and the impact of AI on people and society. Both use the same harmonized clause structure, so one organization can run them as an integrated system.

Sources: iso.org pages for both standards and the ISO/IEC 42001:2023 official preview. Effort-saving percentages quoted elsewhere are not included because we found no published source for them.

If you hold 27001 today, your document control, internal audit and management review processes carry over. The AI-specific parts, such as impact assessment and data provenance, are new work. Software vendors often weigh 42001 against a SOC 2 attestation report instead.

How does ISO 42001 relate to the NIST AI RMF?

ISO/IEC 42001 is a certifiable requirements standard; the NIST AI Risk Management Framework (AI RMF 1.0, January 2023) is voluntary US guidance, and NIST runs no certification for it. The two fit together, and ISO/IEC 42001 points to the AI RMF itself.

The note to clause 4.1 says the types of roles and their link to the AI life cycle “are also described in the NIST AI risk management framework”. You can use the AI RMF’s Govern, Map, Measure and Manage functions to shape your risk work and ISO/IEC 42001 to make that work auditable. The function-to-clause mapping, and which to start with, is in our comparison of the certifiable standard versus the voluntary framework.

How does ISO 42001 relate to the EU AI Act?

The EU AI Act is a law; ISO/IEC 42001 is a voluntary standard. The EU AI Act regulatory framework page describes Regulation (EU) 2024/1689, in force since 1 August 2024, with obligations phasing in through 2 August 2028.

A US company that places AI systems on the EU market has to meet the Act’s obligations directly. An ISO/IEC 42001 management system can organize that work, with a register, risk and impact assessments, and records. A certificate is still not the same as compliance with the Act. The European Commission says harmonized standards will give legal certainty under the Act.

Frequently Asked Questions

When was ISO 42001 published?

ISO/IEC 42001 was published on 18 December 2023 as the first edition, ISO/IEC 42001:2023. It was prepared by ISO/IEC JTC 1/SC 42, the joint committee on artificial intelligence. iso.org shows it at stage 60.60, International Standard published, with no amendment listed.

Is ISO 42001 a framework or a standard?

ISO/IEC 42001 is a standard. It contains requirements, written with “shall”, that an organization must meet to conform, and an accredited certification body can audit against it. Frameworks such as the NIST AI Risk Management Framework are voluntary guidance with no certification. People often call ISO/IEC 42001 a framework in conversation, but its formal type is a management system standard.

Is ISO 42001 free?

No. ISO sells ISO/IEC 42001:2023 for CHF 225 as a PDF and ePub. National standards bodies also sell licensed copies. Free official previews show the foreword, the introduction, the first clauses and the full table of contents, but not the Annex A controls. Copies offered as free full downloads are usually unauthorized.

Does ISO 42001 apply to companies that only use AI?

Yes. Clause 1 of ISO/IEC 42001:2023 says it applies to any organization that provides or uses products or services that use AI systems, regardless of size, type or nature. A company that only buys AI tools determines its role as an AI customer or user under clause 4.1, and the controls it needs follow from that role and its risks.

What is the difference between ISO 42001 compliance and certification?

Compliance, or conformity, means your AI management system meets the requirements of ISO/IEC 42001, which an organization can state on its own evidence. Certification means an accredited certification body has audited that system and issued a certificate for a stated scope. ISO itself does not certify anyone. A certificate carries more weight with customers because a third party has checked it.

What are the requirements for ISO 42001 certification?

An organization needs an AI management system that meets clauses 4 to 10 of ISO/IEC 42001:2023 and a Statement of Applicability covering the Annex A controls. It also needs operating records that show the system works, including an internal audit and a management review. A certification body then runs a Stage 1 and Stage 2 audit, followed by annual surveillance audits and recertification in year three.

Which companies are ISO 42001 certified?

Cloud and AI providers hold some of the best-known certificates. AWS announced ISO/IEC 42001 certification for services including Amazon Bedrock in November 2024, and Microsoft’s compliance documentation lists it for several Copilot and Foundry services (vendor pages, October 2026). Every certificate covers a stated scope, so check which products and sites it names. Scopes and dates are listed for the organizations already certified to ISO 42001.

What does ISO 42001 certification primarily address in AI applications?

ISO/IEC 42001 certification addresses how an organization governs its AI, not whether a single AI model is accurate or safe. Auditors check the management system: scope, AI policy, roles, risk and impact assessments, selected controls, records, internal audit and management review. A certificate covers the stated scope only, so check which AI systems and sites it includes.