ISO 42001
ISO/IEC 42001:2023 — AI Management System (AIMS)
The certifiable AI management system standard
ISO/IEC 42001 is the first international standard for an AI Management System — the AI equivalent of ISO 27001 for security. It sets out how an organization should govern AI responsibly: policy, risk and impact assessment, lifecycle controls (Annex A), and continual improvement. It is voluntary, but it can be independently certified, which is increasingly asked for in procurement and enterprise deals.
Who must comply with ISO 42001?
Voluntary for everyone, but valuable to any organization that builds or deploys AI and wants a recognized, auditable governance framework — especially those selling into enterprises or regulated sectors that ask for an AI management system.
Not sure if ISO 42001 applies? Run a free assessment →
Key obligations under ISO 42001
AI policy & objectives
Establish a documented AI policy, governance roles, and measurable objectives aligned with your risk appetite.
AI risk assessment
Run a systematic AI risk assessment and treatment process across the AI lifecycle.
AI impact assessment
Assess impacts of AI systems on individuals and society, not just on the organization.
Annex A controls
Implement the Annex A controls relevant to your systems — data, transparency, accountability, human oversight.
Lifecycle management
Govern AI from design and data through deployment, monitoring, and decommissioning.
Audit & continual improvement
Run internal audits, management reviews, and corrective actions to keep the AIMS effective.
Penalties & enforcement
No fines, but non-conformities found in a surveillance audit can suspend or withdraw your certificate.
Frameworks that often overlap with ISO 42001
Run a free ISO 42001 gap assessment
Answer 47 questions, get a scored gap report, and see exactly what you need to do to comply with ISO 42001 — in under 3 hours. Free forever.
Start free assessment