In December 2023, ISO published ISO/IEC 42001 — the world's first international standard for Artificial Intelligence Management Systems (AIMS). For enterprise AI governance teams navigating overlapping regulations, ISO 42001 provides what regulations alone cannot: a structured, certifiable, auditable framework for managing AI responsibly across the full lifecycle.
What ISO 42001 Is
ISO 42001 specifies requirements for establishing, implementing, maintaining, and continually improving an AI Management System. It follows the high-level structure (HLS) common to ISO 9001, ISO 27001, and ISO 14001 — making it familiar to organisations already certified under those standards. The standard is not prescriptive about technology; it specifies governance controls that must exist around AI regardless of the underlying platform. Crucially, ISO 42001 is certifiable: third-party certification bodies can audit organisations against it and issue certificates — providing a demonstrable credential that distinguishes it from guidance frameworks like NIST AI RMF.
Core Requirements
Context and leadership: Senior leadership accountability for AI governance must be documented and evidenced — not just stated in policy. Planning: AI risk assessments must address AI-specific risks including bias, explainability failures, data quality issues, and unintended system behaviour. Support: Competence, awareness, and documentation requirements map closely to EU AI Act technical documentation obligations. Operations: Controls for the full AI lifecycle — requirements, design, testing, deployment, monitoring, and decommissioning — must be demonstrably implemented. Evaluation and improvement: The AIMS must be treated as a living system with ongoing monitoring, internal audit, and management review.
ISO 42001 and the EU AI Act
The two instruments are complementary: the AI Act specifies what outcomes must be achieved for high-risk AI systems in the EU market; ISO 42001 provides the management system framework for achieving and demonstrating those outcomes. The key overlaps are in risk management, technical documentation, human oversight accountability, and post-market monitoring. An organisation that implements ISO 42001 rigorously will satisfy most of the AI Act's management system requirements as a by-product.
Implementing an AIMS
Start with a gap assessment against the standard's requirements. Build your AI policy and AI objectives early — these are leadership artefacts that establish organisational commitment and define measurable targets. Develop your AI system register and risk assessment methodology. Implement operational controls for the AI lifecycle, selecting from the Annex A reference control set based on your risk assessment. Establish your internal audit programme and management review cadence. The AIMS must be continuously evaluated and improved — not just documented.
Certification Timeline
For an enterprise implementing ISO 42001 from scratch, a realistic timeline to initial certification is 12–18 months. Organisations with mature ISO 27001 programmes can compress this significantly. Budget for a two-stage initial certification audit and ongoing annual surveillance audits. The business case is compelling: enterprise customers and regulators increasingly treat ISO 42001 certification as a proxy for AI governance maturity. As procurement processes incorporate AI governance requirements, certification will shift from differentiator to table stake.