Skip to main content
Policy Authority
Category: GRC Frameworks

ISO/IEC 42001

Also known as: ISO 42001, ISO/IEC 42001:2023, AI Management System standard, AIMS standard
Simply put

ISO/IEC 42001 is an international standard that sets out how an organization should manage its use, development, or provision of artificial intelligence in a structured, governable way. It describes a management system approach so that AI-related activities can be directed, monitored, and improved over time. It is intended for organizations that develop, provide, or use AI and can be certified against by an accredited third party.

Formal definition

ISO/IEC 42001:2023, jointly issued by ISO and IEC, specifies requirements and provides guidance for establishing, implementing, maintaining, and continually improving an artificial intelligence management system (AIMS) within an organization's context. As a management-system standard, it addresses the governance structures, roles, and processes for directing AI-related activities rather than prescribing specific technical controls or model-level engineering methods. It applies to organizations that develop, provide, or use AI systems and, per the evidence, is a certifiable standard, meaning conformity may be assessed and certified by third parties. This entry does not cover clause-by-clause requirements, certification procedures, or how ISO/IEC 42001 interacts with jurisdiction-specific AI regulation, which vary by context.

Why it matters

Many organizations are adopting artificial intelligence more rapidly than they establish the structures to govern it. ISO/IEC 42001 addresses this gap by providing an internationally recognized, management-system approach to directing, monitoring, and improving AI-related activities. For governance professionals, it offers a recognizable reference point, analogous in form to other ISO management-system standards, for demonstrating that AI development, provision, or use is being managed in a structured and accountable way rather than on an ad hoc basis.

Because ISO/IEC 42001 is a certifiable standard, an organization may seek conformity assessment and certification from an accredited third party. This can support external assurance to customers, partners, regulators, and other stakeholders that defined governance processes for AI are in place and subject to continual improvement. Certification does not by itself guarantee that any particular AI system is safe, fair, or compliant with applicable law; it attests to the existence and operation of a management system, not to the technical performance of individual models.

The standard's relevance is heightened by the emergence of jurisdiction-specific AI regulation, though the way ISO/IEC 42001 interacts with such regulation varies by context and is not addressed in this entry. Organizations should treat the standard as a governance framework that complements, rather than substitutes for, applicable legal and regulatory obligations.

Who it's relevant to

AI developers and providers
Organizations that develop or provide AI systems fall within the intended scope of ISO/IEC 42001. The standard offers a structured way to govern AI-related activities and, where sought, to pursue third-party certification that a management system is in place. It addresses governance processes rather than the technical engineering of individual models.
Organizations deploying AI
Organizations that use AI systems are also within scope. ISO/IEC 42001 can help establish, maintain, and continually improve governance over how AI is directed and monitored, supporting more consistent oversight of AI adoption across the organization's context.
Governance and compliance professionals
Governance, risk, and compliance practitioners may use ISO/IEC 42001 as a recognized reference framework for AI governance. Because it is certifiable, it can support external assurance to stakeholders. Practitioners should note that certification attests to the management system, not to the performance or legal compliance of any specific AI system, and that its interaction with jurisdiction-specific regulation varies by context.
Assurance and certification bodies
Accredited third parties may assess and certify an organization's conformity with ISO/IEC 42001. Their role is to evaluate the AI management system against the standard's requirements, independent of the management activities being assessed.

Inside ISO/IEC 42001

AI Management System (AIMS)
The central construct of the standard: a set of interrelated policies, processes, roles, and controls established by an organization to govern the development, provision, or use of artificial intelligence in a systematic and accountable manner.
Leadership and Governance
Requirements for top management to establish an AI policy, define roles and responsibilities, and demonstrate accountability for the direction of AI-related activities, reflecting the governance pillar of GRC.
AI Risk Assessment and Treatment
Processes for identifying, analyzing, and treating risks associated with AI systems against organizational objectives, aligning with a risk management approach comparable to other ISO management system standards.
AI System Impact Assessment
Consideration of the potential consequences of AI systems on individuals, groups, and society, which distinguishes AI-specific governance from generic management system requirements.
Operational Controls and Lifecycle Processes
Controls addressing the AI system lifecycle, including data management, design, verification, deployment, and monitoring, intended to be applied according to the organization's context and role in the AI value chain.
Continual Improvement
A Plan-Do-Check-Act oriented structure common to ISO management system standards, requiring monitoring, internal audit, management review, and corrective action to improve the AIMS over time.
Harmonized Management System Structure
Adoption of the common high-level structure used across ISO management system standards, which supports integration with systems such as those addressing information security or compliance.

Common questions

Answers to the questions practitioners most commonly ask about ISO/IEC 42001.

Does ISO 42001 certification prove that an organization's AI systems are safe, unbiased, or compliant with AI-specific laws?
No. ISO 42001 is a management system standard that specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system (AIMS). Certification indicates that the management system conforms to the standard's requirements; it does not certify individual AI systems as safe, unbiased, or lawful, nor does it substitute for compliance with applicable AI-specific legislation, which varies by jurisdiction. The distinction between a conforming management system and the assured performance of specific systems should be kept clear.
Is ISO 42001 the same as a technical standard for how AI models should be built or tested?
No. ISO 42001 addresses governance and management processes for AI within an organization rather than prescribing technical methods for model design, training, or testing. It sits at the management system level, comparable in structure to other ISO management system standards, and typically points toward organizational controls, roles, and processes rather than engineering specifications. Technical evaluation methods are generally out of its scope.
How does ISO 42001 relate to other management system standards an organization may already hold?
ISO 42001 follows the harmonized structure common to ISO management system standards, which is intended to support integration with systems such as those for information security or quality. In practice, organizations often align the AIMS with existing governance, risk, and compliance processes rather than operating it in isolation. The degree of integration depends on organizational context; the standard sets requirements but does not dictate a specific implementation approach.
Which functions within an organization are typically involved in implementing an AI management system under ISO 42001?
Implementation commonly involves collaboration across governance, risk, compliance, data, and technology functions, with senior leadership accountability for the management system. Consistent with management system principles, the design and operation of controls is a management responsibility, while any internal audit or independent assurance over the AIMS should remain distinct from those managing it to preserve objectivity. Specific role allocation depends on organizational structure and size.
What steps are generally involved in establishing an AI management system aligned with ISO 42001?
Organizations typically begin by defining the scope and context of the AIMS, identifying interested parties, and establishing leadership commitment and policy. Subsequent activities commonly include assessing AI-related risks and impacts, defining objectives and controls, assigning roles and responsibilities, and setting processes for operation, monitoring, and continual improvement. The standard describes requirements at a management system level; detailed implementation specifics are left to each organization and are outside the scope of the standard itself.
Is certification to ISO 42001 required, and how would an organization pursue it?
Certification is generally voluntary and depends on organizational objectives, stakeholder expectations, and any contractual or jurisdictional drivers. Where pursued, certification is typically carried out by an accredited third-party certification body through an independent audit of the management system against the standard's requirements. This external assessment is an assurance activity distinct from the organization's own management of the AIMS. Whether certification is warranted, and the effort involved, varies by context; this entry does not constitute legal or advisory guidance.

Common misconceptions

ISO 42001 certification means an organization's AI systems are safe, unbiased, or legally compliant.
The standard specifies requirements for a management system that governs AI activities; it does not certify the quality, safety, or legality of any particular AI system. Certification, where pursued, attests to conformity of the management system rather than guaranteeing specific AI outcomes, and it does not substitute for compliance with applicable AI laws or regulations.
ISO 42001 is a regulation that organizations are legally required to adopt.
It is a voluntary international standard issued through ISO, not a law. Whether it becomes relevant to a given organization typically depends on business context, stakeholder expectations, or contractual arrangements. Legal obligations relating to AI arise separately and vary by jurisdiction and sector.
Implementing ISO 42001 replaces the need for other GRC frameworks or management systems.
The standard is designed to be integrated with, not to supersede, other management systems and controls. Organizations commonly operate it alongside frameworks addressing information security, privacy, or broader risk management, mapping overlapping requirements rather than duplicating them.

Best practices

Define the scope of the AI management system explicitly, taking account of the organization's role in the AI value chain (for example developer, provider, or user) and its specific context.
Integrate the AIMS with existing governance, risk, and compliance structures and related management systems rather than building a parallel program, using the common high-level structure to map overlapping requirements.
Establish clear leadership accountability and defined roles for AI governance, ensuring an approved AI policy is supported by top management.
Perform and document AI risk assessments and AI system impact assessments, and select controls proportionate to the identified risks and organizational context.
Maintain lifecycle controls and ongoing monitoring of AI systems, supported by internal audit and management review to drive continual improvement.
Treat certification or conformity as evidence of a functioning management system, not as assurance of AI outcomes, and continue to address applicable legal and regulatory obligations separately.
Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide