What Is ISO 42001? The AI Management Standard Explained

Somewhere in your organisation, right now, someone is pasting a contract into a chatbot to summarise it. A sales tool is scoring leads with a model nobody has looked inside. A supplier has quietly added an "AI assistant" to software you bought three years ago.

None of that is unusual. What is changing is who is asking about it. Customers want to know how you govern AI before they share data with you. More procurement questionnaires now include an AI section. Boards want assurance that a fast-moving technology is not creating risks nobody owns.

ISO/IEC 42001 is increasingly the framework they point to. It is the international standard for an AI management system, and it does for artificial intelligence what ISO 27001 does for information security. This guide explains what it is, what it asks you to put in place, how it fits with ISO 27001 and how to decide whether certification is right for you.

What ISO/IEC 42001 Is and Why It Was Created

ISO/IEC 42001:2023 was published in December 2023 by ISO and the IEC, the two bodies behind most international technology standards. Its full title is a mouthful, Information technology, Artificial intelligence, Management system, but its purpose is simple: to give organisations a structured, auditable way to develop, provide or use AI responsibly.

It was created because AI does not fit neatly into existing frameworks. Information security standards protect data and systems, but they do not ask whether a model treats people fairly, whether its outputs can be explained or what happens when it is wrong at scale. Quality standards care about consistency, but not about the societal impact of an automated decision. AI raises questions that cut across all of them.

ISO 42001 brings those questions into one management system, usually called an AIMS. Crucially, it is a management system standard, not a technical specification. It does not tell you which model to use or how to tune it. It tells you how to run AI as an organisation: who decides, how risks are assessed, what records are kept and how you know it is working.

It also applies whatever your role. The standard is written for organisations that build AI, those that provide AI-based products and services, and those that simply use AI in their operations. That last group is by far the largest, and it includes most businesses reading this.

What the Standard Asks You to Put in Place

Like ISO 27001 and ISO 9001, ISO 42001 follows a common structure. Clauses 4 to 10 contain the requirements you must meet, organised around a Plan, Do, Check, Act cycle. Select a stage to see what it involves.

A few requirements deserve special attention, because they are where AI management differs most from what you may already do.

An AI Policy and Clear Ownership

Leadership must set an AI policy that fits the organisation's purpose and commits to meeting requirements and improving over time. Roles and responsibilities must be assigned. In practice this is where many organisations discover that AI use has grown without anyone being accountable for it.

AI Risk Assessment and Treatment

You need a repeatable way to identify, analyse and evaluate risks associated with AI, then decide how to treat them. The risks go beyond security: think inaccurate outputs, bias, misuse, intellectual property, model drift and reliance on a single supplier.

AI System Impact Assessment

This is the requirement with no real equivalent in ISO 27001. You must assess the potential consequences of an AI system for individuals, groups and society, not just for your own organisation. A CV screening tool, for example, needs an assessment of how it could affect candidates, not only whether the data is secure.

Annex A Controls and a Statement of Applicability

Annex A lists 38 reference controls grouped into nine areas. You select the ones relevant to your AI systems and justify any you exclude in a statement of applicability, exactly as you would for ISO 27001.

Annex B gives implementation guidance for each control. Annex C lists potential AI-related objectives and risk sources, and Annex D explains how the management system applies across different domains and sectors. They are guidance rather than requirements, but they make the standard much easier to put into practice.

ISO 42001 vs ISO 27001: How They Fit Together

If you already hold ISO 27001, you are closer than you think. Both standards share the same harmonised structure, so the management system skeleton is identical: context, leadership, planning, support, operation, performance evaluation and improvement. Your document control, internal audit, management review and corrective action processes can all extend to cover AI.

What 42001 adds is the AI-specific layer: impact assessments, responsible AI objectives, data quality and provenance, life cycle controls and human oversight. What 27001 continues to provide is the security of the information and systems your AI depends on. The two work best together. A model is only as trustworthy as the data and infrastructure it runs on, and a secure system can still make harmful decisions.

Many organisations run them as an integrated management system with one set of governance processes, one audit programme and one management review. Certification bodies can audit both together, which reduces duplication. Our ISO consultancy team can design an integrated system from the outset, so you run one programme rather than two.

Who Should Consider Certification

ISO 42001 is voluntary. No UK law requires it. That said, certification tends to make sense in a few situations:

• You sell AI-powered products or services. Customers will ask how you manage AI risk, and an independent certificate answers that question once rather than in every questionnaire.
• AI influences decisions about people. Recruitment, lending, insurance, healthcare and education are areas where errors and bias have real consequences and where scrutiny is rising.
• You sell into the EU. The EU AI Act expects documented risk management, data governance and human oversight. ISO 42001 is not a harmonised standard under the Act, so it does not on its own presume conformity, but it provides the governance framework the Act's obligations sit on.
• You are in a regulated sector. Financial services, legal and health organisations face growing expectations from their own regulators about AI accountability.
• Your board wants assurance. Certification provides an external, structured view that AI is under control.

For organisations that only use a handful of mainstream AI tools, a lighter approach may be enough to start: an inventory, an acceptable use policy and an approval route for new tools. Our 90-day plan to bring shadow AI under control is a good place to begin. The ISO 42001 structure is still useful as a blueprint, even if you never pursue the certificate.

Where are you today? The self-check below gives a quick sense of how much is already in place.

A Practical Route From Gap Analysis to Certification

The journey to certification follows a familiar pattern for anyone who has done ISO 27001. The difference is that the first step, finding out what AI you actually use, often takes longer than people expect.

Three habits make the route smoother:

1. Start with the inventory, not the policy. It is tempting to write the AI policy first. Resist it. Until you know what AI is in use, including tools staff adopted themselves and AI features inside existing software, any policy is guesswork.
2. Scope sensibly. You do not have to certify every AI system on day one. A clear, well-defined scope covering your most important AI services is more valuable than a sprawling one you cannot evidence.
3. Build evidence as you go. Auditors want to see the system operating, not just documented. Risk assessments, approvals, reviews and training records gathered over several months are what turn a set of documents into a certifiable system.

Certification itself is carried out by an independent, accredited certification body in two stages. Stage 1 reviews your documentation and readiness. Stage 2 tests whether the system works in practice. After that, surveillance audits continue through the certificate's life.

How Cybergen Can Help

Cybergen helps organisations put AI governance in place that is practical, proportionate and ready for scrutiny. Our AI governance, risk and compliance service brings together ISO/IEC 42001, the NIST AI Risk Management Framework and the EU AI Act:

• AI discovery to build an inventory of every AI system, tool and feature in use
• ISO/IEC 42001 gap analysis, with a prioritised roadmap
• AI policy, risk and impact assessment methods that fit how you work
• Integration with an existing ISO 27001 ISMS through our ISO consultancy
• Internal audit and readiness checks before your certification body arrives
• Security testing of AI applications through our AI security services

We prepare you for certification. An independent, accredited body carries out the audit and issues the certificate. If AI is already appearing in your customers' questionnaires, talk to our team about where you stand.

Frequently Asked Questions