What Is ISO 42001?
ISO/IEC 42001:2023 is the first international standard for artificial intelligence management systems (AIMS). Published on 18 December 2023, it defines requirements for building, running, and continually improving governance around AI inside an organization — and it is certifiable by accredited third-party audit.
Publication and status
ISO 42001 was published on 18 December 2023 by ISO and IEC. It is a full management system standard, meaning organizations can be independently certified against it through accredited certification bodies, in the same way as ISO 27001 or ISO 9001.
Structure: the 10 clauses
- Scope — what the standard covers
- Normative references — other documents cited
- Terms and definitions
- Context of the organization — internal and external issues, interested parties, AIMS scope
- Leadership — policy, roles, top management commitment
- Planning — risks, opportunities, AI impact assessments, objectives
- Support — resources, competence, awareness, communication, documented information
- Operation — operational planning and control across the AI system lifecycle
- Performance evaluation — monitoring, internal audit, management review
- Improvement — nonconformity, corrective action, continual improvement
Annex A controls
Annex A lists reference controls organized into groups:
- Policies related to AI
- Internal organization
- Resources for AI systems (data, tooling, human resources, computing)
- Assessing impacts of AI systems
- AI system lifecycle
- Data for AI systems
- Information for interested parties
- Use of AI systems
- Third-party and customer relationships
Relationship to ISO 27001 and ISO 9001
ISO 42001 uses the harmonized Annex SL structure shared by ISO 27001 (information security), ISO 9001 (quality), and ISO 22301 (business continuity). This is deliberate — organizations can integrate AI governance into an existing management system rather than build a parallel one.
Certification path
- Gap assessment against ISO 42001 requirements
- Scope and boundaries of the AIMS
- Policy, risk assessment, applicability statement
- Implement selected Annex A controls
- Operate the AIMS for a period of evidence
- Internal audit and management review
- Stage 1 audit (documentation review) by certification body
- Stage 2 audit (implementation review) and certification
Frequently asked questions
What is ISO 42001?
ISO/IEC 42001:2023 is the first international standard for artificial intelligence management systems (AIMS). Published in December 2023, it defines requirements for establishing, implementing, maintaining, and continually improving an AI management system inside an organization.
When was ISO 42001 published?
ISO/IEC 42001:2023 was published on 18 December 2023 by ISO and IEC. It is the first certifiable AI-specific management system standard.
How is ISO 42001 structured?
The standard uses the harmonized structure common to all ISO management system standards: 10 clauses covering context, leadership, planning, support, operation, performance evaluation, and improvement — plus Annex A with reference controls specific to AI.
What are the Annex A controls?
Annex A of ISO 42001 lists reference controls covering AI policies, internal organization, resources for AI systems, impact assessments, the AI system lifecycle, data for AI, information for interested parties, and use of AI systems. Organizations select applicable controls based on their risk assessment.
How does ISO 42001 relate to ISO 27001 and ISO 9001?
ISO 42001 shares the same 10-clause high-level structure as ISO 27001 (information security) and ISO 9001 (quality). An organization already certified to ISO 27001 can extend its existing management system to cover AI without duplicating governance structures.
Is ISO 42001 mandatory?
ISO 42001 itself is voluntary. However, enterprise procurement processes and some regulatory regimes reference it, so a certification is quickly becoming a de facto requirement for AI vendors selling into large organizations.
How do you get ISO 42001 certified?
The path is: gap assessment, scope definition, control implementation, internal audit, management review, Stage 1 certification audit (documentation review), and Stage 2 audit (implementation review). A typical program takes 6 to 12 months and requires an accredited certification body for the audit.
Automate your ISO 42001 program
Zilonex Govern maps every Annex A control to evidence, so you walk into your audit ready.
Start Zilonex Govern free for 14 days