What is ISO/IEC 42001?
ISO/IEC 42001:2023 is an international standard that specifies requirements for an artificial intelligence management system: a documented set of policies, roles, processes and controls for governing AI, maintained over time and improved on a cycle. It follows the same management-system structure as ISO 27001, and an accredited certification body can certify an organization against it.
What a management system means
A management system is not a document set. It is the arrangement by which a set of documented commitments keeps being met after the person who wrote them has moved on: assigned responsibilities, a planning cycle, records that show a control operated, internal audits, and management review.
This is the part organizations underestimate. Writing an AI policy is a week. Being able to show, eighteen months later, that the policy was reviewed, that exceptions were logged, and that somebody owned it throughout, is the standard.
Annex A adds AI-specific control areas on top of that structure, covering things such as AI policy, internal roles, impact assessment, the system life cycle, data used for AI systems, information provided to interested parties, the use of AI systems, and third-party relationships.
Certification, and what it proves
Accredited certification is issued by an accredited certification body after an audit, usually in two stages, and it is maintained through surveillance audits, not granted once. A certificate from an unaccredited body is an attestation from whoever issued it.
What a certificate proves is that a management system exists and was operating at the time of audit, in the scope stated on the certificate. Scope matters more than most readers assume: a certificate covering one product line says nothing about the rest of the business.
A gap assessment, including this one, is not a certification body's gap analysis and carries none of its weight. Its value is finding the obvious holes before you are paying somebody by the day to find them.
When it is the right target
When a customer, a tender or a procurement questionnaire has asked for a certificate. It is the only common AI framework where the answer to that question can be yes.
When you already hold ISO 27001 and have the management-system muscle. The structure is shared, so the marginal cost is much lower than starting cold.
It is usually the wrong first target for an organization that cannot yet list its AI systems. The standard assumes a starting point, and the inventory is that starting point.
Common questions
- Is ISO/IEC 42001 mandatory?
- No. It is a voluntary standard. It becomes effectively required when a customer contract or a tender asks for it, which is the usual reason organizations pursue it. Where a contract asks for it, check whether it asks for accredited certification specifically, because that is a narrower thing than a certificate.
- Does ISO/IEC 42001 certification make you EU AI Act compliant?
- No. They are separate instruments and the standard does not claim to discharge the Act's obligations. A management system built to the standard can produce evidence useful under the Act, and harmonized standards under the Act are a distinct and evolving matter. Which obligations apply to you depends on your role and on how your systems classify.
- How long does certification take?
- That depends almost entirely on the starting point and on scope, and any figure quoted without seeing an organization is guesswork. The reliable predictor is whether the management-system habits already exist, not how much AI is in use.
Find out where you stand
The assessment on this site asks 24 questions against the framework you pick and returns a score, a verdict and, where a control is short, the one thing to fix first. It runs in your browser and takes about ten minutes.
It is a self-assessment, not an audit, not a certification, not a conformity assessment and not legal advice.
Run the assessment