ISO 42001

What it is

ISO/IEC 42001 is the first certifiable management system standard for artificial intelligence. It follows the same structure as ISO 27001 — scope, leadership, risk, controls, internal audit, management review — but the risk lens covers AI-specific concerns: intended use and misuse, data provenance, model lifecycle, human oversight, transparency, and impact on affected parties. Certification is issued by an accredited certification body on the same three-year cycle.

Who typically needs it

• AI-first products whose enterprise buyers have started asking how models are governed
• Healthcare, financial, and public-sector vendors whose AI features trigger additional diligence
• Companies already certified to ISO 27001 looking for the natural next certification
• Organizations preparing for EU AI Act obligations who want a defensible governance record now
• Vendors who want a first-mover position while the certificate is still rare

What the engagement looks like

Baseline. We assess the AI management system requirements against how your models are actually built, evaluated, deployed, and monitored today. The gap is usually not in the engineering practice but in the record of it.

Build. We define the AI system inventory, the impact assessment process, data governance for training and evaluation sets, and the human oversight model. Where you already hold ISO 27001, we extend the existing management system rather than standing up a parallel one.

Build, continued. We author the policy suite and the lifecycle documentation — intended use statements, evaluation records, model change control, incident handling for model behaviour — and work with your ML team to make the cadence sustainable.

Audit Sprint. We run the internal audit and management review, mock the Stage 1 review, and close findings before the certification body arrives. Assessors for this standard are still few, and preparation matters more than usual.

Steady State. Model estates change faster than the annual audit cycle. We keep the AI system inventory and impact assessments current, refresh evaluation evidence, and prepare surveillance audit packages.

Common failure modes

• Treating the standard as a document exercise disconnected from the ML lifecycle
• An AI system inventory that omits vendor and embedded third-party models
• Impact assessments with no record of who reviewed them or what changed as a result
• Running ISO 42001 as a separate program when ISO 27001 already provides the management system

Related frameworks