ISO/IEC 42001
In plain wordsAn international standard for how an organization should run its AI work responsibly — policies, risk checks, roles and records — which outside auditors can certify, much as ISO 9001 does for quality.
The international management-system standard 'Information technology — Artificial intelligence — Management system', which lays down auditable requirements for an AI management system (AIMS): the policies, roles, processes and records through which an organization that develops, provides or uses AI governs that work and improves it over time. It follows the harmonized structure shared with ISO 9001 and ISO/IEC 27001, so it slots into existing quality and security programs, and requires an AI policy, assigned roles, AI risk assessment and treatment, AI system impact assessment, life-cycle and data controls, and oversight of suppliers; Annex A lists reference controls. Because it states requirements, accredited certification bodies can audit and certify organizations against it, which is how it is mostly used: as evidence of AI governanceAI governance, n.: The rules, institutions and habits that shape how AI is built and used — from laws and treaties to technical standards and a company's own review processes. maturity for customers, investors and regulators.
Two of the vendors on our shortlist are already certified to ISO/IEC 42001.
Origin
Developed by ISO/IEC JTC 1/SC 42ISO/IEC JTC 1/SC 42, prop. n.: The international committee that writes the main worldwide technical standards on artificial intelligence, run jointly by the standards bodies ISO and IEC. and published in December 2023 as the first certifiable AI management-system standard; accredited certifications began in 2024. Companion standards include ISO/IEC 23894 (guidance on AI risk management, 2023), ISO/IEC 42005 (AI system impact assessment, 2025) and ISO/IEC 42006 (requirements for certification bodies, 2025).
Usage note
Certification shows that an organization runs a functioning management process, not that any particular AI system is safe or lawful. Under the EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models., presumption of conformity comes from European harmonised standardsharmonised standards, n.: Official European technical standards, written at the EU's request, that companies can follow to show their AI systems meet the law, instead of proving it from scratch., not from ISO/IEC 42001 as such.
Related
- ISO/IEC 22989ISO/IEC 22989, prop. n.: An international standard that fixes agreed meanings for basic AI words — such as AI system, machine learning and trustworthiness — so that other standards, contracts and laws can use the same vocabulary.
- ISO/IEC JTC 1/SC 42ISO/IEC JTC 1/SC 42, prop. n.: The international committee that writes the main worldwide technical standards on artificial intelligence, run jointly by the standards bodies ISO and IEC.
- NIST AI Risk Management FrameworkNIST AI Risk Management Framework, prop. n.: A free, voluntary guide from the US government's standards agency that helps organizations spot, measure and reduce the risks of the AI systems they build or use.
- AI governanceAI governance, n.: The rules, institutions and habits that shape how AI is built and used — from laws and treaties to technical standards and a company's own review processes.
- AI auditAI audit, n.: An independent check of an AI system, or of the company using it, against agreed standards — for example, testing whether a hiring tool treats women and men fairly.
- harmonised standardsharmonised standards, n.: Official European technical standards, written at the EU's request, that companies can follow to show their AI systems meet the law, instead of proving it from scratch.
- NIST AI Risk Management FrameworkNIST AI Risk Management Framework, prop. n.: A free, voluntary guide from the US government's standards agency that helps organizations spot, measure and reduce the risks of the AI systems they build or use.
Sources
- ISO/IEC 42001:2023. Information technology — Artificial intelligence — Management system. Geneva: ISO.
Mentioned in
AI governanceAI governance, n.: The rules, institutions and habits that shape how AI is built and used — from laws and treaties to technical standards and a company's own review processes., AI auditAI audit, n.: An independent check of an AI system, or of the company using it, against agreed standards — for example, testing whether a hiring tool treats women and men fairly., harmonised standardsharmonised standards, n.: Official European technical standards, written at the EU's request, that companies can follow to show their AI systems meet the law, instead of proving it from scratch., NIST AI Risk Management FrameworkNIST AI Risk Management Framework, prop. n.: A free, voluntary guide from the US government's standards agency that helps organizations spot, measure and reduce the risks of the AI systems they build or use., responsible AIresponsible AI, n.: An umbrella name for the practices organizations use to keep their AI systems fair, safe, private and accountable, from the first design meeting to everyday use., risk-based approachrisk-based approach, n.: A way of regulating AI in which the strictness of the rules depends on how much harm a use could cause: bans for the worst uses, heavy checks for risky ones, little or nothing for the rest., ISO/IEC 22989ISO/IEC 22989, prop. n.: An international standard that fixes agreed meanings for basic AI words — such as AI system, machine learning and trustworthiness — so that other standards, contracts and laws can use the same vocabulary., ISO/IEC 23894ISO/IEC 23894, prop. n.: An international guidance standard that explains how organizations can apply ordinary risk-management practice to the particular risks of AI systems., ISO/IEC JTC 1/SC 42ISO/IEC JTC 1/SC 42, prop. n.: The international committee that writes the main worldwide technical standards on artificial intelligence, run jointly by the standards bodies ISO and IEC.