Skip to main content
Arelis AI

ISO/IEC 42001

Build an AI management system an auditor can check

ISO/IEC 42001 is the international standard for governing AI responsibly. AIMS gives you the inventory, risk and impact assessments, Annex A controls and audit records the standard asks for.

Get the free ISO 42001 templatesBook a demo

The basics

What is ISO/IEC 42001?

ISO/IEC 42001:2023 specifies requirements for an artificial intelligence management system (AIMS): the policies, roles, processes and records an organisation uses to develop, provide or use AI responsibly.

It follows the same harmonised structure as ISO 27001 and ISO 9001, so it sits alongside an existing information security or quality management system. Clauses 4 to 10 are the management system requirements. Annex A lists the controls, and Annex B gives implementation guidance for each one.

It is a certifiable standard. An accredited certification body audits your management system and, if it conforms, issues a certificate valid for three years with annual surveillance audits.

2023

Published by ISO and IEC in December 2023

38

Annex A controls in nine domains

3 years

Certificate cycle, with annual surveillance audits

Requirements

Clauses 4 to 10, in plain language

These are the 'shall' requirements every certified organisation must meet, whatever controls it selects.

  1. Clause 4

    Context

    Define the scope, the AI systems in it, your role and what interested parties expect.

  2. Clause 5

    Leadership

    Top management commitment, an AI policy and clear roles and responsibilities.

  3. Clause 6

    Planning

    AI risk assessment and treatment, AI system impact assessment, objectives and the Statement of Applicability.

  4. Clause 7

    Support

    Resources, competence, awareness, communication and documented information.

  5. Clause 8

    Operation

    Run the processes you planned, including risk treatment and impact assessments, and control changes.

  6. Clause 9

    Performance evaluation

    Monitor and measure, run internal audits and hold management reviews.

  7. Clause 10

    Improvement

    Handle nonconformities, take corrective action and improve continually.

Annex A

The 38 controls, by domain

You select the controls that apply to you and justify the choice in your Statement of Applicability.

DomainWhat it coversControls
A.2 Policies related to AIAI policy, alignment with other policies, policy review3
A.3 Internal organisationAI roles and responsibilities, reporting of concerns2
A.4 Resources for AI systemsData, tooling, computing and human resources5
A.5 Assessing impacts of AI systemsImpact assessment process and its effect on individuals and society4
A.6 AI system life cycleResponsible design, development, verification, deployment, monitoring and logs9
A.7 Data for AI systemsData acquisition, quality, provenance and preparation5
A.8 Information for interested partiesUser information, external reporting, incident communication4
A.9 Use of AI systemsProcesses, objectives and intended use for responsible use3
A.10 Third-party and customer relationshipsAllocating responsibilities, suppliers and customers3
Total38

Certification path

From first inventory to certificate

The order most organisations follow. AIMS supports every step up to the external audit.

  1. 01

    Scope and inventory

    Decide which parts of the organisation and which AI systems are in scope, and register them.

  2. 02

    Gap analysis

    Compare current practice against clauses 4–10 and Annex A to see what is missing.

  3. 03

    Implement

    Write the AI policy, run risk and impact assessments, implement controls and record evidence.

  4. 04

    Internal audit and management review

    Test the system yourselves and have leadership review results and objectives.

  5. 05

    Certification audit

    An accredited body runs a stage 1 documentation review and a stage 2 implementation audit.

ISO 42001 and the EU AI Act

One management system, two sets of requirements

The EU AI Act sets legal obligations for specific AI systems. ISO/IEC 42001 sets up the organisation-wide management system those obligations need: risk processes, documentation discipline, roles and continual improvement.

ISO/IEC 42001 is not a harmonised standard under the AI Act, so certification does not create a presumption of conformity. Teams that run both still save work, because the inventory, risk assessments and evidence are shared.

Read the EU AI Act guide
Cover of the ISO 42001 Implementation Playbook for AI Leaders, Second Edition

Free templates

Start with the templates from the playbook

30 editable templates for your AI management system, including the AI policy, risk register, impact assessment and Statement of Applicability, from Appendix A of the ISO 42001 Implementation Playbook for AI Leaders.

Get the free template pack

ISO 42001 FAQ

Is ISO/IEC 42001 mandatory?
No. It is a voluntary standard. Organisations adopt it to govern AI systematically, to answer customer and procurement questions, and to prepare for regulation such as the EU AI Act.
How long does ISO 42001 certification take?
It depends on scope and starting point. Organisations with an existing ISO 27001 system move faster. The playbook's worked case runs as a twelve-month implementation.
Do we need ISO 27001 first?
No. ISO/IEC 42001 stands on its own. Because both use the same harmonised structure, an existing ISO 27001 system makes integration easier.
What is a Statement of Applicability?
It is the document listing every Annex A control, whether you apply it, and why. Auditors use it to understand the scope of your controls.
Can Arelis certify us?
No. Only an accredited certification body can issue an ISO/IEC 42001 certificate. Arelis provides the software and, if you want it, consulting support to get ready for the audit.

Plan your ISO 42001 implementation

See how AIMS maps clauses 4–10 and all 38 Annex A controls to owners and evidence, using your own scope.

Book a demoGet the free templates