ISO/IEC 42001

The Technical Definition

ISO/IEC 42001 is the international standard for AI management systems, published jointly by ISO and IEC in December 2023. It specifies the requirements for establishing, operating, maintaining, and continually improving a management system for artificial intelligence inside an organization. It follows the same Annex SL structure as ISO 9001 (quality), ISO 27001 (information security), and ISO 14001 (environment), which means it slots into existing management system programs rather than replacing them.

The scope covers governance roles, risk and impact assessments for AI systems, lifecycle controls from design through retirement, supplier management, and continuous improvement. Certification is granted by accredited third-party bodies after a multi-stage audit and is typically maintained on a three-year cycle with annual surveillance.

What This Actually Means for Your Business

ISO/IEC 42001 is a process standard. That distinction matters. The certificate does not say your AI works. It does not say your model is unbiased, accurate, or safe. It says you have a documented system for governing AI — defined roles, risk assessments, change controls, supplier oversight, incident response — and that an external auditor verified you actually use it.

That sounds like a small thing. It is not. Most companies deploying AI today have no documented system at all. Decisions about which models to use, what data to train on, what to log, who can deploy to production, and what happens when something goes wrong live in Slack threads and the heads of three engineers. ISO 42001 forces those decisions onto paper, with owners and review cycles. That alone solves a class of problems most AI failures actually come from — not bad models, but unmanaged models.

The certification is going to matter most in three places first. Regulated industries (financial services, healthcare, insurance) where regulators are looking for any defensible signal of governance maturity. Government procurement, where ISO certifications routinely become contractual minimums within two or three years of standards being published. And vendor evaluations into large enterprises, where procurement teams are starting to ask for it next to SOC 2 and ISO 27001.

The certification will not matter much if your use case is internal productivity tooling and your buyers don’t ask for it. Don’t certify because the standard exists. Certify because someone is going to require it, and you’d rather build the program now than answer an RFP without one in eighteen months.

Reality Check

What the vendor says: “Our AI platform is ISO 42001 certified.”

What that means in practice: A third party verified that the company has documented processes for managing AI risks — risk assessments, role definitions, change control, supplier oversight. It does not mean their model is accurate, fair, or appropriate for your use case. Ask for the statement of applicability. That document tells you what was actually in scope.

What Operators Actually Do

The companies pursuing 42001 today are doing it for one of two reasons. Either a customer or regulator is going to demand it, and they’re moving early. Or they have an existing ISO 27001 program and adding 42001 is a marginal cost — same auditors, same management review cadence, same internal audit team. If neither is true, it’s premature.

When they do pursue it, the work that actually matters happens before the audit. They do an honest inventory of every AI system in production and shadow IT. They classify each by risk — who uses it, what decision it influences, what happens when it fails. They build a register of suppliers and the models behind their products, because 42001 makes you responsible for the AI you procure as well as the AI you build. Most of that inventory work has never been done. It exposes more than the certification itself ever will.

They also resist the temptation to certify the easiest scope. A 42001 certificate that covers an internal HR pilot but excludes the customer-facing product is technically valid and practically meaningless. The right scope is the systems where AI failure would cost the most. If those are out of scope, the certificate is not the signal you wanted to send.

The Questions to Ask

1. What’s in the statement of applicability? This is the document that defines the certified scope. If your vendor’s high-risk system isn’t in it, the certificate doesn’t cover what you need.

2. Who is the certification body, and are they accredited? ISO certifications are only meaningful if issued by an accredited body (look for IAF MLA member accreditation). Anyone can print a certificate. Not everyone can issue one.

3. What did the surveillance audit find last year? Initial certification is the easy audit. The annual surveillance audits are where real problems surface. If the vendor can’t describe last year’s findings, they either haven’t been audited yet or aren’t paying attention to their own program.