ISO 42001.
Organise AI responsibility, risks and operational decisions in a management system and understand the limits of its evidence.
- ISO/IEC 42001:2023
- By Jonathan Bezdek
- As of: 10/22/2026
- Reading time: 7 min.
Short answer.
ISO 42001 is the international requirements standard for an AI management system, or AIMS. ISO/IEC 42001:2023 addresses organisations developing, providing or using AI. It organises responsibility, risks and continual improvement. Voluntary certification by an independent body evaluates the management system within its defined scope, rather than giving blanket approval to every AI application.
ISO 42001 and the AI management system.
An AI management system connects organisational objectives with reliable decisions on using artificial intelligence. The AIMS describes who is responsible, what information a decision needs and how experience leads to improvements. ISO/IEC 42001:2023 is the first international edition, dated December 2023; ISO's public publication entry continues to list it as published.
The standard considers the organisation and its handling of AI. This distinguishes an AIMS from an individual model test, product approval or source-code-only examination. A good test result can support a decision; it must also remain traceable who is responsible for use under which conditions and how changes are assessed.
ISO's public explanation of ISO 42001, section 3, distinguishes support for legal duties from their actual fulfilment. A management system creates workflows for this but does not replace assessment of the specific legal framework. European or national adoptions bearing a different year must also be distinguished from the international base edition.
Who ISO 42001 is suitable for.
ISO 42001 also addresses organisations obtaining AI from other providers. ISO's and IEC's public descriptions name development, provision and use regardless of size or sector. A service provider using purchased AI tools can therefore establish an AIMS without training a foundation model itself.
The appropriate scope follows from actual activities. Clarify, for example, which services, teams, sites and decisions should be considered and what dependencies on external models exist. A narrow starting point makes organising work easier; interfaces and consequences outside that boundary must nevertheless remain visible.
Customers may expect a specific certification scope. Ask early whether evidence should cover development of a service, its operation or internal use. An organisation's name on a certificate alone does not explain which AI activity was actually assessed.
ISO 42001 requirements at a glance.
The requirements connect management and objectives with AI-related risk work, operational processes and improvement. The following six work areas are editorial guidance based on ISO's public explanation, rather than a complete reproduction of the standard or its annexes.
Clarify the mandate and responsibility.
Management gives AI work direction and responsibilities. For practical implementation, business, development, procurement and control functions should understand which decisions they may make and when others must be involved. A central coordinator does not replace individual participants' substantive responsibility.
Bring objectives and expectations together.
The management system needs a traceable connection to organisational objectives and affected parties' expectations. Describe the intended result and applicable boundaries for the selected use. Owners can then later assess whether a change still fits the approved purpose.
Assess risks and impacts.
AI risk work also considers possible consequences for people and groups. The public description of supplementary ISO/IEC 42005:2025 makes this lifecycle perspective clear. In practice, considering operational damage separately from impacts on affected people helps prevent good performance metrics from obscuring relevant disadvantages.
Manage data, suppliers and the lifecycle.
Responsibility extends beyond initial introduction. Document relevant data sources, external services and change routes so that later decisions are based on the correct version. An update to a purchased model may require new evaluations or different usage limits.
Provide competence and information.
Participants need information appropriate to their tasks. A procurement team needs different decision inputs from people evaluating AI outputs in operation. Record responsibilities, known limitations and escalation routes understandably, and check that this information reaches actual users.
Evaluate and improve.
An AIMS remains robust only when experience and identified deviations lead to verifiable decisions. Examine operations and the effectiveness of your procedures. Each improvement should make clear who owns it, what result is expected and what the later evaluation will be based on.
Establish an AI management system.
Define use cases.
As a practical starting point, record a specific AI service with its purpose, participants and important dependencies, rather than simply listing purchased model names.
Define decision rights.
Name owners for use, technical changes and evaluation, and agree which decisions management, business functions and control functions make jointly.
Examine risks and consequences.
Assess possible adverse effects and affected groups based on the actual use context, and determine what additional information is missing for a robust decision.
Operate processes and maintain evidence.
Implement suitable controls and connect approvals, tests, supplier information and operational observations to the assessed service and version.
Evaluate internally.
Assess implementation with sufficient distance from your own work, and record which deviations, outstanding decisions and improvements will be addressed before the next approval.
Continue operations and evidence work.
Plan regular reassessments and, where appropriate, independent certification, while also responding between planned dates to changes in models, tasks or impacts.
What ISO 42001 certification demonstrates.
ISO 42001 certification confirms the assessed conformity of the AIMS within its stated scope. According to ISO's public explanation, section 7, it is voluntary and performed by independent certification bodies. ISO develops the standard but does not itself issue certificates.
The examining body's competence is a separate question. According to ISO's public description, ISO/IEC 42006:2025 supplements requirements for bodies auditing and certifying AI management systems. When selecting one, check the relevant activity scope and accreditation status as recommended on ISO's certification page.
Submitted evidence must fit the current decision. Check scope, issuing body, status and stated validity details. Operational records and technical evaluations remain necessary to assess specific AI applications; an AIMS certificate gives them no blanket security or legal approval.
ISO 42001 and other frameworks.
ISO 27001 organises information security and can provide existing processes for AI work. NIST AI RMF supports contextual examination of AI risks, while the EU AI Act establishes its own statutory roles and duties. ISO 9001 offers another management system context for shared process control and improvement activities; the respective specialist assessment subject remains distinct.
In Secani.
Secani includes an editorial work catalogue for ISO/IEC 42001:2023. Profile information covers provider or user roles, external models, personal AI data and possible impacts, among other things. Reasoned applicability decisions help relate work to the described context. The catalogue is a working aid and replaces neither lawful access to the standard nor professional assessment or independent certification.
Next step.
Choose an AI use case and assemble its purpose, owner, material dependencies and existing approval. Then check whether another person can understand the basis on which use was permitted and when the decision should be reassessed. This creates a concrete starting point for the management system.
Frequently asked questions.
Yes. The general scope also includes organisations using AI products or services from other providers. Their own activities and the defined management system scope are decisive.
No. Certification evaluates the AI management system within its scope. The safety and suitability of specific applications still require appropriate technical and professional assessments.
No. The AIMS can support organisation of evidence, but does not replace a legal assessment of roles and applicability. Legally required assessment procedures must still be observed separately.
No. Certification is a voluntary, separate decision. An organisation can establish and improve its AI responsibilities and operational processes before an external assessment.
Organise AI responsibility with a clear audit trail.
Discuss with Secani how to connect context, decisions and evidence.
This page provides general context on the standard. The current standard version and requirements of the relevant assessment and legal framework take precedence.