What is ISO/IEC 42001?
ISO/IEC 42001 is the international management system standard for artificial intelligence. It specifies how an organisation establishes and maintains a management system for its AI activity, from assigned roles through risk assessment to internal audit. Like the information security standard before it, it is certifiable by an accredited body.
Also called: AI management system standard
Why a certificate answers a question a policy document cannot
Procurement teams began asking for this certificate before most suppliers had heard of the standard. The reason is structural, since a buyer evaluating twelve AI suppliers has no way to assess twelve separate governance narratives, where an accredited certificate reduces all of it to a question with an answer. For the supplier, the work is less about the AI than about proving that a management system exists and is maintained, which is unfamiliar ground for an engineering organisation. The audit asks for records of things the organisation should have been doing anyway.
- Certification converts a governance claim into something a buyer can verify.
- The standard imposes a management system, which outlasts any individual project.
- An external audit finds the gaps an internal review has learned to overlook.
- Certification is increasingly a precondition for public sector procurement.
How ISO/IEC 42001 works
- The scope of the management system is defined and documented.
- Roles with authority over AI risk are assigned to named people.
- Risks are assessed per AI system, with treatment recorded against each.
- Controls are selected from the standard and justified wherever they are excluded.
- Internal audit and management review are performed before external assessment.
- An accredited body assesses the system, with surveillance audits thereafter.
How ISO/IEC 42001 is evaluated
Readiness is assessed on evidence rather than on the volume of documentation. Examine the following before an external body is engaged:
- proportion of deployed AI systems inside the declared scope
- completeness of risk assessment records per system
- coverage of the standard's controls, with exclusions justified
- evidence of internal audit performed independently of the owner
- age of the most recent management review
Limitations, risks and common failure modes
- The scope is narrowed to one pilot, which the certificate then appears to cover.
- Documentation is prepared for the audit and diverges from practice afterwards.
- Risk assessments are completed once and never revisited as systems change.
- Certification is offered to clients as evidence about a specific model's behaviour.