ISO/IEC 42001:2023 is the international standard for an AI management system (AIMS), published in December 2023. It works like ISO 27001 for information security: you set up policies, assess risks, apply controls and improve over time, and an accredited body can certify you. This page lists the requirements in plain language, with a checklist you can use to prepare.
Who ISO 42001 is for
Any organisation that develops, provides or uses AI systems. Certification is most useful when clients or regulators ask for proof that you manage AI responsibly, for example AI vendors, consultancies and firms handling sensitive data.
Requirements by clause
| Clause | What it requires |
|---|---|
| 4 Context of the organisation | Understand internal and external issues, interested parties and your role (developer, provider, user). Define the scope of the AI management system. |
| 5 Leadership | Top management commitment, an AI policy, and clear roles and responsibilities. |
| 6 Planning | AI risk assessment (6.1.2), AI risk treatment and a Statement of Applicability (6.1.3), AI system impact assessment (6.1.4), and measurable AI objectives (6.2). |
| 7 Support | Resources, competence, awareness, communication and documented information. |
| 8 Operation | Run the planned processes, carry out risk assessments and impact assessments, and apply risk treatment. |
| 9 Performance evaluation | Monitoring and measurement, internal audit and management review. |
| 10 Improvement | Continual improvement, nonconformities and corrective action. |
Annex A controls
Annex A lists reference controls that you select through risk treatment and justify in your Statement of Applicability. They are grouped by objective:
- A.2 Policies related to AI: an AI policy aligned with other policies, reviewed regularly.
- A.3 Internal organisation: roles, responsibilities and reporting of concerns.
- A.4 Resources for AI systems: an inventory of data, tools, computing and people.
- A.5 Assessing impacts of AI systems: impact on individuals, groups and society.
- A.6 AI system life cycle: requirements, design, verification, deployment, operation and monitoring.
- A.7 Data for AI systems: data quality, provenance and preparation.
- A.8 Information for interested parties: documentation and transparency for users.
- A.9 Use of AI systems: responsible use, objectives and intended use.
- A.10 Third-party and customer relationships: suppliers, shared responsibilities and customers.
Readiness checklist
- ☐ Scope of the AI management system written down (which AI systems, teams and locations).
- ☐ AI policy approved by top management.
- ☐ AI inventory complete (see our risk register template).
- ☐ AI risk assessment method defined and applied (see the risk assessment template).
- ☐ AI system impact assessments done for systems that affect people.
- ☐ Statement of Applicability listing selected Annex A controls and reasons for exclusions.
- ☐ Supplier and vendor controls in place (see the vendor questionnaire).
- ☐ Training and awareness records.
- ☐ Internal audit completed and management review held.
- ☐ Corrective actions tracked to closure.
Frequently asked questions
How long does ISO 42001 certification take?
For a small or mid-sized organisation with some existing ISO 27001 work, typically several months to set up the system and gather evidence, followed by a two-stage certification audit. Without an existing management system it usually takes longer.
Can we combine ISO 42001 with ISO 27001?
Yes. Both follow the same high-level structure, so policies, internal audit and management review can be shared.
Which AI vendors are ISO 42001 certified?
A growing number of large AI providers report ISO/IEC 42001 certification. Check each tool's SafeScore page, where “Follows an AI risk standard” records what the vendor states.