ISO/IEC 42001: the world's first certifiable AI management standard.
ISO/IEC 42001:2023 gives organizations a defensible, auditable framework for governing AI across its lifecycle. We design AI Management Systems (AIMS) that integrate with existing ISO 27001 or SOC 2 programs, satisfy NIST AI RMF expectations, and prepare you for EU AI Act obligations.
- Standard published
- December 2023
- Integrates with
- ISO 27001 · SOC 2
- Aligns with
- NIST AI RMF · EU AI Act
What ISO 42001 requires
ISO/IEC 42001:2023 defines requirements for establishing, implementing, maintaining, and continually improving an AI Management System. It follows the high-level structure shared by ISO 27001 and ISO 9001, so organizations with an existing management system can extend rather than rebuild.
The standard introduces AI-specific obligations: an AI policy, AI risk and impact assessment methodology, controls across the AI lifecycle (data, model, deployment, monitoring, decommissioning), supplier and third-party AI governance, transparency and explainability requirements, and roles and responsibilities specific to AI development and use.
How we build an AIMS
- AI inventory and classification. Every AI system, internal, customer-facing, embedded vendor capability, categorized by risk and use case.
- AI policy and objectives. Aligned with business strategy, regulatory exposure, and ethical commitments.
- AI risk assessment. Using NIST AI RMF as the methodology, calibrated to your sector and risk appetite.
- AI impact assessment. For each high-risk system: affected individuals, foreseeable harms, mitigations, residual risk.
- Lifecycle controls. Data governance, model documentation, evaluation, deployment gates, monitoring, drift detection, incident response, decommissioning.
- Third-party AI governance. Vendor due diligence, contract requirements, ongoing oversight of foundation-model providers.
- Internal audit and management review. Same management-system discipline as ISO 27001.
Why early ISO 42001 certification matters
Buyers and regulators are converging on management-system thinking for AI. The EU AI Act expects high-risk providers to operate a quality management system; harmonized standards under the Act are tracking closely with ISO 42001. Canadian organizations selling AI into regulated industries, federal departments, or European markets will increasingly be asked for evidence of AI governance maturity. ISO 42001 certification is the cleanest answer.
Layered on top of ISO 27001 or SOC 2
If you already operate an ISO 27001 ISMS or a mature SOC 2 program, ISO 42001 is an extension, shared governance bodies, shared internal audit, shared risk methodology. We design integrated programs so the AIMS doesn't become a parallel bureaucracy.
Common questions
- What is ISO/IEC 42001?
- ISO/IEC 42001:2023 is the world's first certifiable management system standard for artificial intelligence. It defines requirements for an AI Management System (AIMS): leadership, AI policy, risk and impact assessment, lifecycle controls, third-party AI governance, and continual improvement. It is structured like ISO 27001 and integrates with existing management systems.
- Who should certify against ISO 42001?
- Organizations that develop, deploy, or provide AI systems, particularly those selling into regulated industries, public sector, or European buyers subject to the EU AI Act. Early certification is a strong market signal that the organization takes AI governance seriously.
- How does ISO 42001 relate to the NIST AI RMF?
- The NIST AI Risk Management Framework is a voluntary guidance document for managing AI risks. ISO 42001 is a certifiable management system that operationalizes the same concepts. We typically use NIST AI RMF as the risk methodology inside an ISO 42001 AIMS, they're complementary, not competing.
- Does ISO 42001 satisfy the EU AI Act?
- Not on its own. The EU AI Act imposes specific obligations on high-risk AI providers and deployers. ISO 42001 certification demonstrates that an organization has the governance maturity to identify and meet those obligations, and harmonized standards under the AI Act are expected to align closely with ISO 42001.
- How long does ISO 42001 implementation take?
- For organizations already certified to ISO 27001 or with a mature security management system, plan on 4–6 months to add an AIMS layer. Starting from scratch, 8–12 months is more realistic.
Your next enterprise contract is waiting on this.
- Flat fee, total cost known up front
- Canadian data residency available on paid engagements