AssureCore

ISO/IEC 42001 Guide (2026): AI Management System Requirements and Certification

ISO/IEC 42001:2023 is the international standard for an **Artificial Intelligence Management System (AIMS)**. It was published in December 2023 by ISO/IEC JTC 1/SC 42 ([ISO](https://www.iso.org/standard/42001)). It specifies requirements for establishing, implementing, maintaining and continually improving an AIMS in any organisation that develops, provides or uses AI-based products or services ([ISO](https://www.iso.org/standard/42001)). The standard uses the ISO harmonized management-system structure: Clauses 4–10 plus four annexes ([ISO/IEC preview](https://webstore.iec.ch/en/iec_catalog/product/preview/?id=cHViL3BkZi9wcmV2aWV3L2luZm9faXNvaWVjNDIwMDF7ZWQxLjB9ZW4ucGRm)). That makes it easy to integrate with ISO 27001. Certification is voluntary. It is carried out by independent certification bodies, not by ISO ([ISO](https://www.iso.org/insights/iso-42001-explained)). Since July 2025, ISO/IEC 42006 has set extra requirements for bodies that certify an AIMS ([ISO](https://www.iso.org/standard/42006)). UKAS granted the first UK accreditation for 42001 certification on 15 January 2026 ([UKAS](https://www.ukas.com/resources/latest-news/ukas-grants-first-aims-accreditation/)). The standard "does not replace laws or regulations." It gives you a management framework for meeting them ([ISO](https://www.iso.org/insights/iso-42001-explained)).

By AssureCore Compliance Team · Last reviewed

Who it applies to

ISO/IEC 42001 applies to organisations "of any size involved in developing, providing, or using AI-based products or services." It covers all industries, public sector agencies and non-profits (ISO).

ISO lists typical adopters (ISO):

  • technology companies
  • financial institutions
  • healthcare providers
  • manufacturers
  • public authorities

These include organisations that integrate AI into products, use it for decisions or automation, or manage AI systems from third parties.

The scope clause says the standard applies "regardless of size, type and nature" (ISO/IEC preview). Its only normative reference is ISO/IEC 22989 (AI concepts and terminology) (ISO/IEC preview).

Key requirements

Clauses 4–10 (mandatory)

From the table of contents of the published standard (ISO/IEC preview):

  • 4 Context: organisational context, interested parties, AIMS scope.
  • 5 Leadership: commitment, AI policy, roles and authorities.
  • 6 Planning: AI risk assessment (6.1.2), AI risk treatment (6.1.3), AI system impact assessment (6.1.4), AI objectives and planning of changes.
  • 7 Support: resources, competence, awareness, communication, documented information.
  • 8 Operation: operational planning and control, plus carrying out the risk assessment, risk treatment and impact assessment.
  • 9 Performance evaluation: monitoring, internal audit programme, management review.
  • 10 Improvement: continual improvement, nonconformity and corrective action.

Annexes

  • Annex A (normative): reference control objectives and controls.
  • Annex B (normative): implementation guidance for AI controls.
  • Annex C (informative): potential AI-related organisational objectives and risk sources.
  • Annex D (informative): use of the AIMS across domains and sectors (ISO/IEC preview).

What the AIMS must cover in practice

ISO summarises the requirements as follows (ISO):

  • leadership and context
  • AI policy and objectives
  • AI risk management
  • data governance and lifecycle controls
  • transparency and information provision
  • performance monitoring
  • continual improvement

The standard's introduction asks organisations to focus on features unique to AI, such as continuous learning and limited explainability, which "can warrant different safeguards" (ISO/IEC preview).

The wider ISO/IEC AI standards family

ISO describes several companion standards (ISO):

  • ISO/IEC 22989: AI concepts and terminology. It is also 42001's normative reference.
  • ISO/IEC 23053: a framework for describing AI systems that use machine learning.
  • ISO/IEC 23894: guidance on AI risk management.

These standards look at AI technology and risk in detail. ISO/IEC 42001 is the management system standard that ties them together through Plan-Do-Check-Act governance.

Why AI needs its own management system

The introduction to 42001 gives three reasons why AI needs specific management beyond classical IT (ISO/IEC preview):

  • automatic decision-making that can be non-transparent or non-explainable
  • design driven by data and machine learning rather than human-coded logic
  • systems that keep learning and change their behaviour while in use

Your AIMS should show how each of these is addressed for the AI systems in scope.

Certification process and timeline

  1. Define the scope and your AI roles (developer, provider, user).
  2. Run AI risk and impact assessments. ISO/IEC 42005:2025, published May 2025, gives guidance on AI system impact assessments across the lifecycle (ISO).
  3. Implement the controls you select and the documented information required.
  4. Complete an internal audit and a management review (Clause 9) (ISO/IEC preview).
  5. Hold the certification audit with an independent body (ISO). Bodies certifying to 42001 build on ISO/IEC 17021-1, supplemented by ISO/IEC 42006 (ISO). In the UK, accreditation confirms a body's "competence, impartiality and consistent approach" (UKAS).

When you choose a certification body, check that its accreditation scope explicitly lists ISO/IEC 42001.

Costs

ISO lists ISO/IEC 42001:2023 at CHF 225 and ISO/IEC 42006:2025 at CHF 159 (ISO; ISO). Certification audit fees are set by each certification body and are not published by ISO.

Penalties

ISO/IEC 42001 is voluntary and carries no legal penalties. The risks come from the legal obligations it helps you meet. The practical exposure is commercial. Customers or tenders that ask for accredited certification can't be satisfied by self-declared alignment.

Mapping to related frameworks

  • ISO/IEC 27001: both use the harmonized structure (ISO/IEC preview), so policy, risk, audit and review processes can be shared.
  • ISO/IEC 23894 and 38507: AI risk management and AI governance, which complement 42005 and 42001 (ISO).
  • NIST AI RMF: the AI risk process maps closely to its Govern, Map, Measure and Manage functions.
  • EU AI Act: 42001 "supports compliance with legal and regulatory standards" but does not replace them (ISO; ISO).

Readiness checklist

  1. Build an inventory of the AI systems you use, build or provide (ISO).
  2. Assign AI oversight roles and approve an AI policy.
  3. Define the AIMS scope and interested parties.
  4. Complete AI risk assessments and treatment plans.
  5. Carry out AI system impact assessments for individuals and society.
  6. Document data governance and lifecycle controls.
  7. Monitor performance and impacts, and log corrective actions (ISO).
  8. Run an internal audit and a management review before stage 1.

Common pitfalls

  • Treating 42001 as a model-only checklist. It is an organisation-wide management system using Plan-Do-Check-Act (ISO).
  • Leaving third-party AI out of scope. ISO explicitly includes AI provided by third parties (ISO).
  • Skipping the impact assessment. Clause 6.1.4 is separate from the risk assessment (ISO/IEC preview).
  • Assuming certification equals legal compliance (ISO).
  • Choosing a certification body without accreditation for 42001.

How AssureCore helps

  • The Controls Register and Cross-framework Mapping reuse ISO 27001 controls for 42001.
  • The Risk Register records AI risks and treatments.
  • Policy Management drafts AI policies with AI-assisted writing and gap analysis.
  • Evidence Management links evidence to controls and alerts you before it expires.
  • Audit Reports (PDF/CSV) are ready for internal audit and management review.

Frequently asked questions

What is ISO/IEC 42001?

It is the international standard that sets requirements for an AI management system (AIMS). It was published in December 2023.

Who can certify to ISO/IEC 42001?

Independent certification bodies, which may be accredited by national accreditation bodies. ISO itself does not certify organisations.

Is ISO/IEC 42001 mandatory?

No. Certification is voluntary, although it can help you show that you meet legal and customer expectations.

What is ISO/IEC 42006?

Published in July 2025, it adds AI-specific requirements for bodies that audit and certify an AIMS. It supplements ISO/IEC 17021-1.

How does ISO/IEC 42001 relate to ISO 27001?

Both use the harmonized management-system structure, so you can run them as an integrated management system.

Does ISO/IEC 42001 require an AI impact assessment?

Yes. AI system impact assessment is a requirement in Clauses 6.1.4 and 8.4. ISO/IEC 42005 gives guidance on how to do it.

Can a small company use ISO/IEC 42001?

Yes. ISO says it suits organisations of any size, type and nature and the scope covers organisations that only use AI supplied by third parties.

Official references

Supporting evidence and assessment preparation

Evidence examples

Keep approved policies, scope decisions, risk records and operating evidence linked to accountable owners. Record the source, period covered, review and exceptions.

Assessment preparation

Review the applicable requirements and evidence with their owners. Reconcile gaps, findings and action plans, and prepare a clear scope narrative and evidence index.

Common failure points

Avoid treating a framework as a one-time checklist, collecting evidence without context, or leaving decisions and corrective actions undocumented.

Explore workspace guidance or browse other framework guides.

Related frameworks