Contents
What ISO/IEC 42001 is
Published at the end of 2023, the standard sets out the requirements for an AI management system. It follows the same structure as other ISO management system standards, such as ISO/IEC 27001 for information security. An organisation already certified to ISO 27001 can therefore integrate the two systems.
The standard does not tell you what AI to build. It requires an organised way of deciding on, documenting, controlling and improving the use of AI.
The key requirements
- Context and scope: which AI systems, which roles (producer, provider, user), which interested parties.
- The AI policy, approved by top management, with defined roles and responsibilities.
- The AI risk assessment, designed to produce consistent and comparable results from one assessment to the next.
- The AI system impact assessment covering individuals, groups and society, taking into account the technical, social and legal context of the deployment.
- The statement of applicability, which lists the controls selected and justifies those excluded.
- The risk treatment plan, approved by management together with acceptance of the residual risks.
- Internal audit, management review and continual improvement.
The nine domains of Annex A
| Domain | What it covers |
|---|---|
| A.2 Policies related to AI | AI policy, alignment with other policies, periodic review |
| A.3 Internal organisation | Roles and responsibilities, reporting of concerns |
| A.4 Resources for AI systems | Documentation of data, tools, computing resources and skills |
| A.5 Assessing impacts | Impact assessment process and documentation of the results |
| A.6 AI system life cycle | Requirements, design, verification and validation, deployment, operation, event logging |
| A.7 Data for AI systems | Data acquisition, quality, provenance and preparation |
| A.8 Information for interested parties | User documentation, external reporting, incident communication |
| A.9 Use of AI systems | Responsible use in line with the intended use, human oversight |
| A.10 Third-party and customer relationships | Allocation of responsibilities, suppliers, customer expectations |
These domains group together 38 reference controls. Not all of them are mandatory: the organisation selects those its risk assessment shows to be necessary, and may add others.
The seven steps to certification
- Define the scope: which systems, which entities, which sites.
- Carry out a gap assessment of current practice against the requirements of the standard.
- Write the AI policy and appoint the people responsible.
- Conduct the risk and impact assessments for each system in scope.
- Select and implement the controls, then write the statement of applicability.
- Run the system: internal audit, management review, corrective action.
- Undergo the certification audit with an accredited body.
Certification is then maintained through surveillance audits, generally on a three-year cycle. Before choosing a certification body, check that it is accredited for ISO/IEC 42001.
ISO 42001 and the AI Act
ISO/IEC 42001 does not, on its own, create a presumption of conformity with the AI Act: the harmonised European standards are still being drafted, which is also what justified postponing the high-risk obligations to 2 December 2027. It does, however, structure most of the work the regulation demands: risk management, documentation, data quality, human oversight, monitoring. For a Moroccan business exposed to the European market, it is the most solid foundation for getting ready. See The EU AI Act and Moroccan BPOs: What You Need to Know.
Complementary standards
- ISO/IEC 22989: AI vocabulary and concepts, including the generic life cycle model.
- ISO/IEC 23894: guidance on AI risk management, referred to by ISO/IEC 42001.
Further reading
- 4 min read
- 5 min read
- 4 min read
- 8 min read
- 7 min read
Frequently asked questions
How long does it take to get ISO 42001 certified?
It depends on the scope and your starting maturity. At a minimum, you need time to put the system in place and run it (internal audit and management review) before the certification audit. An organisation already certified to ISO 27001 generally moves faster.
Does ISO 42001 apply to companies that use AI without developing it?
Yes. The standard is aimed at any organisation that develops, provides or uses AI systems, including a company deploying a tool bought from a vendor.
Does ISO 42001 certification guarantee compliance with the AI Act?
No. On its own it does not confer a presumption of conformity, but it covers much of the organisational work the AI Act requires and is a solid way to prepare.
General information, not legal advice.
Report an errorReferences (5)
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system. (opens in a new tab)
- ISO/IEC 23894:2023 — Artificial intelligence — Guidance on risk management. (opens in a new tab)
- ISO/IEC 22989:2022 — Artificial intelligence concepts and terminology. (opens in a new tab)
- Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act). (opens in a new tab)
- Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 ("Digital Omnibus on AI"), Official Journal of the EU of 24 July 2026, in force since 27 July 2026. (opens in a new tab)