ISO/IEC 42001

advancedspreading

An international standard describing how an organization (company or public institution) should organize the responsible development and use of artificial intelligence, verifiable by an independent certifier.

In plain terms

ISO/IEC 42001 does not certify an AI system, but the organization that develops or uses it. It specifies what rules, responsible persons, and controls are needed so that artificial intelligence does not operate without oversight in the company.

It is like the hygiene system in a restaurant kitchen. The inspector does not taste the food but checks whether there is order: who is responsible for cooling, is the logbook kept, what happens if something goes wrong. A good system does not guarantee that every dish will be delicious, but the chance of something going wrong is much smaller.

The standard is voluntary, not legislation. Companies adopt it because it brings order to their own operations and because the certificate allows them to show customers and partners that they take risks seriously.

It differs from most AI ethics recommendations in that it is accountable: its requirements are listed in points, and an external auditor can go through them.

How it works

The company first assesses where and how it uses artificial intelligence, and defines the scope of its governance system.
Management adopts an AI policy, sets goals, and names the responsible persons.
The company assesses the risks of each AI system and their impact on people and society. It then goes through the measures listed in the standard's annex (for example, data quality, human oversight, informing users), decides which to apply, and provides a written justification if any are omitted.
Operations are continuously monitored: internal audits are conducted, errors are investigated, management regularly reviews results, and the system is improved.
If the company also wants a certificate, an independent certification body audits it. The certificate usually lasts three years and is reviewed annually in between.

An everyday example

Your workplace might purchase new AI-based customer service software, and the procurement questionnaire includes: 'Does the supplier hold ISO/IEC 42001 certification?' You will also encounter this at the bottom of a provider's website, among other certification badges.

Who is affected

entrepreneur, executiveMore and more clients and tenders ask about it, so having a certificate offers a business advantage, while lacking one may be a disadvantage.

developerBecause of the standard, you must document the origin of data, the tests and the decisions, which means your daily work routine changes. → Code

lawyer, citizenIt is a useful framework for preparing compliance with the EU AI Act, but it does not replace legal obligations. → Law

employeeIf your company adopts AI, policies and training will specify which AI tools you can use for what in your work. → Work & HR

A common misconception

MythIf a company holds an ISO/IEC 42001 certificate, its AI product is secure, accurate, and complies with the EU AI Act.

In realityThe certificate verifies the company's management processes, not the quality of individual products. It does not imply legal compliance; EU regulations must be met separately.

Limits and risks

The certificate is valid only for the specified area, so always check which part of the company and which services it covers.
The standard requires that there be processes and responsible persons, but it does not set specific technical thresholds, such as how accurate a model must be.
Implementation and auditing are time- and cost-intensive, which can be a disproportionate burden for small companies.
There is a risk that it turns into a paperwork exercise: behind polished documentation, actual practice may remain weak.

Similar, but not the same

EU MI-rendelet (AI Act) – The former is a mandatory law with fines; the ISO/IEC 42001 is a voluntary standard that can help with preparation but does not replace it.
ISO/IEC 27001 – One standard regulates the information security management system, while 42001 specifically addresses the risks and impacts of artificial intelligence.
NIST AI Risk Management Framework – The US NIST's free guide cannot be certified, but ISO/IEC 42001 allows for independent audits and certification.

Related concepts

Broader

AI governance, Standardization, Compliance

Narrower

AI impact assessment, AI risk assessment, MI-audit

On the edge

EU MI-rendelet, NIST AI Risk Management Framework, ISO/IEC 27001, Responsible AI, Certification

A brief history

The standard was developed by the joint subcommittee on artificial intelligence of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), and was published in December 2023. This was the first international, certifiable management standard specifically for artificial intelligence.

Where things stand

By the end of 2026, several major cloud and AI providers have obtained the certification, and it is increasingly requested in corporate procurement. It remains rare among smaller companies and does not replace the European standards being prepared for the EU AI Act.

Status: 2026 November

Also known as

ISO 42001 · ISO/IEC 42001:2023 · AI governance system · artificial intelligence governance system · AI management system · AIMS · AI management system standard

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.