ISO 42001: what it is, its requirements and how to certify your AI management system

Normativas ISO
28 Oct 2026, 9:35 p.m. By Juan Carlos Hernandez 💬 0

ISO/IEC 42001:2023 is the international standard for artificial intelligence management systems: it defines how a company governs the AI it develops, provides or uses, with policy, owners, risk and impact assessment, controls and continual improvement. Published in December 2023, it shares the structure of ISO 27001 and ISO 9001 and is certifiable by accredited bodies.

What does ISO 42001 require?

Context (cl. 4): the system scope and the company's role for each AI (provider, user, producer).
Leadership (cl. 5): an AI policy approved by management, roles and responsibilities.
Planning (cl. 6): AI risk assessment and treatment, AI system impact assessment and the statement of applicability.
Support (cl. 7): resources, competence, communication and documented information.
Operation (cl. 8): apply the controls and life-cycle processes.
Evaluation (cl. 9): monitoring, internal audit and management review.
Improvement (cl. 10): nonconformities, corrective action and continual improvement.

What are the Annex A controls?

Annex A has 38 controls grouped under nine objectives. You select the ones that apply based on risk and justify them in the statement of applicability:

A.2 Policies related to AI.
A.3 Internal organization (roles and reporting of concerns).
A.4 Resources for AI systems (data, tooling, compute, people).
A.5 Assessing impacts of AI systems.
A.6 AI system life cycle (requirements, design, verification, deployment, monitoring, logs).
A.7 Data for AI systems (quality, provenance, preparation).
A.8 Information for interested parties.
A.9 Use of AI systems.
A.10 Third-party and customer relationships.

Annexes B, C and D give implementation guidance, potential objectives and risk sources, and use across sectors. It is complemented by ISO/IEC 23894 (AI risk management), ISO/IEC 42005 (impact assessment, 2025) and ISO/IEC 42006 (requirements for certification bodies, 2025).

How does certification work?

Stage 1: the certification body reviews the documentation and readiness.
Stage 2: an implementation audit, with evidence that the system works.
3-year certificate, with annual surveillance audits and recertification at the end of the cycle.
A GAP assessment and an internal audit come first; an accredited body issues the certificate, not the consultant.

How is it different from ISO 27001?

ISO 27001 protects information; ISO 42001 governs AI systems: their impact on people, data quality and provenance, the model life cycle and responsible use. They share clauses, audits, supplier management and incident handling, so if you already have ISO 27001 you reuse much of your system.

Where to start?

Measure your starting point with the ISO 42001 self-assessment (22 requirements, 5 minutes).
Inventory the AI already in use with the shadow AI checklist.
Write the use policy (control A.9.2) with the AI acceptable use policy generator.
Compare frameworks in ISO 42001 vs NIST AI RMF vs EU AI Act.

ISO 42001 frequently asked questions

What is ISO 42001?

It is the international standard ISO/IEC 42001:2023 for artificial intelligence management systems: requirements to govern AI responsibly, certifiable by an accredited body.

How many controls does ISO 42001 have?

38 controls in Annex A, grouped under nine objectives (A.2 to A.10), selected based on risk and justified in the statement of applicability.

Is ISO 42001 mandatory?

No, it is voluntary and certifiable. It helps demonstrate compliance with customer requirements and laws such as the EU AI Act.

How long is the certification valid?

The certificate is valid for 3 years, with annual surveillance audits and recertification at the end.

Can it be implemented together with ISO 27001?

Yes. They share a structure and many processes, and can be audited in an integrated way.

Sources

  1. IEC Webstore. ISO/IEC 42001:2023 Artificial intelligence — Management system. 2023 https://webstore.iec.ch/en/publication/90574
  2. ISO. ISO/IEC 42005:2025 AI system impact assessment. 2025 https://www.iso.org/standard/42005
  3. ISO. ISO/IEC 42006:2025 Requirements for bodies providing audit and certification of AI management systems. 2025 https://www.iso.org/standard/42006
  4. Cloud Security Alliance. What to Expect in the ISO 42001 Certification Process. 2025 https://cloudsecurityalliance.org/blog/2025/07/23/what-to-expect-in-the-iso-42001-certification-process
  5. Baker McKenzie. Colombia: Adoption of ISO/IEC 42001 standard. 2025 https://www.bakermckenzie.com/en/insight/publications/alerts/2025/09/colombia-adoption-of-iso-iec-42001-standard

Want to get ready to certify your AI management system?

GAP assessment, implementation, internal audit and support during the certification body's audit.

See the ISO 42001 service

You may also like

Cumplimiento y regulación

AI and personal data in Colombia: what Law 1581 and SIC Circular 002 require
Cumplimiento y regulación

ISO 42001 vs NIST AI RMF vs EU AI Act: which one does your company need?
Cumplimiento y regulación

Colorado AI law SB 26-189: what changed and what companies must do from 2027

Comments (0)

Be the first to comment.