AI Management
The first international standard for responsible AI governance.
About ISO 42001:2023
ISO 42001:2023 is the first international standard specifying requirements for an Artificial Intelligence Management System (AIMS). It provides a framework for organisations that develop, deploy, or use AI systems to manage AI-related risks, demonstrate accountability, and embed responsible AI governance into their operations.
The standard is directly relevant to EU AI Act compliance obligations and is increasingly requested by enterprise buyers, financial-sector clients, and regulated-industry customers as AI becomes embedded in commercial products and services.
Typical demand drivers.
- Enterprise customers purchasing AI-enabled software or services
- Financial services, insurance, and regulated-sector clients
- Public sector and government buyers subject to AI procurement policy
- Investors requiring AI governance as part of ESG or due diligence
- Organisations subject to or preparing for EU AI Act obligations
- Healthcare and legal sector clients using AI in professional services
Standard structure.
4.1Understanding the organisation and its AI context6.1.2AI risk assessment6.1.4AI system impact assessment8.4AI system lifecycle8.5AI system risk managementA.2.2AI policyA.6.1Human oversight of AI systemsA.9.3Supplier relationships for AI
Responsibilities, clearly drawn.
What we do
- Gap analysis against ISO 42001:2023 clause requirements
- AI system inventory and classification (risk tier, use case, data inputs)
- AI policy, objectives, and governance framework
- AI risk assessment methodology adapted from ISO 27001 risk approach
- Human oversight and accountability framework
- AI impact assessment process for new and existing AI systems
- Supplier and third-party AI system assessment
- Documentation of AI system design, training data provenance, and testing
- Internal audit and management review
- AI governance awareness training curriculum, and delivery on request
- Alignment mapping to EU AI Act obligations and ISO 27001 Annex A
What you do
- Inventory all AI systems in use: vendor, purpose, data inputs, and decision outputs
- Assign an AI governance lead with authority to approve and restrict AI use
- Participate in AI risk workshops for each in-scope system
- Review and approve AI impact assessments
- Ensure relevant staff complete AI awareness training (we provide the curriculum)
- Implement human oversight checkpoints for high-risk AI decisions
From gap analysis to certificate.
- 01
Gap analysis
AI system inventory, clause mapping, and risk landscape overview. We assess current AI governance maturity and produce a prioritised gap register.
- 02
AIMS build
AI policy, governance framework, risk assessment methodology, and documented information. We cross-map with your ISO 27001 ISMS where one exists, avoiding duplicated documentation.
- 03
Impact assessments
We conduct AI impact assessments for each in-scope AI system, documenting risk tier, human oversight requirements, and acceptable use constraints.
- 04
Internal audit
Internal audit against ISO 42001:2023. Nonconformities raised and closed before Stage 1.
- 05
Stage 1 audit
Documentation review with the certification body. We attend and manage any pre-Stage 2 remediation.
- 06
Stage 2 audit
Live AIMS audit. We attend and manage corrective actions until the certificate is issued.
Frequently asked.
- We use AI tools like ChatGPT internally. Does ISO 42001 apply to us?
- ISO 42001 is relevant to any organisation that develops or deploys AI systems — which includes using third-party AI in ways that affect customers, decisions, or regulated outputs. Using ChatGPT for internal drafting is low-risk; using AI to generate legal documents or make credit decisions for customers is in-scope. We help you classify each use case correctly.
- How does ISO 42001 relate to the EU AI Act?
- ISO 42001 certification is not a legal requirement under the EU AI Act, but it provides strong evidence of conformity with the Act's governance obligations — particularly for high-risk AI system providers. Certification to ISO 42001 is likely to be recognised as a means of demonstrating compliance with Chapter III (high-risk AI) obligations as harmonised standards are published.
- We already have ISO 27001. How much additional work is ISO 42001?
- Considerably less than starting from scratch. The standards share the same high-level structure (Annex SL), so the management system framework, internal audit programme, management review process, and documented information controls are already in place. We cross-map the gap and build only what's new — typically the AI risk methodology, system inventory, and impact assessment process.
- What counts as an AI system under the standard?
- ISO 42001 uses a broad definition aligned with the ISO 22989 AI concepts standard: any machine-based system that, given objectives, makes predictions, recommendations, or decisions. This includes ML models, large language models, rules-based decision engines, and automated scoring systems — but not simple rule-based automation or deterministic software.
- Is there a risk that the standard becomes obsolete as AI moves quickly?
- Standards are reviewed and revised. ISO 42001:2023 is a first edition and will be updated as AI governance practice matures. Certification gives you a documented, auditable starting point — which is more defensible than no governance framework at all, whatever the standard's revision cycle.
Accredited certification bodies are beginning to offer ISO 42001 certification. We work with you and a selected certification body to ensure the certification pathway is appropriate to your AI use cases.
Ready to start on ISO 42001?
A gap analysis gives you a clear picture of where you are and what the certification project will involve.