AI management system
What it means
What is an AI management system?
An AI management system is the plan-do-check-act cycle a company runs to govern its AI. It sets policy, does the work, checks results, then adjusts and repeats. ISO/IEC 42001 is the standard that certifies a company actually runs the cycle, not just writes it down.
That cycle is what the standard specifies in full, covering policy, risk treatment, resourcing and internal audit for the whole organisation rather than one product. Building to this shape does not require certifying against it. A management system is a way of working; certification is a separate, optional proof of it.
The EU AI Act does not require this broader system. Article 17 requires a narrower relative of it instead. Every provider of a high-risk AI system must run a documented quality management system. That system has to cover the risk-management process, post-market monitoring and serious-incident procedures, among other elements. Its depth scales to the size of the provider's organisation.
That overlap is why the two get treated as one project, not two. Building the policy, the register and the review cycle once tends to satisfy the voluntary standard. For a provider of high-risk systems, it also tends to satisfy the legal minimum Article 17 sets.
Published · Updated
In practice
Why it comes up
A procurement questionnaire increasingly asks for an AI management system by name, not a risk assessment for one product. This happens because a buyer wants proof that governance survives a change of staff.
A board hears the phrase once a competitor announces ISO/IEC 42001 certification and asks whether the company should follow. The honest answer is usually that the certificate matters less than the structure behind it, since an unread policy is worth little more than none.
What to do about it
Write the policy in one page an engineer would actually follow, not a document written for an auditor. Name an owner for the system as a whole, not just for individual products.
Set a fixed date to review the register rather than waiting for a customer to ask. I score exactly this structure against ISO/IEC 42001 in the two-week AI readiness and risk assessment. So the gap list is evidence rather than a guess.