ISO/IEC 42001
What it means
What is ISO/IEC 42001?
ISO/IEC 42001 is an international standard that sets out what an AI management system must do. An AI management system is the set of policies an organisation follows to govern its own AI, checked on a cycle rather than written once. ISO and IEC published the standard in December 2023.
ISO/IEC's joint technical committee for artificial intelligence wrote it. It specifies requirements for an AI management system: the recurring policies, roles and processes that govern how an organisation develops, provides or uses AI. It uses the same Plan-Do-Check-Act structure as other ISO management-system standards, such as ISO/IEC 27001 for information security.
Unlike the NIST AI RMF, a free framework, ISO/IEC 42001 is a standard that an accredited third party can audit and certify a company against. Enterprise customers and procurement teams ask for it, or ask how your company compares with it. They ask because certification gives them a documented, externally checked answer instead of a vendor's own claim.
Working towards the standard means three things: writing down a risk-assessment method, running an inventory of AI systems, and reviewing that inventory on a schedule. None of that requires certification itself.
Published · Updated
In practice
Why it comes up
A procurement team building a vendor shortlist asks for it by name. A board that already understands ISO 27001 reaches for the same mental model, and asks whether an AI equivalent exists. Because it is a certifiable standard, not a public framework, it carries more weight in a formal audit than a self-written policy. That is why a customer’s legal team may put it on a checklist before reading what is in it.
What to do about it
Full certification is a real project with an external auditor, and most companies at seed to growth stage do not need it yet. What is worth doing now is running the standard’s own structure without the audit.
The structure is a documented risk-assessment method, an AI system inventory, and a review of that inventory on a fixed schedule. That gives you “built to the same structure, without the certificate,” a stronger position than silence or an unsupported claim.
Gap assessment
A gap assessment compares what your company does today with what ISO/IEC 42001 asks for, and lists the difference. Take the requirements one by one, mark each as in place, partly in place or missing, and note the evidence you can show for it.
Rank the missing ones by what a customer or auditor would ask about first. The result is a work list, not a certificate and not a pass or fail grade. The AI Readiness & Risk Assessment includes a gap list against this standard.