# What is ISO/IEC 42001?

> ISO/IEC 42001 is the first international, certifiable standard for the management system a company runs to govern its AI.

Source: https://meshin.co/glossary/iso-iec-42001
Updated: 2026-10-02

---

## Why it comes up

A procurement team building a vendor shortlist asks for it by name. A board that already understands ISO 27001 reaches for the same mental model, and asks whether an AI equivalent exists. Because it is a certifiable standard, not a public framework, it carries more weight in a formal audit than a self-written policy. That is why a customer's legal team may put it on a checklist before reading what is in it.

## What to do about it

Full certification is a real project with an external auditor, and most companies at seed to growth stage do not need it yet. What is worth doing now is running the standard's own structure without the audit.

The structure is a documented risk-assessment method, an AI system inventory, and a review of that inventory on a fixed schedule. That gives you "built to the same structure, without the certificate," a stronger position than silence or an unsupported claim.

## Gap assessment

A gap assessment compares what your company does today with what ISO/IEC 42001 asks for, and lists the difference. Take the requirements one by one, mark each as in place, partly in place or missing, and note the evidence you can show for it.

Rank the missing ones by what a customer or auditor would ask about first. The result is a work list, not a certificate and not a pass or fail grade. The [AI Readiness & Risk Assessment](/services/ai-readiness-and-risk-assessment) includes a gap list against this standard.