ISO/IEC 42001
AI Management System
Published in December 2023, ISO/IEC 42001 is the first international standard for AI management systems. It is certifiable, following the same model as ISO 27001 for information security. Here is what it requires and how to implement it.
The first certifiable AI standard
ISO/IEC 42001:2023
ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining, and continually improving an AI Management System (AIMS) within an organization. It is designed for any organization involved in developing, providing, or using AI-based products or services.
The standard uses the ISO Annex SL high-level structure, which means it shares the same management system architecture as ISO 27001, ISO 9001, and other well-established standards. Organizations with existing ISO certifications will find significant overlap in processes, documentation, and audit procedures.
Certification is conducted by accredited third-party audit bodies, following the same audit process used for other ISO management system standards.
Plan-Do-Check-Act cycle with ISO clause mapping
What ISO 42001 requires
The standard defines six core requirement areas for an AI management system.
AI Management System (AIMS)
Establish an AI management system with a clearly defined scope covering AI activities across the organization. This includes policies, objectives, processes, and the resources needed to manage AI responsibly.
AI Impact Assessments
Conduct impact assessments for AI systems, evaluating potential effects on individuals, groups, and society. Assessments must consider both intended use and reasonably foreseeable misuse.
Lifecycle Controls
Implement controls across the full AI lifecycle: design, development, deployment, operation, and retirement. Each phase requires documented processes and defined responsibilities.
Third-Party AI Oversight
Establish supply chain controls for AI systems and components obtained from third parties. Evaluate vendor AI practices, maintain oversight of outsourced AI activities, and ensure third-party systems meet your management system requirements.
Documentation & Internal Audit
Maintain documented information for the AIMS, including policies, procedures, risk assessments, and audit records. Conduct internal audits at planned intervals to verify the management system is effectively implemented and maintained.
Continuous Improvement
Establish processes for ongoing improvement of the AIMS. This includes management reviews, corrective actions for nonconformities, and systematic tracking of improvement actions and their outcomes.
Journey to ISO 42001 certification
A structured path from gap analysis to certification.
Gap Analysis
Assess current state against ISO 42001 requirements. Identify what exists, what needs to be built, and what can be adapted from existing ISO certifications.
Build the AIMS
Implement policies, processes, controls, and documentation. Establish the AI inventory, risk assessments, impact assessments, and governance structures.
Internal Audit
Run internal audits to verify the management system works as designed. Address nonconformities and document corrective actions.
Certification Audit
Engage an accredited certification body for Stage 1 (documentation review) and Stage 2 (operational audit). Achieve certification.
Complementary standards
ISO 42001 shares the Annex SL structure with other major ISO standards, reducing implementation overhead for organizations with existing certifications.
ISO 27001
Information security controls, access management, data protection
ISO 42001
AI risk management, impact assessments, lifecycle controls
ISO 9001
Quality management, process control, customer focus
Who needs ISO 42001?
Organizations building AI
Companies developing AI models, algorithms, or AI-powered products. ISO 42001 provides the management system structure for responsible AI development.
Organizations providing AI services
SaaS companies, consultancies, and service providers that deliver AI capabilities to clients. Certification demonstrates responsible practices to customers.
Organizations deploying AI
Enterprises using third-party AI tools and services. If you are adopting AI across your business, ISO 42001 provides the governance structure to manage that adoption.
Procurement requirements
ISO 42001 certification is increasingly appearing in enterprise procurement questionnaires and vendor assessment criteria, similar to the path ISO 27001 followed for information security.
Build your AIMS with the right tooling
Each ISO 42001 requirement maps to specific Clarier capabilities.
AI Inventory
Build and maintain a complete inventory of AI systems across your organization. A defined scope requires knowing every AI system in use, its purpose, and its deployment context.
Vendor Research Reports
Automated vendor assessments covering data handling, model transparency, security posture, and compliance alignment. Directly supports Clause 6 supply chain requirements.
Approval Workflows
Structured workflows for AI tool evaluation, approval, and decommissioning. Enforce controls at every lifecycle stage with documented decisions and role-based approvals.
Audit Trail
Immutable record of every decision, risk assessment, approval, and change across your AI program. Purpose-built for internal audit evidence and management reviews.
Maturity Assessment
Track AI program maturity across structured dimensions. Identify gaps, measure progress over time, and demonstrate improvement at management reviews.
Shadow AI Discovery
Your AIMS scope is only valid if it accounts for all AI systems in use. Shadow AI discovery identifies tools adopted outside formal processes, ensuring your scope reflects reality.
Common questions
Sources & further reading
Primary sources and official references cited on this page.
Build your AI management system on solid ground.
See how Clarier provides the inventory, workflows, and documentation you need for ISO 42001 certification.