← All laws
ISO/IEC 42001VoluntaryInternational standard

ISO/IEC 42001:2023 — Artificial intelligence management system

Last reviewed Sep 25, 2026.

In short

ISO/IEC 42001 is the first certifiable international standard for an AI management system (AIMS). Like ISO 27001 for security, it asks an organisation to set AI policy and objectives, assess AI risks and impacts, assign roles, control the AI lifecycle and suppliers, and improve continually, with an Annex A of controls. Certification involves a two-stage audit and annual surveillance. It does not make you legally compliant by itself, but it maps well onto EU AI Act quality-management and documentation duties and is increasingly requested in procurement.

Who it applies to

  • Organisations that build or use AI systems in International standard.
  • Any use case — it is not limited to specific applications.
  • Size: everyone, including solo operators.
  • Voluntary, certifiable standard. Useful when customers or tenders ask for evidence of AI governance, and as a scaffold for EU AI Act quality-management duties.

Key dates

  1. Dec 18, 2023✓First edition published (December 2023)

What you have to do

  • Define an AI policy, scope and objectives approved by leadership.
  • Run AI risk assessments and AI system impact assessments for each system in scope.
  • Implement Annex A controls: data management, transparency, human oversight, incident handling, supplier management.
  • Keep documented information and records for the AI lifecycle.
  • Audit internally and review with management on a cycle.

Penalties

None; voluntary standard. Certification can be suspended or withdrawn by the certification body.

Related lessons

Industries where it matters

Sources

Last reviewed Sep 25, 2026.

Educational information, not legal advice. Laws change and details depend on your situation — check the linked sources and talk to a qualified lawyer before acting. Last content review: 2026-09-25.

Spotted an error? Ask the tutor or email hello@myaiguide.pro.