ISO 42001
ISO 42001 is the international standard for an AI management system (AIMS): the policy, roles, risk and impact decisions, lifecycle controls and records that show you build and use AI responsibly. It is voluntary and certifiable. Customers, investors and regulators’ expectations drive it, and an accredited certification body issues the certificate.
What it is and who it applies to
The formal designation is ISO/IEC 42001:2023, published jointly by ISO and the International Electrotechnical Commission on 18 December 2023. It is the first edition and had no amendment as at October 2026. It uses the same clause layout as ISO 27001 and ISO 9001, so it fits beside an existing management system rather than on top of it.
The standard applies to any organisation that provides, develops or uses AI systems, of any size and in any sector. You decide the scope: one product, the AI systems you sell, or every AI tool in the business. Your role for each system matters from the first clause: ISO 42001:2023 4.1 asks you to work out whether you are a provider, a developer, a user of AI or several of these, because that decides which controls you need.
No law requires ISO 42001. It applies when someone asks for it. Enterprise customers add AI questions to supplier reviews, and a certificate answers many of them at once. Investors and boards want to see AI risk governed. And the EU AI Act asks providers and deployers for risk management, documentation, oversight and monitoring that an AI management system organises.
Four companion standards are worth knowing by name: ISO/IEC 22989 for AI terms and roles, ISO/IEC 23894 for AI risk management guidance, ISO/IEC 42005 for AI system impact assessment guidance, and ISO/IEC 42006 for the bodies that certify you.
This is guidance to help you understand the requirement, not legal advice.
Structure
The requirements sit in clauses 4 to 10. Annex A holds 38 reference controls under nine headings, numbered A.2 to A.10, and the Statement of Applicability records which you apply and why. Annex B is guidance on implementing each control, Annex C lists AI objectives and risk sources to consider, and Annex D covers use across sectors. The table paraphrases each part.
| Part | What it asks for, in plain English | Covered in |
|---|---|---|
| Clause 4 | Understand your context and your role for each AI system, the people with a stake in it, and set the scope | Context, scope and AI policy |
| Clause 5 | Top management leads the system, sets the AI policy and gives people their roles | Context, scope and AI policy |
| Clause 6.1 | Assess AI risk, decide treatment, compare with Annex A, and assess each system’s impact on people and society | AI risk and impact assessment |
| Clauses 6.2 and 6.3 | Set measurable AI objectives and plan changes to the system | Context, scope and AI policy |
| Clause 7 | Resources, competence, awareness, communication and controlled documents | Training and awareness guide |
| Clause 8 | Run the processes, and repeat the risk, treatment and impact work as planned | Operation and the AI system lifecycle |
| Clause 9 | Measure performance, audit the system yourself, and have top management review it | Performance evaluation and improvement |
| Clause 10 | Keep improving, and fix what goes wrong at its cause | Performance evaluation and improvement |
| Annex A, A.2 to A.10 | Policy, roles, resources, impact assessment, lifecycle, data, information for others, responsible use, and third parties | Annex A controls |
| Annexes B to D | Implementation guidance, objectives and risk sources, and sector use | Annex A controls |
What sets ISO 42001 apart from its siblings is the AI system impact assessment (ISO 42001:2023 6.1.4). The risk assessment asks what could go wrong for your organisation; the impact assessment asks what your AI system could do to the individuals, groups and societies it touches. Both feed the choice of controls.
Annex A is a reference list, not a checklist you must finish. You choose controls from your risk treatment, then compare them with Annex A so nothing necessary is missed (ISO 42001:2023 6.1.3). An organisation that only uses AI built by others can exclude most development controls, with a reason.
Certification and enforcement
Certification is voluntary, and nobody enforces ISO 42001 itself; the contract or tender that asks for it does. Certificates come from certification bodies. Since 2025 they work to ISO/IEC 42006, which adds AI-specific requirements, such as auditor competence in AI, to the general rules for certifying management systems. In the UK, look for a certification body accredited by UKAS for ISO/IEC 42001; the first accreditation was announced in November 2025.
Certification follows the usual two stages. Stage 1 checks that the system is designed and documented: scope, AI policy, the risk and impact assessment methods and the Statement of Applicability. Stage 2 checks that it runs: the auditor samples AI systems, follows one from its use case through risk and impact assessment, development or procurement, deployment and monitoring, and interviews the people with named roles. Major nonconformities must be closed before a certificate is issued.
A certificate lasts three years, with surveillance audits in the first and second years and a recertification audit in the third.
How long the first certificate takes depends on how many AI systems are in scope, whether you develop AI or only use it, and whether you already run an ISO 27001 or ISO 9001 system. Certification bodies expect an internal audit (ISO 42001:2023 9.2) and a management review (ISO 42001:2023 9.3) before stage 2, so the system needs time to produce records.
A certificate is not a legal status. It does not show that a particular AI system conforms with the EU AI Act, and the Act’s market surveillance authorities do not rely on it.
How the pieces fit
The clauses form a loop with two assessments at its centre. You set your context and your role for each AI system, then assess AI risk (ISO 42001:2023 6.1.2) and each system’s impact on people (ISO 42001:2023 6.1.4). The Statement of Applicability is the hinge: it turns both into a list of controls with a reason for each. The lifecycle controls then run, the internal audit checks them, management review decides what to change, and corrective action (ISO 42001:2023 10.2) feeds the next round of assessment.
Auditors follow the loop one system at a time. A system missing from the inventory, a high-impact system with no impact assessment, or a control in the Statement of Applicability with no risk or impact behind it is where they look first.
The loop runs per system as well as for the organisation. A new model version, a new customer group or a new use goes back through classification, risk and impact before it goes live. That is also what the EU AI Act asks of a high-risk provider, which is why the two are often run together.
In this section
- ISO 42001 context, scope and AI policy: what is in scope, what role do you play for each AI system, and what must top management do?
- ISO 42001 AI risk assessment, treatment and impact assessment: how do you assess AI risk and impact, and turn them into controls?
- ISO 42001 Annex A controls: what do the 38 controls cover, and how do you justify an exclusion?
- ISO 42001 operation and the AI system lifecycle: how do you control an AI system from use case to retirement?
- ISO 42001 performance evaluation and improvement: how do you measure, audit, review and improve the system?
How Sted maps it
ISO 42001 is one of the standards, regulations and schemes in Sted’s catalogue.
Sted treats it as committed when you hold or pursue it, intend to certify, a customer requires it, or you already run an AI management system. It treats it as strongly indicated when the EU AI Act applies to you or you have recorded an AI system in use, and as recommended when Sted’s benefit assessment says so. It is never treated as a legal requirement. Those rules work from your recorded answers; the AI model does not decide them.
Sted recommends it with its reasons, and you select it or leave it. Administrators and Policy and Process Owners make that choice. Choosing it and pressing Update and generate framework builds the documents it needs.
For ISO 42001 Sted’s knowledge base carries 20 policies, procedures and charters and 40 record templates tagged to its clauses and Annex A controls. They are led by the AI Governance Charter (CHR-AIG), the Artificial Intelligence Governance Policy (POL-AIG), the AI Transparency and Notices Policy (POL-AIT) and the AI System Lifecycle Procedure (PRC-AISL) with its per-system records, and the catalogue holds the 24 clauses and 38 Annex A controls. They are drafted for your organisation for you to review and approve. Your scope, interested parties and obligations sit in management-system registers drafted from your answers.
Sted does not certify you, audit you or choose your certification body. It prepares the documents and records an auditor samples, and shows how much of that work is done.
- Sted keeps a Statement of Applicability for each adopted standard with a control catalogue.
- Only standards with a control catalogue get a Statement of Applicability card.
- You can exclude a control with a coded reason and justification and record its implementation status.
- Each Statement of Applicability card on the Summary lists the standard’s controls by theme as Applicable, Excluded or Not addressed, with any exclusion reason, the implementation status and when each was last verified; below administrator it is marked as a partial view, and its PDF needs a paid plan.
Sted does not certify you. A certification body does; Sted prepares the evidence it will ask for.
Frequently asked questions
Does ISO 42001 apply if we only use AI tools other companies built?
It can. The standard covers organisations that provide, develop or use AI systems, and your role decides which controls you need. A company that only uses bought-in tools usually excludes the development controls with a reason and keeps those on approval, responsible use, suppliers and information for the people affected.
Does ISO 42001 certification mean we comply with the EU AI Act?
No. A certificate shows your AI management system meets ISO/IEC 42001; the Act asks for specific things per system, such as a conformity assessment for a high-risk system, which a certificate does not replace. The two overlap heavily, so running the Act’s work inside an ISO 42001 system saves duplication.
How long does ISO 42001 certification take?
Plan for months rather than weeks. You need the AI policy, the risk and impact assessment process and the Statement of Applicability approved, the controls running long enough to produce records, an internal audit and a management review, and then stage 1 and stage 2 with a certification body. An existing ISO 27001 system shortens this, because the clause structure is the same.
What is the difference between ISO 42001 and ISO 27001?
ISO 27001 protects information; ISO 42001 governs how AI systems are built and used, including their effect on people and society. They share clauses 4 to 10, so one management system can carry both. ISO 42001 adds the AI system impact assessment and its own Annex A of 38 controls.
Is there a UKAS-accredited ISO 42001 certificate?
Yes. UKAS began accrediting certification bodies for ISO/IEC 42001 in November 2025, and certification bodies now work to ISO/IEC 42006:2025, which adds AI-specific requirements for auditing an AI management system. Ask a prospective certification body for its accreditation scope before you book.