ISO/IEC 42001:2023
The first international management-system standard for AI — published December 2023. Structured like ISO 27001, but its Annex A controls address AI-specific risk: data quality, AI impact assessments, and transparency to affected parties.
ISO/IEC 42001 defines an AI Management System (AIMS) using the same high-level management-system structure ISO uses across its portfolio (the same backbone ISO 27001 uses), which makes it genuinely straightforward to run alongside an existing ISO 27001 program rather than as a parallel, disconnected effort. What's different is the Annex A control set, which is built specifically around how organizations develop, provide, or use AI systems responsibly — covering data quality and provenance, AI system impact assessments, resourcing and competence for AI roles, and communication with affected stakeholders.
As with ISO 27001, certification is performed by an accredited third-party certification body against a documented, operating AIMS — not a one-time checklist exercise.
Who is impacted
Organizations that develop AI systems, provide AI-enabled products or services, or are significant users of AI within their own operations — increasingly requested by enterprise buyers and, in some sectors, referenced by regulators as a credible way to demonstrate AI governance maturity ahead of binding AI-specific law.
Requirements
A documented AIMS scope covering the organization's AI systems; a risk assessment methodology specific to AI risk (bias, robustness, transparency, human oversight); an Annex A Statement of Applicability; and operating evidence — data governance practices, AI system impact assessments actually performed, and defined accountability for AI-related decisions.
Key deadlines
ISO/IEC 42001:2023 published
Executive guides & research
ISO 42001: The Complete Executive Guide
The first certifiable AI management system standard, explained — Provider and Deployer obligations, the AI lifecycle, and how it relates to the NIST AI RMF and the EU AI Act.
Glossary
AI Management System (AIMS)
The ISO 42001 term for an organization's continuous, documented system for governing how it develops, provides, or uses AI — the AI-specific analog to ISO 27001's ISMS.
Related regulations
Related
Stay ahead of ISO 42001 changes
Get Regulatory Alerts the moment something about ISO/IEC 42001:2023 changes — new deadlines, guidance updates, enforcement actions.