The short answer
ISO 42001 (ISO/IEC 42001:2023) is the international standard for an AI management system (AIMS). Published in December 2023, it sets requirements in clauses 4 to 10 and 38 reference controls in Annex A for developing, providing or using AI responsibly. It is voluntary, and organisations can be certified against it by an independent certification body.
On this page
- What is ISO 42001?
- Who needs ISO 42001?
- What does ISO 42001 require?
- What are the ISO 42001 Annex A controls?
- How does ISO 42001 relate to ISO 27001?
- How do you prepare for ISO 42001?
- ISO 42001 checklist
- How does ISO 42001 certification work?
- How much does ISO 42001 certification cost?
- Is ISO 42001 mandatory under the EU AI Act?
- Where does AI red teaming fit in ISO 42001?
- Why Sovereign Secure
- Next step
ISO 42001 (ISO/IEC 42001:2023) is the international standard for an AI management system (AIMS): the policies, roles, risk and impact assessments and controls an organisation uses to develop, provide or use AI responsibly. Published in December 2023, it follows the same clause 4 to 10 structure as ISO 27001 and adds 38 reference controls in Annex A. It is voluntary, it applies to organisations of any size that build or use AI, and ISO 42001 certification is carried out by independent certification bodies.
What is ISO 42001?
ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. It was developed by ISO/IEC JTC 1/SC 42, the joint ISO and IEC committee on artificial intelligence (ISO/IEC 42001 on iso.org).
It is a management system standard, not a technical test of a model. It does not tell you what accuracy or fairness threshold a model must hit. It requires you to have the processes that decide what is acceptable for each AI system, check it, and act on the results. Three related standards from the same committee are useful alongside it:
- ISO/IEC 22989: AI concepts and terminology, including the roles organisations play.
- ISO/IEC 23894: guidance on AI risk management.
- ISO/IEC 42006:2025: requirements for bodies that audit and certify AI management systems.
Who needs ISO 42001?
No one is legally required to hold ISO 42001. Organisations pursue it for three main reasons:
- To sell AI. AI vendors and SaaS providers with AI features face questions about model training data, human oversight and misuse in customer security and procurement questionnaires. A certificate answers many of them at once.
- To use AI in decisions about people. Organisations using AI in recruitment, lending, insurance or customer service want a structured way to show that impacts are assessed and controlled.
- To buy AI safely. Procurement teams use the standard as a reference for supplier due diligence, asking whether a supplier’s AI is run under a management system and whether that system is certified.
The standard asks you to determine your role for each AI system, using the roles defined in ISO/IEC 22989:
| Role | Example | What ISO 42001 focuses on |
|---|---|---|
| AI provider | A SaaS company offering an AI feature to customers | Information for users, intended use, monitoring in service |
| AI producer | A team designing, training or fine-tuning a model | Life cycle controls, data quality, verification and validation |
| AI customer | A business using a third-party AI tool | Responsible use, supplier controls, staff guidance |
| AI partner | A data provider or system integrator | Allocation of responsibilities, data provenance |
Many organisations hold more than one role. A company that builds a chatbot on a third-party model is an AI customer of the model supplier and an AI provider to its own clients.
What does ISO 42001 require?
The mandatory requirements are in clauses 4 to 10, the same high-level structure used by ISO 27001, ISO 9001 and ISO 27701:
| Clause | What it requires for AI |
|---|---|
| 4 Context | Your roles, the AI systems in scope, interested parties and the AIMS scope |
| 5 Leadership | Top management commitment, an AI policy and assigned roles and responsibilities |
| 6 Planning | AI risk assessment (6.1.2), AI risk treatment with a Statement of Applicability (6.1.3), AI system impact assessment (6.1.4) and AI objectives |
| 7 Support | Resources, competence, awareness, communication and documented information |
| 8 Operation | Running the risk assessment, risk treatment and impact assessment at planned intervals and when significant changes occur |
| 9 Performance evaluation | Monitoring and measurement, internal audit and management review |
| 10 Improvement | Continual improvement, nonconformity and corrective action |
How is an AI system impact assessment different from a risk assessment?
The AI risk assessment identifies the risks that help or hinder your AI objectives and rates their likelihood and consequences. The AI system impact assessment is a separate, outward-looking exercise: it considers the potential consequences of a specific AI system’s deployment, intended use and foreseeable misuse for individuals, groups of individuals and societies. Where the system processes personal data, coordinate it with your data protection impact assessment (DPIA) under UK GDPR so the two share evidence. They are not interchangeable: a DPIA is limited to the processing of personal data, while the AI system impact assessment also covers wider effects on groups and society, and AI systems that use no personal data at all.
What are the ISO 42001 Annex A controls?
Annex A lists 38 reference controls grouped under nine control objectives, numbered A.2 to A.10:
| Objective | Controls | What it covers |
|---|---|---|
| A.2 Policies related to AI | 3 | AI policy, alignment with other policies, review |
| A.3 Internal organisation | 2 | Roles and responsibilities, reporting of concerns |
| A.4 Resources for AI systems | 5 | Documenting data, tooling, computing and human resources |
| A.5 Assessing impacts of AI systems | 4 | Impact assessment process and records, impacts on individuals, groups and society |
| A.6 AI system life cycle | 9 | Responsible development objectives, requirements, design, verification and validation, deployment, operation and monitoring, technical documentation, event logs |
| A.7 Data for AI systems | 5 | Data for development, acquisition, quality, provenance and preparation |
| A.8 Information for interested parties | 4 | User documentation, external reporting, incident communication, information for interested parties |
| A.9 Use of AI systems | 3 | Processes and objectives for responsible use, intended use |
| A.10 Third-party and customer relationships | 3 | Allocating responsibilities, suppliers, customers |
As with ISO 27001, you select controls through risk treatment and record each decision in a Statement of Applicability, with a justification for anything excluded. Annex B gives implementation guidance for each control, Annex C lists potential AI-related objectives, such as fairness, privacy, robustness, safety, security and transparency, along with common risk sources, and Annex D covers use of the AIMS across sectors.
How does ISO 42001 relate to ISO 27001?
They are built to work together. AI systems are information systems, so ISO 27001 controls such as access control, secure development, supplier security and logging still protect them. ISO 42001 adds what ISO 27001 does not address: effects on people, data quality and provenance, the model life cycle, transparency and responsible use.
| Aspect | ISO/IEC 27001:2022 | ISO/IEC 42001:2023 |
|---|---|---|
| Focus | Information security | Responsible development, provision and use of AI |
| Risk work | Information security risk assessment | AI risk assessment plus AI system impact assessment |
| Annex A | 93 controls in four themes | 38 controls under nine objectives |
| Statement of Applicability | Required | Required |
| Shared machinery | Internal audit, management review, document control, competence, corrective action | The same, so one integrated system is common |
If you already run an ISO 27001 ISMS, you can extend its scope, risk method and audit programme rather than start again, and keep a second Statement of Applicability in the same format as your ISO 27001 Statement of Applicability.
How do you prepare for ISO 42001?
- Build an AI inventory. List every AI system you develop, provide or use, including AI features inside products you buy, and record your role for each.
- Set the scope. Decide which systems, products and teams the AIMS covers.
- Write the AI policy and assign owners for each system and for the AIMS.
- Choose a risk method. ISO/IEC 23894 or the NIST AI Risk Management Framework can structure the AI risk work.
- Define the impact assessment process, linked to your DPIA process.
- Complete the Statement of Applicability against Annex A and close the gaps, typically in data provenance, life cycle records, supplier terms and user information.
- Verify and validate each system before release and after significant change, including adversarial security testing.
- Run the system long enough to produce records, then hold an internal audit and a management review.
- Book the certification audit with an independent certification body.
How long does ISO 42001 take?
There is no standard timeline, and any fixed figure would be a guess without knowing your scope. These factors make the biggest difference:
| Factor | Shorter route | Longer route |
|---|---|---|
| Existing management system | Running ISO 27001 ISMS | No ISO system in place |
| AI systems in scope | One product or use case | Many systems across teams |
| Your role | Using a few third-party AI tools | Training or fine-tuning your own models |
| Development records | Versioned data, tests and approvals | Undocumented experiments |
ISO 42001 checklist
Use this ISO 42001 checklist as a first readiness check. Tick each line only when the evidence exists; anything missing becomes an action in your plan.
| Ref | Check | Evidence to have ready |
|---|---|---|
| 4.1, 4.3 | Your role for each AI system (developer, provider, user) recorded and the AIMS scope set | AI inventory, scope statement |
| 5.2 | AI policy approved by top management and communicated | Signed AI policy |
| 5.3 | Owners named for the AIMS and for each AI system | Roles and responsibilities |
| 6.1.2 | AI risk assessment method set, with acceptance criteria | Risk method, AI risk register |
| 6.1.3 | Risk treatment chosen and a Statement of Applicability covering all 38 Annex A controls | Treatment plan, SoA with justifications |
| 6.1.4 | AI system impact assessment carried out for each system in scope, linked to your DPIA process | Impact assessment records |
| 6.2 | Measurable AI objectives with owners and dates | Objectives register |
| A.6, A.7 | Life cycle and data records: requirements, design, data provenance and quality, verification and validation | Technical documentation, test results, data records |
| A.8 | Information for users and other interested parties, and a way to report incidents | User documentation, incident communication process |
| A.10 | Responsibilities agreed with AI suppliers and customers | Contract terms, supplier assessments |
| 9.2, 9.3 | Internal audit and management review completed | Audit report, review minutes |
| 10.2 | Nonconformities corrected and causes removed | Corrective action log |
If you already run an ISO 27001 ISMS, many lines, such as document control, internal audit and management review, can reuse what you have.
How does ISO 42001 certification work?
Certification follows the usual pattern for management systems: a Stage 1 audit of documentation and readiness, a Stage 2 audit of the system in operation, a certificate valid for three years, and surveillance audits in the intervening years. Certification bodies work to ISO/IEC 17021-1, and for AI management systems also to ISO/IEC 42006:2025, published in July 2025, which adds AI-specific requirements such as the competence of auditors. Before you book, ask a certification body whether its scope covers ISO/IEC 42001 and how it applies ISO/IEC 42006. Impartiality rules also mean the body that certifies you cannot have helped build your AIMS.
How much does ISO 42001 certification cost?
There is no fixed price. The cost has two parts: the certification body’s audit fees over the three-year cycle, and the internal time, tools, testing and any outside help needed to build the AIMS. These drivers move both:
| Cost driver | Why it changes the cost |
|---|---|
| AI systems in scope | Each system needs its own risk and impact assessment, records and evidence |
| Your role | Training or fine-tuning your own models brings more Annex A controls into play than using third-party AI tools |
| People and sites in scope | Certification bodies set audit time largely from the size of the scope |
| Existing ISO 27001 system | Shared document control, internal audit and management review reduce the work, and an integrated audit may reduce audit time if the certification body agrees |
| Development and data records | Versioned data, tests and approvals already in place mean less to build |
| Security testing | Adversarial testing of AI systems as verification and validation evidence |
Budget for the full cycle: Stage 1 and Stage 2, surveillance audits in years two and three, then recertification. Ask each certification body for a quote based on your scope.
Is ISO 42001 mandatory under the EU AI Act?
No. ISO/IEC 42001 is voluntary, and ISO 42001 compliance is not the same as compliance with the Act. The EU AI Act sets legal duties according to your role and the risk category of each AI system, and a 42001 certificate does not by itself show that a system meets them. An AIMS can, however, organise much of the work behind the Act, such as the risk management system (Article 9) and quality management system (Article 17) required of providers of high-risk AI systems. Our AI governance guide explains who the Act applies to and when its obligations take effect.
Where does AI red teaming fit in ISO 42001?
Annex A expects defined verification and validation measures for each AI system (A.6.2.4) and operation and monitoring once it is live (A.6.2.6), and auditors will look for evidence that your risk treatment works. For security risks, that evidence comes from adversarial testing. Our AI and LLM penetration testing covers prompt injection, sensitive data disclosure, jailbreaks, output handling and the web and API layer around the model, and our agentic AI security testing covers AI agents that take actions through tools. Findings come with risk ratings you can carry straight into your AI risk register and Statement of Applicability decisions.
Why Sovereign Secure
Sovereign Secure Ltd was founded in 2012 and is headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. Our part in an ISO 42001 programme is the security evidence and the information security foundation:
- AI and LLM penetration testing, including AI agents and the applications, APIs and cloud services around them.
- ISO 27001 certified, with ISO 27001 consultancy for the ISMS that many AI management systems integrate with.
- PCI SSC Qualified Security Assessor (QSA) company and IASME-licensed Cyber Essentials certification body.
We do not issue ISO certificates. For the management system standards we support, see ISO certification.
Next step
If you are preparing an AI system or agent for release, or need evidence for your AI risk register, request a penetration testing quote for an AI red team test.
Free tools and services
Last reviewed October 2026 by the Sovereign Secure assessment team.
