ISO/IEC 42001: a plain-language guide
Short answer: ISO/IEC 42001:2023 is the first international standard for an AI management system (AIMS). It helps any organisation that builds, provides or uses AI to manage the risks of that AI, such as bias, lack of transparency, security and misuse, in a structured way. Like ISO 27001, you can be audited and certified against it.
What is ISO/IEC 42001?
ISO/IEC 42001 was published in December 2023. It follows the same structure as other ISO management system standards, so clauses 4 to 10 cover scope, leadership, planning, support, operation, performance evaluation and improvement. What is new is the focus: instead of information security in general, it is about the responsible development and use of AI systems.
Who needs ISO 42001?
It is voluntary, but it is quickly becoming the way to show customers and regulators that your AI is under control. It is most useful for:
- Companies that build AI products or add AI features, such as chatbots, copilots, scoring or recommendation engines.
- Companies that use third-party AI models on customer data.
- Businesses selling to enterprises that now ask about AI governance in security questionnaires.
- Organisations preparing for AI rules such as the EU AI Act.
What does ISO 42001 require?
- An AI policy approved by leadership, with clear roles and responsibilities.
- An AI risk assessment covering how your AI systems could cause harm and what you will do about it.
- An AI system impact assessment looking at the effect on individuals, groups and society.
- Controls across the AI life cycle, from design and data to testing, deployment, monitoring and retirement.
- Supplier management for the models, data and tools you get from others.
- Monitoring, internal audit and management review, just as in ISO 27001.
What are the ISO 42001 Annex A controls?
Annex A contains 38 controls grouped under topics such as AI policies, internal organisation, resources for AI systems, impact assessment, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems and third-party relationships. As with ISO 27001, you choose the controls that apply and record your choices in a Statement of Applicability.
How does ISO 42001 relate to ISO 27001 and NIST AI RMF?
If you already have ISO 27001, much of the management system (document control, internal audit, management review) can be shared, and you add the AI-specific parts. The NIST AI Risk Management Framework covers similar ground but is a voluntary guide rather than a certifiable standard. Many organisations use NIST AI RMF to shape their risk work and ISO 42001 to get certified.
How do you start with ISO 42001?
- List every AI system you build or use, including third-party tools staff use at work.
- Decide the scope of your AI management system.
- Write an AI policy and assign owners.
- Run an AI risk assessment and impact assessment for each system in scope.
- Choose Annex A controls and close the gaps.
- Monitor, audit internally and review with leadership.
- Book a certification audit with an accredited body.
How ExpertComply helps with ISO 42001
ExpertComply GRC includes an ISO/IEC 42001:2023 checklist in plain language, plus AI governance and AI risk policy and assessment templates. ExpertComply VAPT checks your code for AI-specific risks such as prompt injection and unsafe handling of model output, mapped to the OWASP Top 10 for LLM Applications. See AI security for more.
See plans Ask for a walkthrough