ISO/IEC 42001.

What ISO/IEC 42001 actually governs

ISO/IEC 42001 is the first certifiable management system standard dedicated to artificial intelligence. It does not tell you which model to train or how to tune a neural network. Instead it defines an AI management system (AIMS): the policies, roles, processes and controls an organisation puts in place to develop, provide or use AI responsibly. If you already know ISO 27001, the mental model transfers directly. Where the ISMS protects information, the AIMS governs the lifecycle of AI systems, from intended purpose and data sourcing through deployment, monitoring and decommissioning.

The standard follows the same High-Level Structure as ISO 27001 and ISO 9001: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. That shared backbone is deliberate. It lets you bolt the AIMS onto an existing integrated management system rather than running a parallel governance silo. The AI-specific substance lives in the annexes, which set out reference controls and implementation guidance covering issues like accountability, data quality, transparency to users, human oversight and impact assessment.

How it differs from ISO 27001 and a generic risk policy

Practitioners coming from security often assume an ISMS already covers AI. It does not. ISO 27001 is built around confidentiality, integrity and availability of information. ISO 42001 adds concerns that have no natural home in a security framework: whether a system behaves fairly, whether its outputs are explainable, whether a human can meaningfully intervene, and whether the AI is used only for its stated purpose. The risk thinking is broader too. A 42001 risk assessment weighs impacts on individuals and society, not only on the organisation, which is why an AI impact assessment is a distinct, named activity inside the standard.

Why it matters for the EU AI Act

ISO 42001 maps cleanly onto the AI Act's expectations for high-risk systems. The Act requires providers of high-risk AI to operate a risk management system, maintain data governance, keep technical documentation, ensure human oversight and run post-market monitoring. Those are precisely the disciplines an AIMS institutionalises. A certified management system is not a substitute for legal conformity, and certification does not by itself make a system compliant. What it does is give an auditable, repeatable structure that demonstrates due diligence and makes meeting the Act's obligations a matter of operating an existing system rather than improvising under deadline pressure.

What implementation looks like in practice

Teams adopting 42001 generally work through a recognisable sequence:

1. Define the scope: which AI systems, used by whom, for what intended purpose, and where the organisation sits in the supply chain (developer, provider, deployer).
2. Run the AI risk assessment and impact assessment, identifying risks to people and the organisation and selecting controls to treat them.
3. Assign clear accountability so a named owner is responsible for each AI system across its lifecycle.
4. Establish data governance, transparency mechanisms and human oversight appropriate to the risk level.
5. Monitor systems in operation, capture incidents and feedback, and feed them back into continual improvement.

Certification is optional but increasingly requested by enterprise buyers and procurement teams who want third-party assurance that an AI supplier governs its systems rather than ships them blind.