What is ISO/IEC 42001?
ISO/IEC 42001 is the international standard for an AI Management System (AIMS). Published in December 2023, it sets out how an organisation should govern the AI systems it builds, provides or uses: who owns them, how risks and impacts are assessed, which controls apply, and how it all gets reviewed and improved. It follows the same management-system structure as ISO 27001, so if you already have an ISMS, much of the groundwork exists.
What does it ask you to do?
- Know which AI systems you have.
- Assess the risks they create for your business.
- Assess their impact on people they affect.
- Put controls in place and assign owners.
- Monitor, review and improve.
How it relates to ISO 27001
ISO 42001 follows the same management-system structure as ISO 27001. An existing ISMS gives you document control, risk processes and internal audit to build on. ISO 42001 adds AI-specific risk, impact assessment and lifecycle controls.
Is it a legal requirement?
No. It is a voluntary, certifiable standard. Certification is issued by an accredited certification body after an audit.
ISO 42001 and the EU AI Act
They are separate. ISO 42001 can help organise the governance work the Act expects, but following it does not by itself make you compliant with the Act.