In brief
ISO 42001 certification guide: what ISO/IEC 42001:2023 requires, how its Annex A and the EU AI Act relate, and the path to an accredited certificate.
This ISO 42001 certification guide covers the standard, its controls and the audit path. ISO/IEC 42001:2023 sets requirements for an AI management system (AIMS) in any organization that develops, provides or uses AI systems. An accredited certification body issues the certificate after a Stage 1 and Stage 2 audit; it is valid for three years with surveillance audits.
What is ISO 42001 and who is it for?
ISO/IEC 42001:2023, published by ISO and IEC in December 2023, is the first international management system standard for artificial intelligence. It asks an organization to define its role for each AI system (for example developer, provider or user), assess AI risks and impacts on people, set controls and keep improving them. It is voluntary: no law requires it in most countries, but buyers increasingly ask suppliers how they govern AI.
It is relevant to three groups:
- Companies that build AI products: SaaS with AI features, model and API providers, and outsourcing firms that build AI for clients.
- Companies that use AI in decisions about people: hiring, lending, insurance, education or health.
- Suppliers asked for evidence of AI governance in security questionnaires or procurement.
What does the standard require?
The requirements sit in clauses 4 to 10, which follow ISO's harmonized structure shared with ISO 27001. The AI-specific parts are concentrated in planning and operation.
| Clause | What it requires | What is AI-specific |
|---|---|---|
| 4 Context | Issues, interested parties, scope, the AIMS | Your role for each AI system and the AI systems in scope |
| 5 Leadership | Commitment, AI policy, roles | An AI policy separate from the security policy |
| 6 Planning | Risks, objectives, changes | AI risk assessment (6.1.2), AI risk treatment and Statement of Applicability (6.1.3), AI system impact assessment (6.1.4) |
| 7 Support | Resources, competence, awareness, documents | AI competence by role |
| 8 Operation | Operational planning and control | Performing the AI risk assessment, treatment and impact assessment (8.2 to 8.4) |
| 9 Performance evaluation | Monitoring, internal audit, management review | AIMS criteria in the audit programme |
| 10 Improvement | Nonconformity, corrective action, continual improvement | Same mechanism as other ISO systems |
Four annexes support the clauses. Annex A lists 38 reference controls in nine groups and is used to build the Statement of Applicability; Annex B gives implementation guidance for those controls; Annex C lists potential AI objectives and risk sources; Annex D describes use across domains and sectors.
What are the Annex A control groups?
| Group | Topic | Controls |
|---|---|---|
| A.2 | Policies related to AI | 3 |
| A.3 | Internal organization | 2 |
| A.4 | Resources for AI systems | 5 |
| A.5 | Assessing impacts of AI systems | 4 |
| A.6 | AI system life cycle | 9 |
| A.7 | Data for AI systems | 5 |
| A.8 | Information for interested parties of AI systems | 4 |
| A.9 | Use of AI systems | 3 |
| A.10 | Third-party and customer relationships | 3 |
Each control is included or excluded in the Statement of Applicability with a justification, for example A.5.2 (AI system impact assessment process), A.6.2.8 (AI system recording of event logs) or A.10.3 (suppliers).
How does ISO 42001 relate to the EU AI Act?
The EU AI Act (Regulation (EU) 2024/1689) is law; ISO 42001 is a voluntary standard. A certificate is not proof of AI Act compliance, but an AIMS produces much of the governance and documentation the Act expects from providers of high-risk systems.
| EU AI Act requirement (high-risk systems) | Where ISO 42001 helps |
|---|---|
| Risk management system (Art. 9) | Clauses 6.1.2 to 6.1.4 and 8.2 to 8.4; A.5 |
| Data and data governance (Art. 10) | A.7 Data for AI systems |
| Technical documentation (Art. 11) | A.6.2.7 AI system technical documentation |
| Record-keeping (Art. 12) | A.6.2.8 AI system recording of event logs |
| Transparency and information to deployers (Art. 13) | A.8.2 System documentation and information for users |
| Human oversight (Art. 14) | A.9 Use of AI systems (partial) |
| Accuracy, robustness and cybersecurity (Art. 15) | A.6.2.4 Verification and validation; cybersecurity via ISO 27001 |
| Quality management system (Art. 17) | Clauses 4 to 10 |
Application dates after the Digital Omnibus on AI (Regulation (EU) 2026/1744):
- 2 February 2025: prohibited practices and AI literacy.
- 2 August 2025: obligations for general-purpose AI models.
- 2 August 2026: transparency obligations (Article 50).
- 2 December 2027: stand-alone high-risk systems (Annex III), moved from 2 August 2026.
- 2 August 2028: high-risk AI in regulated products (Annex I).
How does certification work?
- Define scope: the AI systems, sites and roles covered.
- Build the AI inventory and run the AI risk and impact assessments. See the AI system inventory guide.
- Implement controls and write the Statement of Applicability against Annex A.
- Operate the AIMS long enough to produce records, then run an internal audit and a management review.
- Stage 1 audit: the certification body reviews documentation and readiness.
- Stage 2 audit: it tests that the AIMS works in practice; major nonconformities must be closed before certification.
- Maintain: surveillance audits during the three-year cycle, then recertification.
Choose a certification body accredited for ISO 42001; ISO/IEC 42006:2025 sets the requirements for bodies that audit and certify AI management systems. How long each phase takes depends on how many AI systems are in scope and whether an ISMS already exists; how long ISO 42001 certification takes breaks this down.
What should you do first?
- List every AI system you build, deploy or use, including tools staff use daily, with an owner for each.
- Classify EU exposure: if any system serves EU users, check it against the AI Act risk tiers.
- Run a gap assessment against clauses 4 to 10 and Annex A; teams with ISO 27001 typically find the management-system parts in place and the impact assessment, data and lifecycle controls missing.
- Decide governance roles: who approves AI policy, who owns each system, who reviews impact assessments.
How does pTrackly support ISO 42001?
pTrackly includes ISO 42001 as a framework with a compliance matrix of its clauses and Annex A controls. Adding it creates policy templates such as the AI policy, AI risk management and impact assessment policy, AI data governance policy and AI system lifecycle policy, plus recurring evidence tasks. Controls shared with ISO 27001 count once. Read-only integrations with AI platforms (OpenAI, Anthropic, AWS Bedrock, Azure OpenAI, Google Vertex AI, MLflow and others) collect supporting evidence such as model inventories and usage. pTrackly does not perform the impact assessment or decide which controls apply: your team does that, and an accredited certification body issues the certificate. See the ISO 42001 framework page and the ISO 42001 implementation checklist.
Frequently asked questions
Is ISO 42001 certification mandatory?
No. It is a voluntary standard. Customers may require it contractually, and it can support but not replace compliance with laws such as the EU AI Act.
Who issues an ISO 42001 certificate?
An independent certification body, ideally one accredited for ISO 42001 by a national accreditation body. ISO itself does not certify organizations.
How is ISO 42001 different from ISO 27001?
ISO 27001 manages information security risk. ISO 42001 manages AI risks and impacts on individuals and society, adds an AI system impact assessment and has its own Annex A of 38 controls. The management-system clauses are shared.
Does ISO 42001 apply if we only use third-party AI?
Yes. The standard covers organizations that use AI systems, not only those that build them. The scope and controls then focus on selection, intended use, supplier management and information for affected people.
References
- ISO/IEC 42001:2023
- ISO/IEC 42006:2025
- EU AI Act, Regulation (EU) 2024/1689
- Digital Omnibus on AI, Regulation (EU) 2026/1744
This guide does not replace the published standard, legal advice or an independent assessment.
