ISO/IEC 42001: what it is, how it is structured and what managing artificial intelligence really means

Artificial intelligence is entering businesses faster than their governance mechanisms can evolve. ChatGPT, Microsoft Copilot or an AI feature embedded in corporate software appears first. Automation, classification models, internal assistants and AI-supported decisions follow. The question changes from “do we use artificial intelligence?” to “who controls how we use it?”.

ISO/IEC 42001 addresses that second question. It does not prescribe a particular model or offer a universal list of safe technologies. It establishes a repeatable system for governing the risks, impacts, data, responsibilities, suppliers and decisions associated with AI.

What exactly is ISO/IEC 42001?

ISO/IEC 42001:2023 is the first international management system standard dedicated to artificial intelligence. It specifies requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS).

In Spain, UNE-EN ISO/IEC 42001:2026 is the national adoption, in force since 8 April 2026 and identical to ISO/IEC 42001:2023 according to AENOR. It replaces UNE-ISO/IEC 42001:2025, as recorded in the Spanish official gazette. The management system can be certified by a third party, although implementing the standard and seeking certification are separate decisions.

Who does it apply to?

The standard is designed for organisations of any size and in any sector that develop, provide or use AI-based products or services. It is not limited to model developers.

A company that procures a generative tool, integrates a third-party model or uses AI to support internal decisions must also understand its role. Depending on the system, it may be a provider, developer, operator, deployer, user, integrator, data provider or customer—and may combine several roles.

That role changes its responsibilities. The starting point is therefore not buying controls. It is understanding which AI systems exist, what they are used for, who supplies them, who decides and who may be affected.

Why does AI need its own management system?

Traditional software already requires security, quality and privacy, but AI adds its own uncertainties: difficult-to-explain decisions, dependence on data, probabilistic outputs, bias, performance drift, continuous learning and effects on people that can arise without a conventional technical failure.

A system may be available, suffer no attack and lose no information, yet still produce unfair, unreliable or out-of-purpose results. ISO 42001 brings those questions into ordinary business governance through risk-based management and continual improvement.

How ISO 42001 is structured

The standard can be understood in three layers. This separation prevents the common mistake of reducing ISO 42001 to Annex A.

Requirements in clauses 4 to 10

Clause 4: context and scope

The organisation identifies internal and external issues, interested parties, applicable requirements and the scope of the AIMS. Two questions are decisive for AI: what is each system’s intended purpose, and what role does the organisation play in relation to it?

In practice, an inventory must connect systems, uses, owners, suppliers, data, affected people and jurisdictions. Without that view, scope cannot be justified and risk cannot be assessed consistently.

Clause 5: leadership

Top management must integrate AI management into the business, approve a policy, set objectives, assign responsibilities and provide resources. It is not enough to point to “the AI person”: the organisation must know who authorises a use, accepts risk, monitors outcomes and has authority to stop the system.

To put requirement 5.2 into practice, use our guide to creating an ISO/IEC 42001 AI policy, with a free editable Word template and five working appendices.

Clause 6: planning

This is where risk assessment and treatment processes are designed, objectives are set and changes are planned. The organisation establishes acceptance criteria and considers consequences for itself, people and society.

Clause 7: support

The system needs resources, competence, awareness, communication and documented information. Evidence matters: a practice that lives only in one person’s informal knowledge is difficult to repeat, audit and improve.

Clause 8: operation

Criteria and controls move from paper into real activity. Risk and impact assessments must be repeated at planned intervals and when significant changes are proposed: model, supplier, data, version, functionality, population, context or purpose.

Clause 9: performance evaluation

The organisation decides what to measure, how to analyse it and when results will be reviewed. Internal audit checks both conformity and effective implementation; management review brings decisions and problems to the right governance level.

Clause 10: improvement

Nonconformities are corrected, their causes analysed, recurrence considered and the effectiveness of actions checked. The objective is not to produce a perfect snapshot for an audit, but to build a system capable of detecting and correcting its weaknesses.

Risk and impact: related, but not identical

ISO 42001 requires an AI risk assessment process and an AI system impact assessment process. Their outputs are connected, but they answer different questions.

A model can work as designed and still systematically disadvantage a group. That possibility is why the assessment cannot be limited to availability, accuracy or cyberattacks.

Risk treatment and the Statement of Applicability

After assessing risks, the organisation decides how to treat them and which controls it needs. It then compares that selection with Annex A to check that no necessary control has been omitted.

The result is recorded in a Statement of Applicability: necessary controls, reasons for inclusion, implementation status and reasons for excluding Annex A controls. The organisation may also add its own controls.

The 38 Annex A controls

The reference controls are grouped into nine areas. They are not 38 cybersecurity controls: they combine governance, data, transparency, impact, lifecycle, responsible use and third parties.

Annex B gives guidance for implementing the controls. Annex C broadens possible objectives and risk sources—including fairness, privacy, robustness, transparency and environmental impact—while Annex D helps integrate the AIMS with systems such as ISO/IEC 27001, ISO/IEC 27701 and ISO 9001.

What evidence should an organisation be able to show?

The exact documentation depends on scope and risk, but a defensible system will normally connect at least the following:

• Inventory and context: systems, purposes, roles, owners, suppliers, affected parties and requirements.
• Governance: policy, objectives, decision bodies, responsibilities, escalation and risk acceptance.
• Risk and impact: method, criteria, assessments, decisions and foreseeable misuse.
• Data and lifecycle: provenance, quality, transformations, requirements, validation, deployment, records and changes.
• People and transparency: competence, human oversight, user information and channels for reporting impacts.
• Third parties: due diligence, contractual responsibilities, changes, incidents and monitoring capability.
• Improvement: metrics, audits, management review, nonconformities and corrective actions.

How to start implementing ISO 42001

A proportionate implementation does not start by writing dozens of procedures. It starts by defining decisions and evidence.

1. Sponsorship and objective: clarify why the system is being implemented and what management expects from it.
2. Initial inventory: locate AI uses, including software-as-a-service and informal adoption.
3. Roles and scope: define the organisation’s role and which units, processes and systems enter the AIMS.
4. Gap assessment: compare current practices with clauses 4–10 and Annex A.
5. Risks and impacts: apply repeatable criteria to the systems in scope.
6. Treatment and applicability: select controls, owners, deadlines and evidence.
7. Operation: integrate controls into procurement, development, changes, use, monitoring and incidents.
8. Assurance: measure, audit, review and correct before considering certification.

ISO 42001 and the EU AI Act: how do they relate?

ISO 42001 can help structure governance, risk, competence, documentation, suppliers and improvement. These capabilities are useful when an organisation must connect multiple systems and evidence for the EU AI Act.

Precision matters, however: ISO 42001 certification is not automatically equivalent to EU AI Act compliance. Article 40 reserves a presumption of conformity for harmonised standards—or parts of them—whose references have been published in the Official Journal of the European Union, and only to the extent that they cover the relevant requirements.

The standard manages an organisation, while the AI Act imposes duties according to the role, system, classification and use case. A requirement-by-requirement mapping and system-specific legal and technical assessment are therefore still needed.

What ISO 42001 is not

• It is not a list of approved AI tools.
• It does not certify that every model output is correct or fair.
• It does not replace technical, legal, security or data-protection assessments.
• It does not require every Annex A control to be deployed without judgement.
• It does not remove responsibility when an organisation buys AI as a service.
• It is not a project that ends with a certificate: continual improvement is required.

Frequently asked questions about ISO 42001

What is ISO/IEC 42001?

It is a certifiable international standard that sets requirements for establishing, implementing, maintaining and continually improving an artificial intelligence management system.

Who does ISO 42001 apply to?

Any organisation, of any size or sector, that develops, provides or uses products or services based on artificial intelligence.

Is ISO 42001 mandatory?

Not by itself. It is a voluntary standard, although a contract, procurement policy or sector-specific requirement may require it.

Does ISO 42001 certification prove compliance with the EU AI Act?

No. ISO 42001 can help organise processes and evidence, but certification does not replace legal analysis or prove compliance with the EU AI Act by itself.

Must all 38 Annex A controls be implemented?

Not necessarily. The organisation selects controls from its context and risks, justifies inclusions and exclusions, and may add its own controls.

ISO 42001’s most valuable contribution is not a particular list of controls. It turns AI governance into a continuous process: knowing which systems exist, who decides, who may be affected, what evidence supports their use and when the organisation must change course.

The question is no longer only whether the AI works. It is whether the organisation is prepared to decide when to use it, under which conditions and with what accountability.