ISO 42001 is the international standard for an artificial intelligence management system, published in December 2023. It sets out requirements for establishing, running and improving the way an organization governs the AI it builds or uses, and it can be certified by an accredited body.
What does ISO 42001 actually ask for?
A management system, in the familiar ISO shape: a stated AI policy, defined roles, impact assessment, controls across the AI lifecycle, and data governance, with an annex of controls grouped into themed areas. It certifies your process, not any individual model, which is the point people most often get wrong when they ask whether a specific chatbot can be certified. Much of it restates what a functioning AI governance program already does.
Who should actually pursue ISO 42001 certification?
The honest answer is whoever is being asked for it. The pressure usually arrives through a customer security questionnaire rather than from a regulator, so the deciding question is whether certification unblocks revenue. Certification runs a two-stage audit, holds for three years with annual surveillance, and is a real budget line. If nobody is asking yet, the cheaper path is documented AI risk management and AI assurance evidence you can show on request, plus the same rigor applied to suppliers through AI vendor assessment.
Frequently asked questions
Is ISO 42001 the same as complying with the EU AI Act?
No. The standard is voluntary and the Act is law. Certification is useful evidence that you manage AI systematically, and it overlaps much of what the Act expects of a deployer, but it is not a legal defense on its own.
Do we need ISO 42001 if we already hold ISO 27001?
They cover different things. ISO 27001 certifies that you manage information security; ISO 42001 certifies that you manage AI, including its impact on the people it affects and its behavior across the lifecycle. The management system structure is familiar, so much of the documentation and review routine can be reused.
No advertising or tracking cookies, and our visitor counts are anonymous. The Cal.com booking widget loads only if you allow it. Privacy Policy.
The page itself, anything our host sets to serve and secure it, and the anonymous visitor count. Always on, and none of it stores anything on your device.
The Cal.com booking widget. Left off, a booking link opens the booking page instead of a popup, so you can still book a call.