ISO 42001: the AI management system standard explained

ISO/IEC 42001 is the international standard for an Artificial Intelligence Management System (AIMS) - the first certifiable framework for governing how an organisation develops, deploys and uses AI. If ISO 27001 is how you prove you manage information security, ISO 42001 is how you prove you manage AI responsibly.

Why it exists

AI introduces risks that traditional security frameworks were never designed to address: biased outputs, opaque decision-making, model drift, training-data provenance, hallucinated content, and unclear accountability when an automated decision harms someone. Regulators and enterprise buyers began asking how organisations control these - and ISO 42001 provides the answer in a familiar management-system format.

What the standard requires

It follows the same high-level structure as ISO 27001, so the two integrate cleanly:

• Context and scope - which AI systems and use cases the AIMS covers.
• Leadership and AI policy - documented commitment and accountability for AI outcomes.
• Planning - AI risk assessment and, distinctively, AI system impact assessment considering effects on individuals and society, not just on the organisation.
• Support - competence, awareness and documented information.
• Operation - controls across the AI lifecycle: data management, model development, validation, deployment, monitoring and decommissioning.
• Performance evaluation - monitoring, internal audit and management review.
• Improvement - corrective action and continual improvement.

How it differs from ISO 27001

• Object of protection. ISO 27001 protects information. ISO 42001 governs AI systems and their effects - including on people outside the organisation.
• Impact assessment. ISO 42001 explicitly requires assessing consequences for individuals and society, which has no direct ISO 27001 equivalent.
• Lifecycle focus. Controls follow the AI lifecycle - data, training, evaluation, deployment, monitoring, retirement.
• Transparency duties. Explainability, documentation of intended use, and disclosure that AI is being used.

Because the management-system clauses are structurally aligned, organisations with a working ISMS can extend it into an AIMS rather than building a second system.

Who should consider certification

• Organisations building AI into products, especially where outputs affect customers.
• Vendors selling AI capability to enterprises - buyers are already adding AI questions to security reviews.
• Regulated sectors deploying AI in decisions about people: finance, healthcare, employment, insurance.
• Organisations preparing for the EU AI Act, which expects documented risk management, data governance and human oversight.

Practical first steps

1. Inventory your AI systems. Include embedded vendor AI features - most organisations underestimate this substantially.
2. Classify by impact. An internal summarisation tool is not a credit-scoring model; govern them proportionally.
3. Assign accountability for each AI system to a named owner.
4. Assess data provenance - what the model was trained or grounded on, and whether you had the right to use it.
5. Define human oversight - where a person must review or can override an AI output.
6. Monitor in production for drift, degradation and harmful outputs, and record the results.

The most common gap is not a missing control - it is a missing inventory. You cannot govern AI you have not noticed your teams are using.

Key takeaways

• ISO 42001 is the first certifiable AI management system standard.
• It adds impact assessment, lifecycle controls and transparency duties beyond ISO 27001.
• It supports - but does not equal - EU AI Act compliance.
• Start with an AI inventory, including embedded vendor AI features.