Lesson 3 of 7 · 8 min read
ISO/IEC 42001
In this lesson
TL;DR: ISO/IEC 42001:2023 (published December 2023) defines an AI management system (AIMS): organisational context and scope, leadership commitment and an AI policy, roles, AI risk assessment and treatment, AI system impact assessment on individuals and society, operational controls across the AI lifecycle, performance evaluation through monitoring, internal audit and management review, and continual improvement. It uses the ISO harmonised structure, so it integrates with ISO/IEC 27001. Its Annex A lists reference controls (policies, internal organisation, resources, impact assessment, lifecycle, data, information for interested parties, use, third parties). It is certifiable. Certification proves the system for managing AI exists and works, not that a given model is safe or that the organisation meets the EU AI Act.
Before you read
Pick an answer before you read further. The lesson below explains it, and guessing first, right or wrong, helps the explanation stay with you.
1A vendor shows you its ISO/IEC 42001 certificate in a procurement review for an AI product. What does it tell you, and what does it not?
What a management system standard is
Management system standards describe how an organisation runs a domain repeatably, rather than prescribing technical settings. ISO/IEC 27001 does this for information security. ISO/IEC 42001 does it for AI: a system of policies, objectives, processes and controls, operated in a plan-do-check-act cycle and audited.
The requirements, clause by clause
| Clause | Content | Practical output |
|---|---|---|
| 4 Context | Internal and external issues, interested parties, scope, the AIMS | Scope statement; register of AI systems in scope |
| 5 Leadership | Commitment, AI policy, roles and responsibilities | AI policy; named owners |
| 6 Planning | AI risk assessment and treatment; AI system impact assessment; objectives | Risk register; impact assessments; statement of applicability |
| 7 Support | Resources, competence, awareness, communication, documented information | Training records; documentation |
| 8 Operation | Operational planning and control; performing assessments and treatments | Lifecycle procedures, release gates |
| 9 Performance evaluation | Monitoring, measurement, internal audit, management review | Metrics, audit reports, review minutes |
| 10 Improvement | Nonconformity, corrective action, continual improvement | Corrective action log |
Annex A provides reference controls, Annex B implementation guidance, and further annexes cover AI objectives, risk sources and use across sectors. Like ISO 27001's statement of applicability, organisations justify which controls they include.
Plan
Policy, scope, risk + impact assessment
Do
Lifecycle controls, data, suppliers
Check
Monitoring, internal audit, review
Act
Corrective action, improvement
Plan and do
Clauses 4 to 6 set context, leadership, AI risk assessment and AI system impact assessment; clause 8 operates the controls chosen from Annex A across the AI lifecycle.
Annex A: 38 controls in nine areas
Annex A is where the standard gets concrete. It lists 38 reference controls grouped under nine areas, numbered A.2 to A.10. Interviewers rarely expect the control numbers, but knowing the areas and roughly what evidence each needs shows you have worked with the standard rather than read a summary.
| Area | Controls | What auditors typically ask to see |
|---|---|---|
| A.2 Policies related to AI | 3 | The AI policy, how it aligns with other policies, when it was last reviewed |
| A.3 Internal organisation | 2 | Named AI roles, and a way for staff to report concerns |
| A.4 Resources for AI systems | 5 | Inventories of data, tools, compute and people for each system |
| A.5 Assessing impacts of AI systems | 4 | The impact assessment process and completed assessments for individuals, groups and society |
| A.6 AI system life cycle | 9 | Requirements, design records, verification and validation, deployment, monitoring, technical documentation and event logs |
| A.7 Data for AI systems | 5 | Data acquisition, quality, provenance and preparation records |
| A.8 Information for interested parties | 4 | User documentation, incident communication, information for external reporting |
| A.9 Use of AI systems | 3 | Processes and objectives for responsible use, and what the intended use is |
| A.10 Third-party and customer relationships | 3 | Allocation of responsibilities, supplier assessments, customer commitments |
The counts add up to 38. A.6 is the largest because it covers the whole build, test and run cycle, and for a security team it is where most of the work lands: release gates, evaluation records tied to model versions, monitoring and logs.
The statement of applicability
The standard does not say "implement all 38". Clause 6 requires a risk assessment, a risk treatment plan and a statement of applicability (SoA): for every Annex A control, whether it is included, why, and whether it is implemented. Excluding a control is allowed with a written justification tied to the scope, for example "the organisation does not train models in-house" for some data-preparation controls. Organisations can also add controls that are not in Annex A when their risks call for them.
Auditors read the SoA against the risk register. A control excluded without justification, or a significant risk with no treatment, is a finding. A control marked implemented with no evidence over time is also a finding, which is why the operating records matter more than the policy documents.
How certification works
Certification is done by an accredited certification body, and since July 2025 ISO/IEC 42006 sets the extra requirements for bodies that certify AI management systems, including auditor competence in AI.
- Stage 1 reviews documentation and readiness: scope, policy, risk and impact assessments, SoA, and whether internal audit and management review have happened.
- Stage 2 tests whether the system actually operates: interviews, samples of records, evidence that controls work as described. Major nonconformities must be closed before a certificate is issued.
- Surveillance audits follow each year, sampling parts of the system to show it keeps running.
- Recertification happens on a three-year cycle.
The most important document for anyone relying on someone else's certificate is the scope statement. A certificate covers the AI management system for the systems, sites and activities named in scope, nothing else. A vendor certified for its internal HR analytics has told you nothing about the product it is selling you.
The family of related standards
ISO/IEC 42001 is the only certifiable one in this group. The others provide method or link it to regulation.
- 1
1 · ISO/IEC 42001:2023
AI management system requirements
- Certifiable
- Clauses 4 to 10 plus Annex A
The system you are audited on
- 2
2 · ISO/IEC 42006:2025
Requirements for certification bodies
- Auditor competence in AI
- How audits are run
Governs the auditors, not you
- 3
3 · ISO/IEC 23894 and 42005
Risk management and impact assessment guidance
- Methods for clause 6
- Not certifiable
How to do the assessments
- 4
4 · ISO/IEC 27090:2026
Security threats to AI systems
- Poisoning, evasion, extraction
- Feeds 27001 and 42001 risk work
A threat catalogue, not a management system
- 5
5 · EN 18286:2026
Quality management system for the AI Act
- Cited in the Official Journal
- Presumption for the Article 17 QMS
The EU route, separate from 42001
The certifiable core
42001 defines the management system; 42006 defines how certification bodies audit it.
- ISO/IEC 23894:2023 is guidance on AI risk management, adapting ISO 31000 to AI, with an annex mapping risk activities to the AI life cycle.
- ISO/IEC 42005:2025 is guidance on carrying out AI system impact assessments: the method behind A.5.
- ISO/IEC 27090:2026 is guidance on security threats and compromises to AI systems. Use it as a threat catalogue for clause 6 risk identification, mapping threats such as poisoning, evasion, model extraction and data leakage to Annex A and ISO 27002 controls.
- EN 18286:2026 is a separate European standard for the quality management system the AI Act requires of high-risk providers, and the first harmonised standard cited for the Act. A 42001 system is a strong foundation for it, but presumption of conformity comes from EN 18286, not from a 42001 certificate.
Worked example: adding 42001 to an ISO 27001 organisation
A company already certified to ISO 27001 wants 42001 for an AI platform behind three customer-facing features. The timeline and scope are illustrative.
| Area | SoA decision | Evidence |
|---|---|---|
| A.5 Impact assessment (4) | All included | Three impact assessments, one per feature, using 42005 as the method |
| A.6 Life cycle (9) | All included | Release-gate records, evaluation results tied to model versions, monitoring dashboards, event logs |
| A.7 Data (5) | Included; one control narrowed | Dataset register with provenance and quality checks; no in-house pretraining, justified in the SoA |
| A.10 Third parties (3) | All included | Model-vendor reviews, contract clauses on data retention and change notice |
| Management processes | Reused from 27001 | Internal audit, management review, document control and corrective action extended to AI |
The plan: a gap assessment in month 1; build the missing AI processes in months 2 to 4; run a full internal audit and management review in month 5, so there are records to show; then Stage 1 and Stage 2 from month 6. The common failure is reaching Stage 2 with policies but no operating history: auditors sample records, and three months of release-gate evidence is far stronger than a procedure nobody has followed yet.
Gap assessment
Month 1
Build the AIMS
Months 2 to 4
Internal audit
Plus management review
Stage 1
Documents, readiness
Stage 2
Records, interviews
Find the gaps
Compare current practice with clauses 4 to 10 and Annex A, reusing what an existing 27001 system already does.
Impact assessment as a distinct requirement
Beyond risk to the organisation, ISO/IEC 42001 requires assessing the potential consequences of AI systems for individuals, groups and society. That aligns with the fundamental rights focus of the EU AI Act and with the NIST AI RMF's attention to impacts beyond the organisation, and it is where many security-led programmes need to broaden.
Relationship to other frameworks
| ISO/IEC 42001 | NIST AI RMF | EU AI Act | |
|---|---|---|---|
| Nature | Certifiable management system standard | Voluntary framework | Law |
| Scope | The organisation's AI management | AI risk practices | Specific systems by risk tier and role |
| Evidence | Certificate from an accredited body | Self-attested alignment | Conformity assessment, documentation, registration |
They overlap heavily: an organisation can use the NIST AI RMF to structure risk practices, operate them inside an ISO/IEC 42001 management system, and use both as evidence toward EU AI Act obligations. None satisfies another automatically. Presumption of conformity under the AI Act comes from harmonised European standards cited in the Official Journal; the first, EN 18286, cited in October 2026, covers the quality management system only (checked November 2026), and others are still being developed.
Integrating with ISO 27001
Because both use the harmonised structure (the same clause numbering for context, leadership, planning and so on), organisations commonly run an integrated management system: one set of management review, internal audit and document control processes, with AI-specific risk and impact assessments and controls added. AI security controls such as model supply chain checks, evaluation gates and AI incident response fit naturally into the operation clause.
Misconceptions interviewers listen for
- "Certification means the model is safe." It means the management system operates within its scope. Read the scope statement.
- "All Annex A controls are mandatory." Controls are selected through the statement of applicability, with justification for exclusions.
- "42001 is the AI Act's harmonised standard." EN 18286 is the cited standard for the AI Act quality management system; 42001 helps but does not give presumption of conformity.
- "42005 and 23894 can be certified." Both are guidance, used as methods inside a 42001 system.
What if · interview follow-ups
Hold your answer as the constraints change
Your company runs an ISO 27001 programme and is adding ISO/IEC 42001 for its AI platform. You also buy AI services from vendors who advertise 42001 certificates. The interviewer probes what the standard does and does not tell you.
Start here
Is ISO/IEC 42001 a technical standard for securing models?
What kind of standard is it, and where do technical controls appear?
No. It is a management system standard: it requires a governed, audited process for managing AI risk and impact, with Annex A listing 38 reference controls in nine areas. Technical measures such as evaluations and release gates appear as evidence that life-cycle controls in A.6 operate, but the standard does not prescribe particular techniques.
Carry it forward42001 audits the process that produces controls, not the controls' technical strength.
Weak answerDescribing it as a security checklist for models.
Constraint changes
What if the auditor asks for evidence that your A.6 life-cycle controls work?
Policies or records?
Show records over time: release-gate decisions for each model version with the evaluation results behind them, change tickets, monitoring alerts and how they were handled, and event logs. A procedure document alone is weak; auditors sample operating records, and surveillance audits do so again every year.
Carry it forwardEvidence is operating records, sampled over time.
Weak answerHanding over the policy and the procedure only.
Constraint changes
What if a vendor's 42001 certificate scope excludes the product you are buying?
What does a certificate cover?
Then it is not evidence about that product. Ask for a certificate whose scope includes it, or for product-specific evidence instead: evaluation results, the vendor's own impact assessment, contract terms on data use and change notice, and a right to audit. Record the gap in your third-party risk assessment.
Carry it forwardA certificate is only as useful as its scope statement.
Weak answerAccepting the logo on the vendor's website as assurance.
Constraint changes
Does being 42001-certified satisfy the EU AI Act's quality management system requirement?
Which standard is cited in the Official Journal?
Not by itself. Presumption of conformity for the Article 17 quality management system comes from EN 18286, the first harmonised standard cited for the Act. A 42001 system covers much of the ground, so do a gap analysis against EN 18286 and close the differences, rather than assuming the certificate carries over.
Carry it forwardUse 42001 as a foundation and gap-assess against EN 18286.
Weak answerTelling leadership the certificate makes them AI Act compliant.
Constraint changes
How would you use ISO/IEC 27090 inside the management system?
Which clause needs a list of threats?
As a threat catalogue for clause 6 risk identification. Map its threats, such as poisoning, evasion, model extraction and data leakage, to the AI systems in scope, then to Annex A and ISO 27002 controls, and record the treatment decisions in the risk register and statement of applicability. It is guidance, so it feeds the system rather than being audited on its own.
Carry it forward27090 supplies threats; 42001 and 27001 manage the response.
Weak answerProposing to certify against 27090.
Now defend it
As the defender, what would you check first when relying on a supplier's 42001 certificate?
The scope statement and whether it names the product and sites you use, the certification body and its accreditation, the date of the last surveillance audit, and whether the supplier will share its statement of applicability or a summary of excluded controls with their justification.
How this shows up in interviews
"What is ISO/IEC 42001, is it certifiable, and how does it relate to ISO 27001?" appears in governance and security architect interviews. Strong answers describe the management system clauses, impact assessment, Annex A controls, certification and its limits, and the integration with 27001, and place it correctly alongside the NIST AI RMF and the EU AI Act.
Say it in 30 seconds: "ISO/IEC 42001:2023 is a certifiable AI management system standard, structured like ISO 27001: context and scope, leadership and an AI policy, AI risk assessment and treatment plus AI system impact assessment, operational controls, monitoring, audit and continual improvement, with Annex A reference controls. It integrates with 27001 through the shared clause structure. A certificate shows the management system works within its scope; it doesn't prove a product is safe or that you meet the EU AI Act."
Check yourself
Say or write your answer first, then reveal. Explaining it from memory, in your own words, is the skill an interviewer is checking.
1Why does a certificate's scope statement matter so much in vendor reviews?
2An organisation already certified to ISO 27001 wants ISO 42001. What can it reuse, and what is genuinely new?
3How many Annex A controls does ISO/IEC 42001 list, and in how many areas?
4What are the stages of a 42001 certification and how long does a certificate cycle last?