What is ISO/IEC 42001? The artificial intelligence management system
ISO/IEC 42001:2023 is the international standard that sets the requirements for an artificial intelligence management system (AIMS): policies, roles, risk and impact assessment, controls and continual improvement to develop, provide or use AI systems responsibly. It was published in December 2023, follows the same structure as ISO 27001 (clauses 4 to 10) and includes an Annex A with 38 reference controls.
Who is ISO 42001 for?
It applies to any organization that develops, provides or uses AI systems, regardless of size or sector: from a company using a customer-service chatbot or a CV screening tool to a provider training its own models.
- Companies adding third-party AI to their processes that need to control risks and responsibilities.
- Software providers embedding AI and receiving customer questions about AI governance.
- Organizations that already have ISO 27001 and want to extend their management system to AI.
- Teams that must show responsible AI management to customers, auditors or regulators.
Structure of the standard: clauses 4 to 10
| Clause | Topic | What it means in practice |
|---|---|---|
| 4 | Context of the organization | Define the AIMS scope, interested parties and the organization's role regarding AI (provider, user, etc.) |
| 5 | Leadership | Top management commitment, AI policy, roles and responsibilities |
| 6 | Planning | Assess and treat AI risks, assess impacts on people, set objectives and prepare the Statement of Applicability |
| 7 | Support | Resources, competence, awareness, communication and documented information |
| 8 | Operation | Carry out the plan: risk and impact assessments and treatment across the system life cycle |
| 9 | Performance evaluation | Indicators, internal audit and management review |
| 10 | Improvement | Nonconformities, corrective actions and continual improvement |
Annex A: 38 controls in 9 objectives
Annex A groups the reference controls into nine areas. As with ISO 27001, the organization decides which ones it needs based on its risks and justifies it in a Statement of Applicability.
| Area | Focus |
|---|---|
| A.2 | Policies related to AI |
| A.3 | Internal organization: roles, responsibilities and reporting of concerns |
| A.4 | Resources for AI systems: data, tools, computing and people |
| A.5 | Assessing the impacts of AI systems on people and society |
| A.6 | AI system life cycle: design, verification, deployment and operation |
| A.7 | Data for AI systems: quality, provenance and preparation |
| A.8 | Information for interested parties: transparency and documentation |
| A.9 | Responsible use of AI systems |
| A.10 | Third-party and customer relationships: suppliers and shared responsibilities |
The standard also includes Annex B (implementation guidance for the controls), Annex C (AI-related objectives and risk sources) and Annex D (use of the management system across sectors).
ISO 42001 vs ISO 27001
| Aspect | ISO/IEC 27001:2022 | ISO/IEC 42001:2023 |
|---|---|---|
| Subject | Information security | Responsible development, provision and use of AI |
| Structure | Clauses 4 to 10 | Clauses 4 to 10 (same structure) |
| Annex A controls | 93 controls in 4 themes | 38 controls in 9 objectives |
| Specific assessment | Information security risks | AI risks and AI system impact assessment |
| Statement of Applicability | Required | Required |
Because they share a structure, an organization with ISO 27001 can reuse its document control, internal audit, management review and corrective action processes and add what is specific to AI.
How it relates to the EU AI Act
Regulation (EU) 2024/1689 on artificial intelligence entered into force on 1 August 2024, and since 2 February 2025 the prohibited practices and the staff AI literacy obligation (Article 4) apply. ISO 42001 does not replace the Regulation and does not by itself amount to compliance, but it gives an orderly way to inventory systems, assess risks and impacts, assign responsibilities and keep evidence, which is the groundwork that compliance needs.
Steps to implement an AIMS
- Inventory the AI systems you develop, provide or use, and define the scope.
- Approve an AI policy and assign roles (including who decides about each system).
- Set criteria and assess AI risks and each system's impact on people.
- Select controls and document the Statement of Applicability against the 38 Annex A controls.
- Train staff, operate the controls and measure with indicators.
- Run internal audits and management reviews, and correct what you find.
Frequently asked questions
Is ISO 42001 certifiable?
Yes. It is a requirements standard, so an organization can be audited by a certification body. The outcome depends on how the system is implemented and operated in each organization.
How many controls does ISO 42001 have?
Annex A has 38 controls grouped into 9 objectives (A.2 to A.10). The organization decides which ones apply based on its risks and justifies it in the Statement of Applicability.
Do I need ISO 27001 to implement ISO 42001?
No. They are independent, but they share a structure, and organizations with an ISMS can reuse much of their management system.
Is ISO 42001 useful if we only use third-party AI?
Yes. The standard covers different roles regarding AI, including users of other providers' systems, and third-party relationships have their own control area (A.10).
Related guides
- ISO 27001 Statement of Applicability (SoA): what it is and how to write it
- ISO 42001 mandatory documents (AI management system)
- What is an ISMS and how do you implement it with ISO 27001?
Updated: 2026-10-20