Compliance Guide - ISO/IEC 42001¶

Overview¶

ISO/IEC 42001:2023 is the international standard for an AI Management System (AIMS). Published in December 2023, it is the first certifiable AI governance standard, which is what distinguishes it from frameworks like NIST AI RMF: an accredited body can audit you and issue a certificate that a customer or regulator can read.

If you already hold ISO/IEC 27001, the shape will be familiar. 42001 uses the same Harmonized Structure (clauses 4 to 10), the same Annex A control-set pattern, and the same plan-do-check-act rhythm. Organizations with a working ISMS typically extend it rather than building a parallel system.

📖 ISO/IEC 42001:2023 - the standard (purchase required) 📖 ISO/IEC 23894:2023 - AI risk management guidance, the companion to 42001 📖 ISO/IEC 22989:2022 - AI concepts and terminology

Structure¶

flowchart TB
  subgraph mgmt[Management system clauses 4-10]
    C4[4 Context<br/>scope, interested parties]
    C5[5 Leadership<br/>policy, roles, commitment]
    C6[6 Planning<br/>risk + impact assessment,<br/>objectives]
    C7[7 Support<br/>resources, competence,<br/>awareness, documentation]
    C8[8 Operation<br/>run the processes]
    C9[9 Performance evaluation<br/>monitoring, internal audit,<br/>management review]
    C10[10 Improvement<br/>nonconformity, corrective action]
  end

  AA[Annex A controls<br/>selected via Statement<br/>of Applicability]

  C4 --> C5 --> C6 --> C7 --> C8 --> C9 --> C10
  C10 -.continual improvement.-> C4
  C6 --> AA --> C8

The management system clauses are mandatory. Annex A controls are selected based on your risk assessment and justified in a Statement of Applicability, which is the document auditors spend the most time on.

Clause by clause, in practice¶

The AI system impact assessment in clause 6 is the requirement with no direct 27001 equivalent. It asks about consequences for individuals and groups, not just for the organization, which is a genuinely different lens for a security team to adopt.

Annex A control themes¶

Annex A groups roughly 38 controls across nine themes. The exact clause numbering should be read from the standard itself; what follows is the shape of what is covered.

The data and lifecycle themes map almost one-to-one onto engineering practice you may already have: dataset versioning, model registries, eval gates, audit logging, and the AI-BOM.

Roles the standard recognizes¶

42001 expects you to state which roles you occupy, because obligations differ.

• AI provider - develops or supplies AI systems or platforms.
• AI producer - designs, develops, tests, and deploys.
• AI customer / user - uses AI systems, including systems built by others.
• AI partner - supports the lifecycle, for example data providers or evaluators.
• AI subject - the individual affected by the system's output.
• Relevant authority - regulators and oversight bodies.

Most organizations are simultaneously a customer of foundation models and a producer of the applications built on them. Say so explicitly in the scope; ambiguity here creates findings.

Getting certified¶

Typical timeline: 6 to 12 months from a standing start, 3 to 6 months if you already hold 27001.

1. Scope. Which entities, locations, and AI systems are in scope. A narrow first scope that you can defend beats a broad one you cannot evidence.
2. Gap analysis. Current state against clauses 4 to 10 and Annex A.
3. Build the AIMS. Policy, roles, risk method, impact assessment method, lifecycle procedures, documentation control.
4. Operate it. Auditors need records, and records need elapsed time. Run the system for at least a few months before Stage 2.
5. Internal audit and management review. Both are mandatory inputs to certification, and both are commonly the reason a first attempt is deferred.
6. Stage 1 audit. Documentation review, readiness check.
7. Stage 2 audit. Implementation and effectiveness. Nonconformities are raised, then closed.
8. Certificate, valid three years, with annual surveillance audits and recertification at year three.

Choose an accredited certification body. An unaccredited certificate is worth little in enterprise procurement, which is usually the reason to certify in the first place.

How it maps to everything else¶

Is it worth it?¶

Certify if: you sell AI capability to enterprises or the public sector, you face EU AI Act exposure and want a defensible governance spine, you already hold 27001 so the marginal cost is moderate, or procurement questionnaires are already asking.

Do not certify yet if: your AI use is internal and low-risk, you have no AI inventory (fix that first), or you would be building the management system purely for the certificate. An AIMS that exists only for the audit generates findings at surveillance and costs more than it returns.

A reasonable middle path: build against 42001's structure, run NIST AI RMF as the risk method, and defer certification until a customer asks. You get the governance benefit immediately and the certificate when it has commercial value.

Documentation links¶

📖 ISO/IEC 42001:2023 - AI management system requirements 📖 ISO/IEC 23894:2023 - guidance on AI risk management 📖 ISO/IEC 22989:2022 - AI concepts and terminology 📖 ISO/IEC 27001:2022 - information security management, the sibling standard 📖 AWS ISO/IEC 42001 certification - provider certification scope and shared responsibility 📖 Microsoft compliance offerings - certification scope per service 📖 Google Cloud compliance resource center - certifications and audit reports