Artificial intelligence
ISO/IEC 42001:2023 — Artificial intelligence management system
The first certifiable AI management standard: govern the development and use of AI systems responsibly.
At a glance
- Type
- International standard, certifiable
- Publisher
- ISO / IEC
- Edition
- 2023
- Annex A
- 38 reference controls, 9 domains
70 requirements tracked · 93 shared controls
What is ISO 42001?
Published at the end of 2023, ISO/IEC 42001 is the first certifiable international standard for artificial intelligence management systems (AIMS). It applies to any organisation that develops, provides or uses AI systems.
It follows the common structure of management system standards (clauses 4 to 10), complemented by AI risk assessment and the assessment of the impact of AI systems on individuals and society. Its Annex A offers 38 reference controls, included or excluded in a Statement of Applicability. It is a useful preparation for the AI Act, without conferring a presumption of conformity on its own.
Key requirements
- 1
AI policy and roles
An AI policy approved by top management, with clear roles and responsibilities.
- 2
AI system risks and impacts
Assess AI-related risks and the impact of systems on individuals, groups and society.
- 3
Life cycle and data
Control design, validation, deployment and monitoring, as well as data quality and provenance.
- 4
Information to interested parties and responsible use
Document systems, inform users and govern use.
- 5
Third-party relationships
Allocate responsibilities with suppliers, partners and customers.
Summary written by OK-GRC. The texts of ISO standards are protected by copyright and are not reproduced.
How OK-GRC helps
- ISO 42001 requirements linked to 93 common controls, including 24 AI-specific controls
- An AI usage policy template to tailor with the assistant
- AI risk register and impact assessments in the shared register
- Statement of Applicability and justification of exclusions
- An AI usage training module for your teams
Related frameworks
With ISO 27001 controls in place, your ISO 42001 starting score is about 37 to 42%.
The controls you put in place for ISO 42001 also count for:
Frequently asked questions about ISO 42001
Does ISO 42001 make us compliant with the AI Act?
No. It provides a very useful governance framework, but the presumption of conformity with the regulation will come from the European harmonised standards under development. The two approaches complement each other.
Do we have to develop AI to be concerned?
No. The standard also targets organisations using AI systems provided by others, such as generative assistants or CV screening tools.
Informational content up to date as of October 2026; it does not constitute legal advice. Always check the official texts in force.
Ready to simplify your compliance?
Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.
14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment