- Home
- ISO 42001 consulting
ISO/IEC 42001:2023
ISO 42001 consulting for AI management systems
ISO 42001 is the first international standard for an AI management system (AIMS). It shows customers and regulators that your organisation develops, provides or uses AI in a controlled, accountable way. We implement it with you and prepare you for certification.
- Standard
- ISO/IEC 42001:2023
- Structure
- Clauses 4–10 and Annex A (38 controls)
- Applies to
- Organisations that develop, provide or use AI
- Works with
- ISO 27001, ISO 27701, EU AI Act, NIST AI RMF
What's included
Building an AI management system that passes audit
- AI system inventoryIdentifying every AI system in scope, including third-party tools.
- Role and scopeClarifying whether you act as developer, provider or user of each system.
- AI policy and objectivesA policy leadership can stand behind, with measurable objectives.
- AI risk assessmentRisks to the organisation, assessed and treated with an owner for each.
- AI system impact assessmentEffects on individuals, groups and society, as clause 6.1.4 requires.
- Statement of ApplicabilityAll 38 Annex A controls assessed and justified.
- Data and life-cycle controlsData quality, provenance, testing, deployment and monitoring.
- Supplier assessmentDue diligence and contract terms for third-party AI.
- Internal audit and reviewA full internal audit and a management review.
- Certification supportCertification body selection, Stage 1 and Stage 2 preparation.
Annex A control areas
| Ref | Control area | What it covers |
|---|---|---|
| A.2 | Policies related to AI | An AI policy aligned with business objectives and other policies |
| A.3 | Internal organisation | Roles, responsibilities and reporting of concerns about AI |
| A.4 | Resources for AI systems | Data, tooling, computing, system and human resources |
| A.5 | Assessing impacts of AI systems | Impact assessments on individuals, groups and society |
| A.6 | AI system life cycle | Objectives, design, verification, deployment, operation and monitoring |
| A.7 | Data for AI systems | Data acquisition, quality, provenance and preparation |
| A.8 | Information for interested parties | Documentation and information for users and others affected |
| A.9 | Use of AI systems | Processes and objectives for responsible use |
| A.10 | Third-party and customer relationships | Allocating responsibilities with suppliers and customers |
Integration
Already certified to ISO 27001?
ISO 42001 and ISO 27001 share the same harmonised structure. Your context analysis, leadership commitments, document control, internal audit and management review can all be extended to cover AI rather than duplicated. In practice, this cuts a large share of the effort and lets one certification body audit both standards together.
If you haven't started either, we can plan an integrated management system from day one.
FAQ
ISO 42001 questions
Is ISO 42001 mandatory?
No. ISO 42001 is voluntary. Organisations adopt it because customers, partners and investors increasingly want evidence that AI is being developed and used responsibly, and because it gives AI risk a clear owner and process.
Does ISO 42001 make us compliant with the EU AI Act?
Not on its own. ISO 42001 gives you a management system that supports many of the Act's governance expectations, but the Act sets its own legal obligations depending on your role and the risk level of your AI systems. We map the two so you can see where they overlap and where extra work is needed.
Do we need ISO 27001 first?
No. ISO 42001 can be implemented on its own. If you already have ISO 27001, much of the management system (leadership, risk process, internal audit, management review) can be extended rather than built again.
We only use AI tools, we don't build them. Does it apply?
Yes. ISO 42001 covers organisations that develop, provide or use AI systems. For an organisation that mainly uses third-party AI, the focus is on usage policy, supplier assessment, impact assessment and oversight.
How long does ISO 42001 implementation take?
Typically three to six months to audit readiness, depending on how many AI systems are in scope and whether an existing management system can be extended.
Ready to show your AI is under control?
Tell us where you are today. We'll come back with a clear view of the gaps, the effort involved and a realistic timeline. No obligation.