ISO 42001: How to Certify an AI Management System
What do ISO/IEC 42001:2023 requirements cover, and what does this guide answer?
ISO/IEC 42001:2023 (the international standard for artificial intelligence management systems) specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system (AIMS). It is the first certifiable management system standard specifically addressing responsible AI governance.
The standard follows the High Level Structure shared by all recent ISO management system standards, so its clauses for context, planning, support, performance evaluation, and improvement mirror those of ISO 9001 and ISO 27001. This alignment makes it practical to integrate an AIMS with an existing information security management system and to reuse documentation already developed for ISO 27001.
Building an AIMS starts with defining the scope and AI policy, then conducting AI impact assessments and risk management across the organisation's AI systems. Annex A of the standard provides a catalogue of controls specific to AI systems that the organisation selects based on its risk assessment. Clause 9 requires monitoring, measurement, and internal audits.
This guide covers the four main implementation steps and explains how AIMS software addresses each clause.
How do you define the scope and AI policy under ISO 42001?
ISO/IEC 42001:2023 clause 4 requires the organisation to understand its context: the internal and external factors that affect its AI activities, and the expectations of interested parties (employees, customers, regulators, affected communities). The scope of the AIMS defines which AI systems and activities are included.
Clause 5.2 requires the top management to establish an AI policy. The policy must commit the organisation to responsible development and use of AI, provide a framework for setting objectives, and commit to continual improvement. Unlike a general quality or security policy, the AI policy must address the specific concerns raised by AI systems: fairness, transparency, safety, privacy, and human oversight.
AIMS software provides a structured space for the scope statement, the AI policy, and the register of AI systems in scope. Keeping the AI system inventory up to date is non-trivial: new AI features are deployed frequently, and each addition to the scope requires a corresponding update to the impact assessment register.
How do AI impact assessment and risk management work under ISO 42001?
ISO/IEC 42001:2023 clause 6.1 requires the organisation to identify risks and opportunities related to its AI systems, conduct AI risk assessments at planned intervals and whenever significant changes occur, and plan actions to address those risks. AI risks include bias, lack of explainability, safety failures, privacy violations, and misuse.
Annex B of the standard provides guidance on AI system impact assessment, which evaluates the potential effects of an AI system on individuals, groups, and society. The impact assessment considers the context of deployment, the vulnerability of affected individuals, the degree of human oversight, and the severity of potential harm. Its outputs inform the selection of controls from Annex A.
AIMS software structures the risk assessment and impact assessment in linked records, so that each AI system has a documented risk profile, a set of selected controls, and a record of how impact assessment findings influenced those selections. For the EU AI Act, the complementary regulation to ISO 42001 for AI systems, the same impact assessment record can support the conformity assessment required under the regulation.
What are the controls specific to AI systems under ISO 42001?
Annex A of ISO/IEC 42001:2023 provides a reference set of controls across domains including: AI policy and governance, AI risk management, data management, AI system lifecycle (design, development, testing, deployment, decommission), AI system transparency and explainability, accountability, and human oversight. The organisation selects applicable controls based on its risk and impact assessment, and documents its selection in a Statement of Applicability.
The controls differ materially from ISO 27001 controls in that they address AI-specific concerns such as model bias monitoring, training data quality, explainability requirements, and mechanisms for human intervention when an AI system behaves unexpectedly. An organisation implementing both ISO 42001 and ISO 27001 will find that some controls are complementary and others are distinct.
AIMS software maintains the Annex A control register, links each selected control to the risk or impact that justifies its selection, and records evidence of implementation. For ISO 27001, the complementary standard to ISO 42001 for AI system security, a shared platform avoids duplicating controls that appear in both standards.
How does AI management software cover ISO 42001:2023 requirements?
An AIMS software tool structured around ISO/IEC 42001:2023 provides dedicated modules for: AI system inventory and scope management, AI policy documentation, AI risk and impact assessment, Annex A control register and Statement of Applicability, AI system lifecycle documentation, monitoring and measurement, internal audit management, nonconformity and corrective action, and management review preparation.
The Optivalue.ai platform operates 85 specialised agents (72 business agents, 12 sector agents, and 1 librarian agent, as documented in the platform's own product description [lu: iso-42001-software.com/en/index.md]), which train on the organisation's AI governance documents to cross-reference each clause and control against actual evidence. The platform also supports organisations preparing for the EU AI Act, so that a single compliance layer covers both the ISO 42001 certification requirements and the regulatory conformity assessment.
The key selection criterion is whether the software maintains the AI system inventory dynamically, so that as new AI features are deployed, the compliance layer remains current rather than trailing behind operations.
See how Optivalue.ai guides your ISO 42001 AIMS. Book a demonstration
Frequently asked questions
What is ISO/IEC 42001:2023 and who should implement it?
ISO/IEC 42001:2023 is the first international standard for AI management systems, published in 2023 by the International Organization for Standardization and the International Electrotechnical Commission. Organisations that develop, deploy, or use AI systems and wish to demonstrate responsible AI governance, satisfy customer requirements, or prepare for regulatory requirements such as the EU AI Act should consider implementing it.
What is the difference between ISO 42001 and ISO 27001?
ISO 27001 covers the management of information security risks across all information assets. ISO 42001 focuses specifically on AI systems, addressing risks and responsibilities that are distinctive to AI: bias, transparency, human oversight, and the AI system lifecycle. The two standards are complementary and share the same High Level Structure, making integrated implementation straightforward.
Does ISO 42001 satisfy EU AI Act requirements?
ISO 42001 and the EU AI Act are distinct requirements. The EU AI Act is binding regulation for certain AI systems placed on the EU market; ISO 42001 is a voluntary certifiable standard. Implementing ISO 42001 may support compliance with the EU AI Act by providing a documented management framework, but it does not automatically satisfy the Act's conformity assessment requirements. Organisations should verify which requirements apply to their specific AI systems.
What is a Statement of Applicability under ISO 42001?
A Statement of Applicability (SoA) is a document that lists the controls from Annex A of ISO/IEC 42001:2023, states whether each control is applicable to the organisation, and justifies any exclusions. It is a required output of the risk assessment process under clause 6.1 and is typically reviewed by certification auditors to verify that the control selection is justified.
How does the AI impact assessment under ISO 42001 differ from a data protection impact assessment?
An AI impact assessment under ISO 42001 evaluates the broader societal and individual impacts of an AI system, including bias, safety, and transparency concerns, across all affected parties. A data protection impact assessment focuses specifically on privacy and personal data processing risks under applicable data protection law. The two assessments serve different purposes and may be conducted in parallel for AI systems that process personal data.
<!-- JSON-LD -->
Back to top