What the standard actually asks of you
ISO/IEC 42001 is a management system standard. It asks who does what, when, on what basis, and what record proves it happened. What you end up with is an AI management system, usually shortened to AIMS.
Annex A is normative and sets out reference control objectives and controls across nine areas, from AI policy and internal organisation through the AI system life cycle, data, and third-party relationships. The controls are not exhaustive and not all of them have to be used. You select what your risk treatment requires, design your own where the reference set does not cover you, and record every inclusion and exclusion with justification in a statement of applicability. That document is where most of the argument with a certification body happens.
An accredited certification body conducts the certification audit in two stages and makes the certification decision. I am not that body. My work is implementation and certification readiness: building the system and preparing the organisation for that audit.
Defining the scope of the management system
The first question in any ISO/IEC 42001 project is what the management system covers. Not every AI system in the organisation has to sit inside it. What matters is that the scope is deliberate, that it reflects how the organisation uses AI, and that you can demonstrate control over everything you have claimed.
Scope gets decided against your AI inventory, which means the inventory comes first. Decide scope before you know what is running and you will be rewriting the system three months in.
The scope you present for certification is agreed with the certification body.
Who the standard applies to
ISO/IEC 42001 is a voluntary standard. It covers organisations that develop AI systems and organisations that deploy them. Buying a model from a vendor, running assistants across your workforce, putting agents into a customer facing process: all of these can sit within an AIMS, and which of them do is a scoping decision you make deliberately.
Organisations still rule themselves out, assuming the standard was written for model developers.
ISO/IEC 42001 and the EU AI Act
| ISO/IEC 42001 | EU AI Act |
|---|---|
| A management system standard you choose to adopt | A regulation that applies whether you adopt anything or not |
| Scope defined by your organisation | Obligations depend on the role, the system and the applicable requirements |
| AI risk assessment and AI system impact assessment | Specific legal classifications and obligations under the Regulation |
| Internal audit and management review | Conformity assessment and registration, where required |
| Certification available from an accredited body | Compliance is a legal obligation, not something anyone certifies |
| Continual improvement | Fixed obligations with transition periods |
The AI Act attaches obligations to operators, and distinguishes providers, deployers, importers, distributors, product manufacturers and authorised representatives. Determining which role or roles apply to your organisation, for each system, is an early part of the analysis.
Certification against ISO/IEC 42001 does not demonstrate compliance with the AI Act. A well built AIMS produces much of the evidence the Regulation expects an organisation to hold, and the two remain separate obligations.
Where personal data is involved, a GDPR data protection impact assessment and the AI system impact assessment required by clause 6.1.4 answer different questions about the same system. One governance architecture can carry both, while the obligations under each instrument stay distinct.
Sources: Regulation (EU) 2024/1689 · ISO/IEC 42001:2023. Last reviewed: August 2026.
Why the documentation pack does not get you there
The packs on the market do what they promise. An AI policy, procedures, an impact assessment template, a register with columns already laid out for owner, intended use, lifecycle stage and review date.
Then you open the impact assessment template and have to decide who fills it in and when. Before procurement signs the contract? After the vendor is chosen, when changing direction costs money? At design, for the systems you build in house?
The pack cannot answer that, because it does not know how a use case becomes a running system in your organisation. Naming that step, and its owner, is the work.
Common problems and the controls that answer them
| What is going wrong | What the system has to carry |
|---|---|
| People use AI tools nobody approved | AI inventory, and an intake route easier than going around it |
| Assistants and copilots across the workforce | Use case classification and acceptable use, placed in the joiner process |
| Vendors whose models you cannot inspect | Supplier controls, third-party AI risk, contractual limits on data use and model training |
| Data going into models that should not | Controls at the point of entry, not in a policy |
| Outputs that are wrong in ways nobody catches | Monitoring, thresholds, and a named person who looks |
| Nobody knows who approved a use case | Roles, approval workflow, decision records |
| An incident with no owner | AI incident management wired into the incident process you already run |
| Teams that never saw the requirement | Competence, and evidence that it reached the people who build |
| Rules that changed and nobody noticed | Monitoring of legal requirements, management review |
Integrating ISO/IEC 42001 with ISO/IEC 27001 and what you already run
If you already run ISO/IEC 27001, most of the machinery exists: risk methodology, supplier controls, incident handling, internal audit, management review. Both standards share the same high level structure, so the clauses line up. Organisations working under NIS2, DORA or NIST AI RMF have more of it again. What is missing is specific to AI, and it is a short list.
People skip governance that sits beside their work, because compliance costs more than avoidance. Wire it into what they already do and the question stops coming up.
→ Services and how they are scoped
ISO/IEC 42001 questions people actually ask
Does ISO/IEC 42001 apply to us if we only use third-party AI?
Yes. The standard covers organisations that deploy AI as well as those that develop it. What sits inside your AIMS is a scoping decision you make.
What is the difference between ISO/IEC 42001 and the EU AI Act?
The standard is voluntary and the scope of the AIMS is defined by the organisation. Certification can be pursued through an accredited certification body once the management system is ready for audit. The AI Act is binding, attaches obligations to your role and to the system concerned, and nobody certifies compliance with it.
Does ISO/IEC 42001 certification make us AI Act compliant?
No. They are separate instruments. A well built AIMS produces much of the evidence the Regulation expects you to hold, which is a different statement.
Is ISO/IEC 42001 mandatory?
ISO/IEC 42001 is a voluntary standard. It can nevertheless become a practical requirement through contracts, procurement or commitments the organisation has already made.
Do we have to implement every control in Annex A?
No. Annex A is normative, but the controls in it are not exhaustive and not all of them have to be used. You select controls against your risk treatment, add your own where the reference set does not cover you, and justify inclusions and exclusions in the statement of applicability.
Can it be integrated with ISO/IEC 27001?
Yes. For organisations already operating an ISO/IEC 27001 based ISMS, integrating the two reduces duplication and aligns risk methodology, supplier controls, incident handling, internal audit and management review.
How long does implementation take?
It depends on scope, on the state of your existing management systems, and on how quickly the organisation makes people and documents available. For a defined scope in an organisation that already runs a certified management system, three to six months is realistic.
Can you certify us?
No. Certification is performed by an accredited certification body. I prepare organisations for that audit.
What does ISO/IEC 42001 implementation cost?
It depends on the scope of the management system, how many AI systems sit inside it, and how much of your existing governance can be reused. I price defined projects at a fixed fee once the scope is agreed, and fractional roles at a monthly rate. The first conversation is free and I will tell you if the work is smaller than you think.
Do companies that only use ChatGPT and Copilot fall under the EU AI Act?
Possibly, as deployers. Obligations attach to the role you hold for a given system and to how that system is used, not to whether you built it. As a deployer you also carry the AI literacy obligation under Article 4.
Do AI agents need something different?
Yes. Governance for AI agents and agentic systems
Where to start
Take one file from whatever documentation you already have. Name the step in your process where it gets produced, and name the person who owns that step. If you cannot do both, that is your first project.