ISO/IEC 42001:2023 is the international standard that sets requirements for an artificial intelligence management system (AIMS) in any organisation that develops, provides or uses AI. It was published in December 2023 as the first edition, is still the current edition in October 2026, and certification against it is voluntary.
This guide is for compliance, risk and technology leads deciding whether to build an AIMS, and for teams preparing for a first certification audit.
What does ISO/IEC 42001:2023 cover and who is it for?
ISO/IEC 42001 was developed by the joint ISO and IEC committee on artificial intelligence, ISO/IEC JTC 1/SC 42. Its page on iso.org describes it as the requirements for establishing, implementing, maintaining and continually improving an AIMS. ISO calls it the world's first AI management system standard.
It applies to organisations of any size and sector, including public bodies and non-profits. The test is your role with AI. You may build AI systems, offer products that contain them, or use AI bought from others. Each role brings different risks, and the standard asks you to define which roles you hold.
On 3 October 2026 iso.org listed the 2023 edition as published, with no revision or amendment shown in its life cycle. Some commentators have reported an early revision. Treat that as unconfirmed until ISO lists a new project.
What does the standard require, clause by clause?
ISO/IEC 42001 uses the same clause 4 to 10 structure as ISO/IEC 27001 and ISO 9001. The AI content sits inside that frame. The table shows what each clause means for AI and the evidence an auditor typically asks for. The right-hand column is AGS's practical reading, not the standard's text.
| Clause | What it asks for in AI terms | Evidence usually asked for |
|---|---|---|
| 4 Context | Your AI roles, interested parties and the scope of the AIMS | AI system inventory, scope statement, issues and interested parties register |
| 5 Leadership | An AI policy and clear accountability for AI | Signed AI policy, roles and responsibilities, management commitment |
| 6 Planning | AI risk assessment, risk treatment and AI system impact assessment, with objectives | Risk register, impact assessments, statement of applicability for the Annex A controls |
| 7 Support | Resources, competence, awareness, communication and documented information | Competence matrix, training records, document control |
| 8 Operation | Running the planned controls across the AI system life cycle | Life cycle records, data management, supplier checks, repeated assessments after changes |
| 9 Performance evaluation | Monitoring, internal audit and management review | Monitoring results, internal audit reports, review minutes |
| 10 Improvement | Nonconformity, corrective action and continual improvement | Corrective action log, AI incident reports |
The annexes hold reference controls and guidance. As with ISO/IEC 27001, you decide which controls apply on the basis of your risk and impact assessments and justify each choice in a statement of applicability.
How is an AI impact assessment different from a risk assessment?
A risk assessment looks at risks to the organisation and its objectives. An AI system impact assessment looks outward, at how a system and its foreseeable uses may affect individuals, groups or society. ISO/IEC 42001 asks for both.
ISO published guidance for the second one in May 2025 as ISO/IEC 42005:2025, AI system impact assessment. It helps you identify, evaluate and document impacts across the life cycle. A credit scoring model, a recruitment screening tool and a chatbot answering customers would each need a different assessment, even inside one company.
How does ISO/IEC 42001 relate to the EU AI Act?
The EU AI Act, Regulation (EU) 2024/1689, is law. ISO/IEC 42001 is a voluntary standard. A certificate does not by itself show that an AI system meets the Act, which has its own obligations and conformity routes.
The Act entered into force on 1 August 2024 and became generally applicable on 2 August 2026. Prohibited practices and AI literacy duties have applied since 2 February 2025, and obligations for general-purpose AI models since 2 August 2025. The high-risk dates moved in 2026.
The AI Omnibus, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moved the high-risk obligations to 2 December 2027 for Annex III use cases, such as employment, education and biometrics. For AI built into products under EU product safety law, listed in Annex I, the date is now 2 August 2028. The European Commission's AI Act page sets out the timeline.
The Commission lists what high-risk systems will need, including risk assessment and mitigation, high-quality datasets, activity logging and documentation. An AIMS gives you a place to run those processes, but you still need to map each legal duty to your role. This is not legal advice. Check your position with a qualified adviser.
How does it fit with ISO/IEC 27001 and other AI standards?
Because the clauses match, many organisations run ISO/IEC 42001 alongside an existing information security system. Document control, internal audit and management review can be shared, while the AI risk, impact and life cycle processes are added. Our ISO/IEC 27001:2022 guide covers the security side.
Two companion standards matter for certification. ISO/IEC 42006:2025, published in July 2025, sets the extra requirements for bodies that audit and certify an AIMS. It builds on ISO/IEC 17021-1. For board-level oversight, our guide to ISO/IEC 38507 on governing the use of AI explains what directors are expected to ask.
Is your organisation ready for an ISO/IEC 42001 audit?
ISO does not certify organisations. Independent certification bodies do, and they may be accredited by national accreditation bodies. Before you book a stage 1 audit, check that you can show these items:
- An inventory of every AI system in scope, including AI features inside bought software.
- A defined role for each system, such as developer, provider or user.
- A signed AI policy and named owners for each system.
- Completed risk and impact assessments, with treatment decisions and a statement of applicability.
- Supplier records for third-party models and AI services, covering data use and change notices.
- At least one internal audit and one management review, with corrective actions closed.
Ask the certification body whether its accreditation covers ISO/IEC 42001 and how it applies ISO/IEC 42006. Agree the scope wording early, because it decides which AI systems the audit samples.
How AGS can help
AGS has two document sets for AI governance, both in editable Microsoft Word.
- ISO IEC 42001-2023 -AI Management System: 43 documents, including an AIMS manual, 14 procedures, an impact assessment form, a statement of applicability and an Annex A controls checklist.
- AI Governance Policy & Management System Package: 57 documents covering seven AI governance areas, each with a policy, procedure, work instruction, checklist, KPIs and risk register.
Frequently asked questions
Is ISO/IEC 42001 certification mandatory?
No. ISO/IEC 42001 is a voluntary standard. Customers or tenders may ask for it, so whether you need a certificate depends on their requirements.
Do high-risk AI Act obligations apply from 2 August 2026?
Not any more. Regulation (EU) 2026/1744 moved them to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products. The Article 50 transparency duties still apply from 2 August 2026, and general-purpose AI model duties have applied since 2 August 2025.
Can a company that only uses AI tools adopt ISO/IEC 42001?
Yes. ISO states that the standard applies to organisations that use AI-based products or services, not only to those that build them.
Will buying documents get an organisation certified?
No. Certification depends on how the AIMS runs and on the certification body's audit findings.
AGS provides independent documentation toolkits. This guide and the referenced kits are not affiliated with, endorsed by or approved by ISO, IEC, the European Commission or any certification body, and they do not guarantee any certification outcome or legal compliance.
Reviewed October 2026. Facts checked against the sources current at publication.
