Skip to content

ISO/IEC 42001 -- AI Management System

What is ISO 42001

ISO/IEC 42001:2023 is the first international standard specifying requirements for an AI Management System (AIMS) — a system for managing AI in an organization. The standard provides a structured framework for the responsible development, deployment, and operation of AI systems.

Why ISO 42001

Regulatory context

ISO/IEC 42001 is an AI management system standard. Its certificate concerns the organisation’s AIMS within a defined scope; it is not a product CE mark or automatic proof of AI Act conformity. Do not describe ISO/IEC 42001:2023 itself as an AI Act harmonised standard without the relevant Official Journal citation. The Commission explains that its goals and definitions differ from the AI Act’s quality-management requirements and that a specific standard was requested for those requirements.

An AIMS can help organise risk management, responsibilities, evidence and improvement. The applicable AI Act duties, product/system conformity route and published harmonised references still need separate assessment.

Business value

  • Customer trust — certification demonstrates a responsible approach to AI
  • Competitive advantage — a relevant certificate can provide a comparable, scoped assurance signal
  • Systematic approach — the standard brings order to AI governance
  • Synergy — easily integrated with ISO 27001 (information security)

Standard structure

ISO 42001 uses the harmonised structure for management system standards. This is an overview of topics; the relationship to NATIVE is our methodological mapping:

ChapterContentRelationship to NATIVE
4. Context of the organizationUnderstanding the environment and stakeholdersL0 — Navigate
5. LeadershipManagement commitment, AI policyL1 — Align
6. PlanningRisk and opportunity managementL1 — Align + L3 — Innovate
7. SupportResources, competence, awarenessL2 — Transform
8. OperationAI system management, impact assessmentL5 — Execute
9. Performance evaluationMonitoring, internal audit, management reviewL4 — Verify
10. ImprovementNonconformities, corrective actions, continual improvementCross-cutting

Key annexes

  • Annex A — Controls for AI
  • Annex B — Implementation guidance
  • Annex C — Potential AI-related organisational objectives and risk sources
  • Annex D — Use of the AI management system across domains or sectors

Path to certification

The durations below are illustrative planning ranges. The certification body determines the audit scope, time, sampling and certification decision; readiness work cannot guarantee a certificate.

Synergy with ISO 27001

If your organization already holds ISO 27001 (Information Security Management System), implementing ISO 42001 is significantly easier — both standards share:

  • The Annex SL structure
  • The approach to risk management
  • Documentation requirements
  • Internal audit processes

We recommend an integrated approach — a single management system covering both standards.

Next steps

Content reviewed: 6 September 2026. Primary sources: ISO/IEC 42001, Commission — standardisation and AI Act, AI Act, GDPR — Art. 35.