Menu

ISO/IEC 42001 and AI Management Systems: The Complete Guide

Key Takeaways

What is ISO/IEC 42001:2023?

ISO/IEC 42001:2023 is an international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS). ISO describes it as the world's first AI management system standard.

It is a joint publication of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The first edition was published on December 18, 2023. The responsible committee is ISO/IEC JTC 1/SC 42, Artificial Intelligence. The public catalog page lists the paid standard text as 51 pages.

This guide does not quote that paid text (ISO/IEC 42001:2023; IEC publication record).

ISO says the standard sets out a structured way to manage risks and opportunities associated with AI, balancing innovation with governance. It addresses unique challenges that AI poses, including ethical considerations, transparency, and continuous learning.

ISO also lists benefits that include a framework for managing risk and opportunities, a way to demonstrate responsible use of AI, and support for traceability, transparency, and reliability (ISO/IEC 42001:2023; ISO, AI management systems).

ISO classifies ISO/IEC 42001 as a management system standard, not a standard that describes the internals of one model or application. Implementing it means putting policies and procedures in place for the governance of AI across an organization, using the Plan-Do-Check-Act method (ISO/IEC 42001:2023).

What is an AI management system?

ISO defines an AI management system, as specified in ISO/IEC 42001, as a set of interrelated or interacting elements of an organization intended to establish policies and objectives, as well as processes to achieve those objectives, in relation to the responsible development, provision or use of AI systems.

The same definition appears on Microsoft's public compliance page for the standard (ISO/IEC 42001:2023; Microsoft Learn, ISO/IEC 42001:2023).

ISO's explainer describes an AI management system in practical terms as a structured set of policies, processes and controls that help an organization govern how AI systems are designed, developed, deployed and used.

In that account, an AIMS helps an organization define responsibilities for AI use, identify and assess AI-related risks, support transparency and accountability, manage data quality and system performance, address ethical, legal and societal concerns, and monitor AI systems throughout their lifecycle (ISO, ISO/IEC 42001 explained).

How does the Plan-Do-Check-Act cycle work in ISO/IEC 42001?

ISO says that implementing this management system standard means putting policies and procedures in place for the sound governance of an organization in relation to AI, using the Plan-Do-Check-Act methodology.

On its AI management systems page, ISO says ISO/IEC 42001 is built around a Plan-Do-Check-Act process of establishing, implementing, maintaining and continually improving artificial intelligence.

ISO gives three reasons that cycle matters: it helps an organization recognize AI's value for growth and put the right oversight in place; it lets the organization adapt as the technology develops; and it encourages the organization to conduct AI risk assessments and define AI risk treatment activities at regular intervals (ISO/IEC 42001:2023; ISO, AI management systems).

ISO's public package description of ISO/IEC 42001 says the standard covers leadership, planning, support, operation, performance evaluation, and continual improvement across the AI lifecycle.

ISO's explainer lists related requirement themes that include leadership and organizational context, AI policy and objectives, risk management for AI systems, data governance and system lifecycle controls, transparency and information provision, performance evaluation and monitoring, and continual improvement (ISO, Responsible AI governance and impact standards package;

ISO, ISO/IEC 42001 explained).

Those public themes match the Plan-Do-Check-Act pattern ISO assigns to the standard:

Public implementation guidance published by AWS on May 13, 2025 discusses ISO/IEC 42001:2023 using that same clause numbering. It describes risk assessment under clause 6.1, operational controls under clause 8.2, and continuous monitoring, documentation and improvement under clauses 9 and 10.

It also refers to clauses 4 and 5 when it discusses organizational governance (AWS Security Blog, AI lifecycle risk management). The official ISO product page does not republish a clause table.

Who does ISO/IEC 42001 apply to?

ISO says the standard is for organizations of any size involved in developing, providing, or using AI-based products or services. It is applicable across industries and is relevant for public sector agencies as well as companies and nonprofits. ISO also says the standard is designed to apply across various AI applications and contexts (ISO/IEC 42001:2023).

IEC's publication record says the document is intended for use by an organization providing or using products or services that utilize AI systems. It is intended to help the organization develop, provide or use AI systems responsibly, pursue its objectives, and meet applicable requirements and obligations related to interested parties.

IEC says it is applicable to any organization, regardless of size, type and nature, that provides or uses products or services that utilize AI systems (IEC, ISO/IEC 42001:2023).

ISO's explainer adds that this includes organizations that develop AI systems, integrate AI into products or services, use AI for decision-making or automation, or manage AI systems provided by third parties. Examples it names include technology companies, financial institutions, healthcare providers, manufacturers, public authorities and service organizations (ISO, ISO/IEC 42001 explained).

ANAB, which accredits certification bodies for this standard, notes that the design and implementation of an AIMS is influenced by the organization's needs and objectives, processes, size, structure, and role, for example as a producer, developer or provider, or user (ANAB, ISO/IEC 42001 accreditation).

How is ISO/IEC 42001 structured?

ISO lists ISO/IEC 42001:2023 as a Type A management system standard that uses the Harmonized Structure. A Type A management system standard contains requirements against which an organization can claim conformance. ISO says certification can take place only against a document that contains requirements.

Harmonized Structure standards share the same structure and many of the same terms and definitions, which helps an organization operate one integrated management system that can meet two or more management system standards at the same time (ISO, Management System Standards list).

ISO's Joint Technical Coordination Group on management system standards says the Harmonized Structure includes identical clause numbers in the same sequence, identical clause titles, common terms and core definitions, and shared core text (ISO JTCG, Exploring MSS). Because ISO lists ISO/IEC 42001 as a Harmonized Structure Type A standard, its requirement clauses follow that shared sequence.

In Harmonized Structure standards, the management-system requirements sit in clauses 4 through 10. The official ISO/IEC 42001 product page does not republish that clause table, and this guide does not quote the paid standard.

ISO's public materials describe the requirement areas as organizational context, leadership, planning, support, operation, performance evaluation, and continual improvement, including across the AI lifecycle (ISO, ISO/IEC 42001 explained; ISO, Responsible AI governance and impact standards package).

UKAS describes the standard as supporting responsible AI governance across areas such as leadership, risk management, operational controls, performance evaluation and continual improvement (UKAS, Artificial Intelligence Management Systems).

What are Annex A controls in ISO/IEC 42001?

The official ISO product page for ISO/IEC 42001:2023 does not publish an annex list or a control count. This guide therefore does not state a control count, and it does not reproduce any annex text from the paid standard.

Public implementation guidance from AWS, published May 13, 2025, discusses Annex A controls and a Statement of Applicability under ISO/IEC 42001. In that account, an organization identifies and assesses AI risks, then implements operational controls and records which reference controls apply. AWS uses Annex A identifiers in worked examples.

Those examples are AWS's public commentary, not a substitute for the standard itself (AWS Security Blog, AI lifecycle risk management).

Separately, ISO's explainer says the standard helps organizations manage risks such as bias, safety, security and misuse. That statement describes the standard as a whole. It does not, on its own, itemize Annex A (ISO, ISO/IEC 42001 explained).

How does ISO/IEC 42001 govern the AI system lifecycle?

ISO's explainer says an AI management system helps an organization monitor AI systems throughout their lifecycle. ISO's package description says ISO/IEC 42001 covers leadership, planning, support, operation, performance evaluation, and continual improvement across the AI lifecycle (ISO, ISO/IEC 42001 explained; ISO, Responsible AI governance and impact standards package).

AWS's May 13, 2025 guidance describes AI governance as spanning the entire AI lifecycle, including setting intended purpose, managing data, models and deployment risks, designing for explainability, bias mitigation and traceability, and establishing accountability, monitoring and decommissioning practices.

Citing ISO/IEC 22989:2022, that AWS article lists an example lifecycle that may include inception; design and development; verification and validation; deployment; operation and monitoring; re-evaluation; and retirement. AWS also notes that an organization may define its lifecycle stages differently to suit its context (AWS Security Blog, AI lifecycle risk management).

This guide has not reproduced the paid text of ISO/IEC 22989.

ISO/IEC 42005:2025, the companion guidance on AI system impact assessment, recommends performing assessments throughout the AI system lifecycle, from design and development to deployment and post-market monitoring, and updating them as needed (ISO/IEC 42005:2025).

How should an organization assess AI risks and AI system impact?

ISO says ISO/IEC 42001 provides an integrated approach to managing AI projects, from risk assessment to effective treatment of those risks. On its AI management systems page, ISO says the Plan-Do-Check-Act approach encourages organizations to conduct AI risk assessments and define AI risk treatment activities at regular intervals (ISO/IEC 42001:2023; ISO, AI management systems).

Two related ISO/IEC documents give additional public guidance:

ISO's package page says the two standards are designed to work together. ISO/IEC 42001 establishes an organization-wide management system for AI. ISO/IEC 42005 offers a detailed method for assessing the effects of individual AI systems.

ISO says ISO/IEC 42001 makes impact assessments a consistent part of AI governance, while ISO/IEC 42005 is meant to make those assessments thorough and systematic (ISO, Responsible AI governance and impact standards package).

AWS's public guidance describes a similar split inside ISO/IEC 42001:2023 itself: identify and assess AI risks (clause 6.1), implement operational controls (clause 8.2), and monitor, document and improve those controls and the AI system (clauses 9 and 10).

It also describes AI impact assessments as complementary to baseline risk assessments in higher-impact use cases, with a focus on societal, ethical and legal effects (AWS Security Blog, AI lifecycle risk management).

How does ISO/IEC 42001 relate to ISO/IEC 27001?

ISO/IEC 27001:2022 is ISO's Type A Harmonized Structure standard for information security management systems. ISO/IEC 42001:2023 is ISO's Type A Harmonized Structure standard for AI management systems.

Because both use the Harmonized Structure, ISO says an organization may operate a single integrated management system that meets more than one management system standard at the same time (ISO, Management System Standards list).

ISO also places ISO/IEC 42001 in the same family of management system standards as ISO/IEC 27001 when it explains why a management system approach matters for AI. That comparison is about method (policies, procedures, Plan-Do-Check-Act, and continual improvement), not about treating the two standards as substitutes (ISO, AI management systems).

An information security management system is not, by itself, an AI management system, and an AIMS is not, by itself, an information security management system.

How does ISO/IEC 42001 relate to the NIST AI RMF?

The NIST AI Risk Management Framework (AI RMF 1.0) is voluntary guidance from the U.S. National Institute of Standards and Technology. NIST released it on January 26, 2023 for organizations designing, developing, deploying or using AI systems.

NIST says the framework is intended to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems (NIST, AI Risk Management Framework; NIST, January 26, 2023 announcement).

NIST divides the document into two parts. The first part discusses how organizations can frame AI risks and outlines characteristics of trustworthy AI systems. The second part, the core, describes four functions: govern, map, measure and manage. NIST also released a companion playbook. On July 26, 2024, NIST released NIST AI 600-1, a generative AI profile.

NIST's framework page notes that AI RMF 1.0 is being revised as part of the White House AI Action Plan (NIST, January 26, 2023 announcement; NIST, AI Risk Management Framework).

The NIST AI RMF is not a certifiable ISO management system standard. AWS's public ISO/IEC 42001 guidance treats the NIST AI RMF as one structured method organizations may use when they identify, evaluate and mitigate AI risks inside a broader AI management system (AWS Security Blog, AI lifecycle risk management). Using one does not automatically satisfy the other.

How does ISO/IEC 42001 relate to the EU AI Act?

The EU Artificial Intelligence Act is Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024. It was published in the Official Journal on July 12, 2024 and entered into force on August 1, 2024. It is binding law in the EU, not a voluntary management system standard (EUR-Lex, Regulation (EU) 2024/1689; European Commission, AI Act enters into force).

The Commission's announcement describes a risk-based framework. Most AI systems, such as spam filters, are treated as minimal risk and face no obligation under the Act, though companies may adopt codes of conduct voluntarily. Some systems have specific transparency duties, such as informing users that they are interacting with a chatbot.

High-risk systems, such as certain medical or recruitment systems, must meet stricter requirements that the Commission summarizes as including risk-mitigation systems, high-quality data sets, clear user information and human oversight. Some practices, such as social scoring by governments or companies, are treated as unacceptable risk and are banned (European Commission, AI Act enters into force).

ISO says ISO/IEC 42001 does not replace laws or regulations. Instead, it provides a management framework that helps organizations meet compliance obligations more effectively.

ISO's AI management systems page also says the standard can support better regulatory compliance through controls, audit schemes and guidance that are consistent with emerging laws and regulations (ISO, ISO/IEC 42001 explained; ISO, AI management systems).

That is alignment and process support, not a legal finding. Implementing or certifying an AIMS against ISO/IEC 42001 does not, by itself, mean an organization complies with the EU AI Act. Legal obligations depend on the Act, its staged application dates, and the organization's actual systems and role.

How does voluntary third-party certification work?

Certification to ISO/IEC 42001 is voluntary. ISO does not certify organizations. Certification is carried out by independent certification bodies, which may be accredited by national accreditation bodies (ISO, ISO/IEC 42001 explained).

Because ISO/IEC 42001 is a Type A management system standard, an organization can claim conformance with it and can seek third-party certification (ISO, Management System Standards list).

Two other documents shape how that certification is delivered:

UKAS describes accredited certification as an independent assessment of an organization's AI management system by a competent and impartial certification body.

ANAB publishes an accreditation program for ISO/IEC 42001 certification bodies that uses ISO/IEC 17021-1 together with ISO/IEC 42001:2023 and ISO/IEC 42006:2025 (UKAS, Artificial Intelligence Management Systems; ANAB, ISO/IEC 42001 accreditation).

Microsoft's public compliance page is an example of how a large provider describes third-party ISO/IEC 42001 audits of its own AI services. Microsoft also says a customer that wants certification for its own implementation remains responsible for engaging an assessor to evaluate the controls and processes inside that customer's organization (Microsoft Learn, ISO/IEC 42001:2023).

If an organization wants independent confirmation that its AIMS meets ISO/IEC 42001:2023, it should ask a certification body which accreditation body has accredited it for this standard, then confirm that scope on the accreditation body's register.

ISO's public page for ISO/IEC 42001 points to a wider set of AI standards. It names ISO/IEC 22989:2022, which establishes terminology for AI and describes concepts in the field; ISO/IEC 23053, which establishes an AI and machine learning framework for describing a generic AI system that uses machine learning; and ISO/IEC 23894:2023, which provides guidance on AI-related risk management.

ISO contrasts those documents with ISO/IEC 42001, which is the management system standard (ISO/IEC 42001:2023).

ISO/IEC 22989:2022 was published on July 19, 2022. ISO says it can be used in the development of other standards and to support communications among interested parties, and that it applies to all types of organizations, including commercial enterprises, government agencies and not-for-profit organizations (ISO/IEC 22989:2022).

Two later documents complete the public picture around an AIMS:

ISO/IEC 42005 also says it complements ISO/IEC 38507, which addresses AI governance (ISO/IEC 42005:2025).

What are practical first steps toward an AI management system?

ISO's explainer lists practical first steps that help an organization strengthen AI governance even before a full implementation:

ISO says these steps help build the foundations of an AI management system (ISO, ISO/IEC 42001 explained).

Help applying that process to a real workflow, when someone wants it, is AI consulting.

Can puna.one certify ISO/IEC 42001?

No. puna.one does not hold this certification and does not issue it. Only an independent certification body can certify an organization to ISO/IEC 42001, and accredited certification depends on the rules in ISO/IEC 17021-1 and ISO/IEC 42006.

References

Guide only. puna.one does not hold, and this page does not imply, any certification, attestation or audit report for this framework.

Book a consultation

Related