Key Facts
- Regulator
- ISO/IEC JTC 1/SC 42 (Artificial intelligence), published by ISO and IEC
- Latest version
- ISO/IEC 42001:2023, Edition 1 (Information technology — Artificial intelligence — Management system); status Published
- Effective
- 18 December 2023
- Official text
- www.iso.org ↗
What is ISO/IEC 42001?
ISO 42001, formally ISO/IEC 42001, is the international standard for an artificial intelligence management system (AIMS). ISO and IEC publish it through committee JTC 1/SC 42. It applies to organisations of any size or sector that develop, provide or use AI-based products or services, and certification against it is voluntary.
The current edition is ISO/IEC 42001:2023, Edition 1, Information technology — Artificial intelligence — Management system, published in December 2023. ISO describes it as the first global AI management system standard. The ISO standard page holds the official record.
The standard specifies requirements for establishing, implementing, maintaining and continually improving an AIMS inside an organisation. It is a management system standard, not a standard for specific AI applications. It sets how an organisation governs AI, not how any one model is built.
Why it matters
A customer asks how you govern the AI in your product. You have a draft policy, a model description and one engineer who knows the answer. That is not yet a system anyone can assess.
ISO/IEC 42001 turns that answer into something checkable. Because it is a management system standard, an independent certification body can assess an organisation against it. ISO 42001 certification is optional, and ISO does not carry it out: ISO does not certify organisations.
A policy that no one is accountable for is a document, not a management system.
Certification shows the management system exists. It does not make any single AI system safe or lawful, and ISO says the standard does not replace laws or regulations.
Who it applies to
ISO/IEC 42001 applies to organisations of any size involved in developing, providing or using AI-based products or services. That includes public sector bodies and non-profits as well as software firms. An organisation that neither builds nor uses AI has nothing for an AIMS to govern.
The obligation is voluntary. No one must hold ISO 42001 certification because the standard says so. A customer, tender or board may still ask for it, and that request is where most organisations meet it.
ISO 27001 is the information security management system standard. ISO/IEC 42001 is the equivalent for AI. ISO sells the two together as an "AI and information security management package", which suggests they are commonly paired. If you already hold ISO 27001, the ISO 27001 vault covers the management system you would be extending.
The UK position
No UK statute is cited here as requiring ISO/IEC 42001. The UK government material that references it is voluntary guidance, and two regimes sit near it:
| Regime | Who it affects | Relationship to ISO/IEC 42001 |
|---|---|---|
| DSIT AI Management Essentials (AIME) | UK organisations that want a self-assessment of their AI management practices | Based partly on ISO/IEC 42001. It is not mandatory, gives no certification and does not represent compliance with the standard |
| EU AI Act | UK firms placing AI systems on the EU market | DSIT cites it as one of the three frameworks behind AIME. ISO says ISO/IEC 42001 does not replace laws |
Certification itself is carried out by independent certification bodies, which may be accredited by national accreditation bodies.
For a UK firm of 25 to 250 people, the first encounter is more likely a customer question than a regulator.
Key requirements
ISO/IEC 42001 uses the Plan-Do-Check-Act methodology and manages AI risks and opportunities across the organisation. ISO lists the requirement areas below. Together they are the standard's answer to AI governance.
- Leadership and context. Top management owns the AI management system, and the organisation defines the context in which it uses AI.
- AI policy and objectives. A policy sets the organisation's position on AI, and objectives make it measurable.
- AI risk management. The organisation identifies and treats the risks and opportunities that its AI systems create.
- Data governance and lifecycle controls. Controls cover the data AI relies on and the AI system across its lifecycle.
- Transparency. The organisation can explain what its AI systems do and how they are governed.
- Performance evaluation and continual improvement. The system is monitored, reviewed and improved, which is the Check and Act half of the cycle.
A management system standard sets duties for the organisation. It says nothing about the quality of any particular model.
Related ISO/IEC AI standards
ISO positions ISO/IEC 42001 as the management-system foundation alongside three other standards:
- ISO/IEC 22989 covers AI terminology.
- ISO/IEC 23053 is a framework for machine learning.
- ISO/IEC 23894 gives guidance on AI-related risk management for organisations.
ISO/IEC 42001 sets the requirements. The other three supply vocabulary, structure and risk guidance to work with.
Frequently asked questions
The current published edition is ISO/IEC 42001:2023, Edition 1, titled Information technology — Artificial intelligence — Management system. ISO lists its status as published, with an effective date of December 2023. The ISO page does not state a revision in progress, so check it before you cite the standard in a contract or questionnaire.
ISO 27001 specifies an information security management system. ISO/IEC 42001 specifies an AI management system, covering AI policy, AI risk, data governance and transparency. They are separate standards, but ISO sells them together as an "AI and information security management package", which suggests organisations commonly pair them.
No. ISO says certification for ISO/IEC 42001 is voluntary, and the standard does not replace laws or regulations. A customer or tender may still ask for it, but ISO/IEC 42001 itself creates no legal duty to certify. Whether it is worth holding depends on who is asking you.
Independent certification bodies carry out ISO/IEC 42001 certification; ISO does not certify organisations. These bodies may themselves be accredited by national accreditation bodies. Whoever you choose, check the accreditation it holds and whether the customers asking for ISO 42001 certification will accept its certificates.
No. ISO states that ISO/IEC 42001 does not replace laws or regulations. DSIT cites the EU AI Act as a separate framework behind its AIME tool, and a UK firm placing AI systems on the EU market still has to check the Act's own duties. ISO/IEC 42001 can support AI governance, but it is not a compliance substitute.