Explainer
ISO 42001 is the first international management system standard for artificial intelligence, and it is fast becoming the thing procurement teams ask for. Here is what it contains, what certification involves, what it costs and when it is worth doing rather than simply aligning to.
By Christopher Fagan, Managing Partner, PEF Consulting Partners
ISO/IEC 42001, published at the end of 2023, sets out the requirements for an AI management system: the policies, roles, processes and controls an organisation uses to develop, provide or use AI responsibly. It follows the same structure as ISO 27001 for information security and ISO 9001 for quality, which means organisations that already run one of those will recognise the shape: context and scope, leadership, planning, support, operation, performance evaluation and improvement, plus an annex of specific controls. It applies to any organisation that builds AI, buys it or uses it, and it is certifiable by accredited bodies.
Underneath the management system language the standard asks for a handful of concrete things. A scope that says which AI systems and uses are covered. An AI policy approved by leadership. Named roles with authority. An inventory of AI systems. Risk assessments and AI impact assessments for each system, looking at the effect on people and society as well as the organisation. Controls for the AI lifecycle: data quality and provenance, development and testing, deployment, monitoring and retirement. Supplier and third party management for AI you buy. Transparency and communication with the people affected. Competence and awareness for staff. And the evidence trail, internal audit and management review that let an external auditor check all of it is happening.
Certification follows the familiar two stage audit: a documentation review, then an on site or remote assessment of whether the system operates as described, followed by annual surveillance and recertification every three years. For a mid sized organisation the path from standing start to certificate is usually six to twelve months. Certification body fees typically run from the low tens of thousands of pounds over the three year cycle, and the larger cost is internal: the time to build the inventory, run the assessments and write the controls into how teams work. Organisations that already hold ISO 27001 can usually integrate the two and save a large part of the effort.
Certify if you sell AI enabled products or services to large customers, operate in a regulated sector, bid for public sector work or have EU exposure under the AI Act, because in each case somebody will ask and a certificate ends the conversation. Align without certifying if you are a deployer using AI internally, because the structure gives you a sound governance framework at a fraction of the cost, and you can certify later if a customer requires it. The mistake is to do neither and write a policy instead; the second mistake is to certify a paper system that the teams building and using AI never see.
ISO 42001 does not make you compliant with the EU AI Act or UK GDPR, but it is the closest management system standard to both and produces most of the evidence they want. It sits naturally alongside ISO 27001 for security and ISO 27701 for privacy, and it maps well to the NIST AI risk management framework for organisations with US customers. The practical approach is one governance framework, built once, that answers the standard, the regulators and the procurement questionnaires together.
Related reading: a practical AI governance framework, the EU AI Act for UK companies, AI readiness, governance and implementation consultancy, the free AI policy template.
The international standard for an artificial intelligence management system, published in 2023. It specifies how an organisation should govern the development, provision and use of AI, following the same structure as ISO 27001 and ISO 9001, and it can be certified by accredited bodies.
Nobody is legally required to hold it. It is most valuable for organisations that build AI into products, sell to large or regulated customers, bid for public contracts or have EU AI Act exposure. Internal users of AI usually gain enough by aligning to it without certifying.
Six to twelve months for a mid sized organisation starting from little, less for one that already runs ISO 27001 and can extend its management system. The audit itself is a small part of the time; building the inventory, assessments and controls is most of it.
Not fully, but much of the evidence overlaps: risk management, data governance, documentation, human oversight and monitoring. A certified organisation will have most of what the Act requires for high risk systems, but the Act has its own specific obligations and conformity assessment.
If you are weighing up ISO 42001 and want an honest view on whether to certify or align, a short confidential conversation will give you one.