Why the standard exists
Before ISO 42001, AI governance was a workaround. Most teams stretched ISO 27001 over anything AI-adjacent and hoped no one pulled the thread. Some bolted on ISO 27701 for privacy. There was usually also a one-page "responsible AI" policy a committee had drafted in 2023 and quietly never updated. Then late 2024 happened. Procurement teams started writing "AI-specific certification" into their RFPs. Nobody had one. ISO 42001 arrived just in time to be the answer.
Publication date: December 2023 [1]. Certifications followed through 2024 and 2025. Schellman became the first ANAB-accredited body in 2024. BSI became the first UKAS-accredited body. DNV, SGS, and TÜV SÜD followed shortly after [4]. The very first organization in the world to certify was KPMG Australia, audited by BSI; a small fact that surprises people who expected a tech company to be first. Adoption built slowly. Roughly 16 AI companies had certified by mid-2025. By the time BCG announced on January 27, 2026 [5], the global count had crossed 100. In regulated industries and European procurement, "are you 42001 certified or on the path" is now a standard RFP question.
What is inside the document
The shape of the document is familiar. Ten clauses, with scope and normative references at the front, then the substance: leadership, planning, support, operation, performance evaluation, improvement. Anyone who has implemented ISO 27001 will recognise the bones immediately. Most of that scaffolding is reusable. What makes 42001 a real new standard rather than a 27001 rebrand is in the annexes, which is where the AI-specific obligations live.
| Part | Contents |
|---|---|
| Clauses 4–10 | The management system itself: leadership, risk planning, operation, evaluation, improvement. Structure is aligned with the ISO High-Level Structure used by every modern ISO management standard. |
| Annex A | Reference controls, grouped into categories that cover AI policy, internal organization, AI resources, AI impact assessment, AI lifecycle, data for AI, information for third parties, use of AI systems, and third-party / customer relationships. |
| Annex B | Implementation guidance for each Annex A control. Read this if you want to know what "good" looks like in practice. |
| Annex C | Catalogue of AI-related risk sources and objectives the management system is expected to address. |
| Annex D | Explains how ISO 42001 relates to other management systems (ISO 27001, ISO 9001, etc.), useful when you are mapping existing controls to the new standard. |
Inside an AI Management System
AIMS is the term the standard defines. It is not software. It is not a platform feature. It is a documented system of policies, processes, and evidence that describes how the organization governs AI across its full lifecycle: supplier selection, data acquisition, design, deployment, monitoring, decommissioning. The lifecycle scope is the part teams underestimate.
In every production audit we have heard about, three artefacts show up. A written AI policy with named owners. An inventory of AI systems in use, which absolutely must include the third-party AI now embedded in nearly every SaaS contract (this is the part teams forget). And an evaluation cadence that reruns risk and performance checks on a fixed schedule. The standard formalises all of this as clauses. The language will look familiar to anyone with 27001 audit experience.
The certification path, end to end
- 01
Readiness assessment (typically 1–3 months)
A gap analysis against the clauses and Annex A controls. Most organizations discover that the policy exists but the inventory does not.
- 02
Stage 1 audit, documentation review (4–6 weeks)
An accredited certification body reviews your AIMS documentation and flags missing evidence.
- 03
Stage 2 audit, implementation review (2–3 months)
Auditors sample controls in operation. The inventory must match reality, with change logs. This is where programs that skipped the inventory fail.
- 04
Surveillance audits (annually) and recertification (every 3 years)
Certification is not a one-time event. It has the same ongoing cost structure as ISO 27001.
How it sits beside NIST AI RMF and the EU AI Act
ISO 42001 and NIST AI RMF are often pitched as competitors. They are not. ISO 42001 is the management system: structure, roles, meeting cadences, documentation, audit trail. NIST AI RMF is what you do inside that system to assess and manage risk for any specific AI use case, using the GOVERN, MAP, MEASURE, MANAGE functions [6]. NIST publishes a crosswalk mapping its framework to ISO 42001. Organizations running both usually write a combined control-mapping document. The work takes about two days once the ISO 42001 scope is set.
The EU AI Act is the regulatory layer above both. ISO 42001 certification on its own does not satisfy EU AI Act compliance. But a working AIMS maps cleanly to most of the high-risk-system obligations. The Cloud Security Alliance published a January 2025 analysis walking through where the two frameworks help and where they do not [7].
ISO/IEC 42001:2023, the common questions
-
What is ISO/IEC 42001:2023?
It is the international standard auditors use to certify that an organization governs its AI properly. ISO and IEC published it in December 2023. The thing being certified is the AIMS, which is short for AI Management System. That bundle includes the policies, named owners, inventory, and review cadences your auditor will sample. If you have done ISO 27001, the management-system shape will look familiar. If not, expect 6 to 12 months of work. -
Who is certified against ISO 42001?
As of April 2026, you can verify ten named-and-public certifications. AWS. IBM (Granite models specifically). BCG. CrowdStrike. CM.com. Swimlane. Meltwater. Vanta. Kandji. Mimecast. The historical first was KPMG Australia, audited by BSI. BCG announced on January 27, 2026 that it had cleared the bar in the first hundred globally certified. -
Who can issue ISO 42001 certifications?
Only an accredited certification body can issue a valid certificate. Schellman was the first ANAB-accredited body, in 2024. BSI was the first UKAS-accredited. The other major options are DNV, SGS, and TÜV SÜD. Verify accreditation directly with ANAB (US), UKAS (UK), or RvA (Netherlands) before signing the engagement letter. Accreditation is the part that makes the certificate buyable in procurement. -
How does ISO 42001 differ from NIST AI RMF?
They cover different layers. ISO 42001 is the management system: the structure, roles, processes, and documentation the auditor will sample. NIST AI RMF is the risk-assessment work done inside that system on a specific AI use case, using GOVERN, MAP, MEASURE, MANAGE. NIST publishes an explicit crosswalk to ISO 42001. Most organizations running both end up with one combined control-mapping document. About two days of work, once the ISO 42001 scope is set. -
How long does ISO 42001 certification take?
Six to twelve months, end to end. The readiness assessment runs 1 to 3 months. Stage 1, the documentation review, is 4 to 6 weeks. Stage 2, the implementation review, is 2 to 3 months. Surveillance audits follow annually. Full recertification is every three years. Teams that already hold ISO 27001 can compress the front end significantly by reusing the existing management system. -
Does ISO 42001 replace the EU AI Act?
No. ISO 42001 is a voluntary management-system standard. The EU AI Act is binding regulation. Certification does not equal compliance. But a working AIMS lines up cleanly with most of the high-risk-system obligations under the Act. One program, scoped right from the start, can satisfy ISO 42001, NIST AI RMF, and the EU AI Act together.