Blog
What ISO/IEC 42001 is and what it means for a company
ISO/IEC 42001 is the first international standard that sets requirements for an artificial intelligence management system: the set of policies, roles, processes, and controls an organization uses to direct and oversee its use of AI. It was published in December 2023 by ISO and IEC.
This article explains, in business terms, what the standard asks for, who it applies to, and what a company gains by putting it in place.
Who does ISO/IEC 42001 apply to?
Any organization that develops, offers, or simply uses AI systems, regardless of size or sector. You do not need to build your own models: a company whose teams use generative AI assistants, or whose CRM has AI features enabled, is already in scope.
That is why it matters today. In most organizations, AI did not enter through a strategic decision—it entered through three doors at once: teams, vendors, and pilots in each area.
What is an AI management system?
It is the ordered way an organization decides what AI is used for, who is accountable for each system, which risks are accepted, and how everything is verified. In practice, it rests on five elements:
- A policy approved by leadership: what AI is used for, with which principles, and what is not allowed.
- Clear owners: who decides, who supervises each system, and who can stop it.
- Risk and impact assessment, proportional to the use: an internal writing assistant is not governed like a system that intervenes in decisions about customers.
- Operational controls over data, vendors, and the lifecycle of each system.
- Measurement and improvement: indicators, internal audit, and periodic leadership review.
The standard does not require a large structure or a new department. Scope is defined with the organization: it can start with one area, one process, or a group of systems, and expand later.
How is the standard structured?
ISO/IEC 42001 follows the same structure as other management system standards, such as ISO 9001 (quality) or ISO/IEC 27001 (information security):
| Part | What it contains |
|---|---|
| Clauses 4 to 10 | Management system requirements: context, leadership, planning, support, operation, performance evaluation, and improvement. |
| Annex A | 38 reference controls grouped in nine objectives, from AI policies to relationships with third parties. |
| Annexes B to D | Guidance to implement controls, risk sources and typical objectives, and application in different sectors. |
That common structure has a practical advantage: if the organization already works with ISO 9001 or ISO/IEC 27001, the AI management system integrates with what exists instead of creating a separate world.
Is it mandatory?
No. ISO/IEC 42001 is voluntary. Organizations adopt it to govern AI use in a way they can show—not because a law forces them to. Some markets and buyers already treat structured AI governance as a commercial expectation.
Two important clarifications:
- It does not replace law. Legal obligations still apply, starting with personal-data protection rules in your jurisdiction and any AI-specific rules in force where you operate.
- It gives you a shared language. Leadership, auditors, and partners can talk about policy, owners, risk, and controls without reinventing the vocabulary for every market.
What does a company gain by implementing it?
- Trust. Clients, parent companies, and partners see governed, verifiable AI use. They ask about it more and more often.
- Traceable decisions. You know which AI systems exist, what data they use, and who is accountable.
- Obligations in view. The system documents which rules already apply to AI use (for example, data protection) so the organization can keep them current with legal counsel.
- Scale with less friction. With common rules, each new use case follows the same path: evaluate, approve, build with human oversight, and measure.
Where do you start?
With a gap assessment: a review of the organization against all requirements of the standard, requirement by requirement, that shows where it stands, what is missing, and where to start. It ends in a report with a roadmap and realistic scope.
From there, implementation advances in phases. The AI with Judgment methodology organizes that journey in five: context and scope; leadership and policy; risk and impact; controlled operation; and evaluation and improvement, with a cross-cutting people and culture axis.
In summary
- ISO/IEC 42001 is the international standard for managing artificial intelligence responsibly.
- It applies to any organization that uses AI, not only those that develop it.
- It is voluntary, and it does not replace legal obligations in your jurisdiction.
- The practical first step is a gap assessment.
ISO/IEC 42001 is a standard published by ISO and IEC. This article is for information only: it does not reproduce the standard or replace legal advice.