ISO 42001, run AI responsibly and prove it
The first certifiable standard for managing AI. See what it asks and how ready you are.
Official sources
Use these official places to read the text and find the latest version.
Official website
ISO shows the edition, status and a preview of the contents.
Visit iso.org/standard/81230 ↗Get the document
Buy the official PDF from ISO or your national standards body.
Open the official page ↗What ISO 42001 is
ISO/IEC 42001 is the international standard for an AI management system. It asks you to set policy, assess AI risks and impacts, put controls in place and keep improving.
It follows the same structure as ISO 27001, so organisations that already hold that certificate can add it with less duplicated work.
How ISO 42001 got to where it is today
The milestones that changed what organisations have to do.
Work begins
ISO and IEC begin drafting the first management system standard for AI.
ISO/IEC 42001:2023
Published in December 2023 as the first certifiable AI management standard.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You build, sell or use AI in your products or operations.
Customers ask how you govern AI.
You need a path to meet the EU AI Act.
You already hold ISO 27001 and want to extend it.
What it asks of you
The requirements fall into six areas.
Context and scope
Decide which AI systems and roles are covered.
Leadership and AI policy
Management owns responsible AI and sets the policy.
Risk and impact assessment
Assess risks and effects on people.
Controls (Annex A)
Controls for data, development, use and third parties.
Operation and monitoring
Run AI under controls and watch performance.
Audit and improvement
Audit internally and fix what you find.
2 parts, 16 areas and 65 requirements
ISO/IEC 42001 is a certifiable standard for running an AI management system. It has clauses 4 to 10 plus Annex A controls grouped into nine areas. This page paraphrases the structure and does not reproduce the standard.
16 clause or control areas · 65 requirements
Management system clauses 4 to 10The mandatory requirements for building, running and improving an AI management system.7 clause or control areas · 27 requirements
c4Clause 4 Context of the organisationKnow your situation, who cares, and what your AI management system covers.4 requirements
- 4.1
Understand the internal and external issues that affect your AI goals and your role in the AI value chain.
What you do
- List the AI systems you build, buy or use, and note regulatory, market and ethical pressures
- Record your role (developer, provider, user) for each system
- 4.2
Identify interested parties and which of their requirements the AI management system must address.
What you do
- Build a stakeholder table covering customers, regulators, staff and affected individuals
- Capture contractual and legal duties that touch AI
- 4.3
Define and document the boundaries and scope of the AI management system.
What you do
- Write a scope statement naming systems, teams, locations and exclusions
- Link scope to the AI system inventory
- 4.4
Establish, run, maintain and continually improve the AI management system.
What you do
- Document the processes and how they connect
- Assign an owner for the overall system
Evidence to keep
- Register of internal and external issues affecting AI use
- Interested parties list with their needs
- Scope statement for the AI management system
c5Clause 5 LeadershipTop management owns AI governance, sets direction and assigns roles.3 requirements
- 5.1
Top management shows leadership and commitment to the AI management system.
What you do
- Sponsor the programme and give it budget
- Discuss AI risk at board or leadership meetings
- 5.2
Top management sets an AI policy suited to the organisation and its purpose.
What you do
- Write a short AI policy covering responsible use, objectives and improvement
- Publish it to staff and make it available to interested parties
- 5.3
Roles, responsibilities and authorities for AI are assigned and communicated.
What you do
- Name an AI governance lead and system owners
- Add AI duties to job descriptions
Evidence to keep
- Signed AI policy
- Management review minutes
- Role and responsibility matrix for AI
c6Clause 6 PlanningPlan how you will handle AI risks, impacts and objectives.6 requirements
- 6.1.1
Plan actions to address the risks and opportunities linked to the AI management system.
What you do
- Keep a risk and opportunity register for AI
- Review it when systems or rules change
- 6.1.2
Define and apply an AI risk assessment process.
What you do
- Set criteria for likelihood and impact covering harm to people
- Assess each AI system before launch and on major change
- 6.1.3
Define and apply an AI risk treatment process and decide which Annex A controls apply, with justification.
What you do
- Choose treatments and record owners and dates
- Produce a Statement of Applicability explaining included and excluded controls
- 6.1.4
Define and apply a process to assess the consequences of AI systems for individuals, groups and society.
What you do
- Run an impact assessment template for each system
- Store results with the system record
- 6.2
Set AI objectives at relevant functions and plan how to reach them.
What you do
- Write measurable goals such as fairness, accuracy or incident targets
- Assign owners and review dates
- 6.3
Plan changes to the AI management system in a controlled way.
What you do
- Use a change log and approval step for system changes
- Assess effects of a change before it goes live
Evidence to keep
- AI risk assessment and treatment plan
- AI system impact assessment records
- Measurable AI objectives and plans
- Statement of Applicability for Annex A
c7Clause 7 SupportProvide people, skills, awareness, communication and controlled documents.5 requirements
- 7.1
Provide the resources the AI management system needs.
What you do
- Budget for tooling, people and assurance
- Review resource gaps at management review
- 7.2
Make sure people doing AI work are competent.
What you do
- Define needed skills and train or hire to close gaps
- Keep training records
- 7.3
Make people aware of the AI policy, their contribution and the cost of not conforming.
What you do
- Add AI awareness to induction
- Run short refreshers for teams using AI
- 7.4
Decide what to communicate about the AI management system, to whom, when and how.
What you do
- Create a simple communication matrix
- Name who speaks for the organisation on AI
- 7.5
Create and control the documented information the system requires.
What you do
- Use versioned, approved documents with owners
- Set retention and access rules
Evidence to keep
- Training and competence records
- Communication plan
- Document control register
c8Clause 8 OperationRun the planned processes and keep risk and impact work current.4 requirements
- 8.1
Plan, implement and control the processes needed to meet requirements, including controlling planned changes and outsourced processes.
What you do
- Define lifecycle procedures from design to retirement
- Control suppliers that run AI processes for you
- 8.2
Carry out AI risk assessments at planned intervals and when significant change occurs.
What you do
- Schedule reviews and trigger them on model or data changes
- Keep dated results
- 8.3
Implement the AI risk treatment plan and keep results.
What you do
- Track treatments to closure
- Report open risks to leadership
- 8.4
Carry out AI system impact assessments at planned intervals and keep results.
What you do
- Reassess impacts on a schedule and after major change
- Store assessments with system documentation
Evidence to keep
- Operational procedures for AI lifecycle
- Results of periodic risk and impact assessments
- Treatment plan progress records
c9Clause 9 Performance evaluationMeasure, audit and review how well the system works.3 requirements
- 9.1
Decide what to monitor and measure, how, and when, and evaluate performance and effectiveness.
What you do
- Define indicators such as incidents, drift and complaints
- Report them regularly
- 9.2
Run internal audits of the AI management system at planned intervals.
What you do
- Create an audit programme with independent auditors
- Track findings to closure
- 9.3
Top management reviews the AI management system at planned intervals.
What you do
- Hold a review covering audit results, risks, objectives and changes
- Record decisions and actions
Evidence to keep
- Monitoring metrics and reports
- Internal audit reports
- Management review minutes
c10Clause 10 ImprovementFix problems and keep getting better.2 requirements
- 10.1
Continually improve the suitability, adequacy and effectiveness of the system.
What you do
- Keep an improvement backlog tied to review outputs
- Share lessons learned across AI teams
- 10.2
React to nonconformities, correct them, find root causes and prevent recurrence.
What you do
- Log issues, fix, and analyse cause
- Verify the fix worked
Evidence to keep
- Corrective action log
- Improvement backlog
Annex A reference controlsThe control objectives and controls you consider and justify in your Statement of Applicability.9 clause or control areas · 38 requirements
A.2A.2 Policies related to AIGive direction through AI policy.3 requirements
- A.2.2
Document an AI policy.
What you do
- Write and approve a policy covering responsible AI use
- A.2.3
Align the AI policy with other organisational policies.
What you do
- Cross-check against security, privacy and quality policies
- A.2.4
Review the AI policy at planned intervals.
What you do
- Add policy review to the annual calendar
Evidence to keep
- AI policy and related policies
- Policy review records
A.3A.3 Internal organisationSet accountability and a way to raise concerns.2 requirements
- A.3.2
Define and allocate AI roles and responsibilities.
What you do
- Name owners for each system and for oversight
- A.3.3
Provide a process for reporting concerns about the organisation's role in AI.
What you do
- Offer an anonymous channel and non-retaliation promise
Evidence to keep
- Roles and responsibilities document
- Concern reporting channel and log
A.4A.4 Resources for AI systemsKnow the resources AI systems rely on.5 requirements
- A.4.2
Identify and document resources needed for each AI system.
What you do
- Keep a resource sheet per system
- A.4.3
Document data resources used.
What you do
- List datasets, sources and owners
- A.4.4
Document tooling resources used.
What you do
- List libraries, platforms and model sources
- A.4.5
Document system and computing resources used.
What you do
- Record cloud, hardware and capacity
- A.4.6
Document the human resources and competences involved.
What you do
- Record roles and required skills
Evidence to keep
- Resource inventory per AI system
- Competence records
A.5A.5 Assessing impacts of AI systemsUnderstand effects on people and society.4 requirements
- A.5.2
Establish an AI system impact assessment process.
What you do
- Create a standard template and triggers
- A.5.3
Document the results of impact assessments.
What you do
- Retain assessments for the system life
- A.5.4
Assess the impact of AI systems on individuals or groups.
What you do
- Check fairness, safety and rights effects
- A.5.5
Assess the societal impact of AI systems.
What you do
- Consider environmental and community effects
Evidence to keep
- Impact assessment process
- Completed impact assessments
A.6A.6 AI system life cycleBuild, verify, deploy and operate AI responsibly.9 requirements
- A.6.1.2
Set objectives for responsible development.
What you do
- Define fairness, safety and transparency goals
- A.6.1.3
Set processes for responsible design and development.
What you do
- Use secure and ethical development checklists
- A.6.2.2
Specify AI system requirements.
What you do
- Write requirements including risk and impact needs
- A.6.2.3
Document design and development.
What you do
- Record architecture, model and data choices
- A.6.2.4
Define verification and validation measures.
What you do
- Test accuracy, robustness and bias before release
- A.6.2.5
Plan deployment.
What you do
- Use a release checklist and rollback plan
- A.6.2.6
Define and document operation and monitoring.
What you do
- Monitor drift, errors and misuse after launch
- A.6.2.7
Prepare technical documentation for relevant parties.
What you do
- Provide documentation for users and auditors
- A.6.2.8
Determine when event logs are recorded.
What you do
- Log decisions and key events for traceability
Evidence to keep
- Design and test documentation
- Deployment approvals
- Operational logs
A.7A.7 Data for AI systemsManage data quality, origin and preparation.5 requirements
- A.7.2
Define data management processes for AI.
What you do
- Set rules for data use in development
- A.7.3
Determine how data is acquired and selected.
What you do
- Record sources and legal basis
- A.7.4
Define data quality requirements and check them.
What you do
- Measure completeness and accuracy
- A.7.5
Record data provenance.
What you do
- Keep lineage from source to model
- A.7.6
Define criteria and methods for data preparation.
What you do
- Document cleaning and labelling steps
Evidence to keep
- Data quality reports
- Data provenance records
A.8A.8 Information for interested partiesBe open with users and others.4 requirements
- A.8.2
Provide system documentation and information to users.
What you do
- Publish clear instructions and limits
- A.8.3
Provide a way for external parties to report adverse impacts.
What you do
- Offer a contact point and tracking
- A.8.4
Determine and communicate incidents.
What you do
- Set notification rules for AI incidents
- A.8.5
Determine and document information obligations to interested parties.
What you do
- Map what each party must be told
Evidence to keep
- User documentation
- Incident communication records
A.9A.9 Use of AI systemsUse AI systems responsibly and as intended.3 requirements
- A.9.2
Define processes for responsible use of AI systems.
What you do
- Write usage rules and approval steps
- A.9.3
Identify objectives to guide responsible use.
What you do
- Set acceptable use goals
- A.9.4
Use the system according to its intended use and documentation.
What you do
- Block use outside stated purpose
Evidence to keep
- Responsible use procedures
- Intended use statements
A.10A.10 Third-party and customer relationshipsShare responsibility clearly with suppliers and customers.3 requirements
- A.10.2
Allocate responsibilities across the AI value chain.
What you do
- Put roles into contracts
- A.10.3
Set a process for suppliers to align with your responsible AI approach.
What you do
- Assess suppliers before onboarding
- A.10.4
Consider customer expectations and needs in responsible AI use.
What you do
- Gather and act on customer requirements
Evidence to keep
- Supplier agreements
- Customer contract terms
- Supplier assessments
Nothing matches. Clear the search or pick another part.
Outcomes and implementation examples are from ISO/IEC 42001:2023 Artificial intelligence, Management system, published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
List your AI systems
Build, buy and embedded.
- 2
Set the policy and scope
Agree roles and boundaries.
- 3
Assess risks and impacts
Per system, in plain terms.
- 4
Apply controls and gather evidence
Document what happens.
- 5
Audit, then certify
Internal audit first, then a certification body.
How Optimus AI helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus AI |
|---|---|
| Context and scope | AI system inventory and scope |
| Leadership and AI policy | Policy management |
| Risk and impact assessment | AI risk register and impact assessments |
| Controls (Annex A) | Controls library with evidence |
| Operation and monitoring | Monitoring tasks and review logs |
| Audit and improvement | Audit plans and corrective actions |
Free ISO 42001 readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- AI policy (sample)
- AI system register
- AI impact assessment template
- Internal audit checklist
Share or cite this page
Writing about ISO 42001? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/iso-42001/">ISO 42001 explained in plain English - Optimus CyberX</a>Common questions
Is ISO 42001 required by law?
No. It is voluntary, though it can support compliance with laws such as the EU AI Act.
Does ISO 42001 equal EU AI Act compliance?
No. It helps but does not replace the legal requirements.
How does it fit with ISO 27001?
Both share a structure and can be audited together.
Do we need it if we only use third-party AI?
You still need to govern how it is used. Scope can be limited to use.
Related frameworks
See how ready you are for ISO 42001
Answer questions across every area. We email you a report showing where you comply and where you do not.