ISO 42001 Explained: The AI Management System Standard and How Certification Works

ISO/IEC 42001:2023 is the international standard for an AI management system (AIMS): a structured set of policies, roles, risk and impact assessments, and controls for building or using AI responsibly. Published in December 2023 by ISO and IEC, it is the first AI management system standard an organization can be independently certified against. Certification is issued by an accredited certification body after a two-stage audit, and the certificate is valid for three years.

If a customer has just asked you "are you ISO 42001 certified?", this guide covers what the standard actually requires, what certification involves, and what it takes to get there.

What ISO 42001 is (and is not)

ISO/IEC 42001 was developed by the joint ISO/IEC technical committee for AI, JTC 1/SC 42, and published as ISO/IEC 42001:2023. It defines the requirements for establishing, running, maintaining, and continually improving an AI management system.

A management system standard does not tell you which model to use, how accurate it must be, or which fairness metric to adopt. It requires you to decide those things deliberately, document the decisions, assign owners, assess risk and impact, apply proportionate controls, and check that it all works. The auditor is testing whether your system for governing AI is designed sensibly and operating as described.

Three points tend to clear up early confusion:

• It is certifiable. Unlike guidance documents such as ISO/IEC 23894 (AI risk management guidance) or the NIST AI Risk Management Framework, ISO 42001 contains "shall" requirements that an accredited body can audit.
• It is for organizations, not people. Individual credentials such as ISO 42001 Lead Implementer, Lead Auditor, or the IAPP AIGP are separate. See AI governance certification for the difference.
• It does not replace security frameworks. ISO 42001 sits alongside ISO 27001 and SOC 2 rather than substituting for them. The comparison is covered in ISO 42001 vs ISO 27001 vs SOC 2.

Who ISO 42001 applies to

The standard is written for any organization that develops, provides, or uses AI systems, in any sector and at any size. That covers three common profiles:

Profile	Typical example	What the AIMS mostly governs
AI developer or provider	A SaaS company shipping ML or LLM features to customers	Model and data life cycle, testing, documentation, customer-facing transparency, incident communication
AI user (deployer)	A company using third-party AI for hiring, support, or underwriting	Intended use, supplier management, impact on individuals, human oversight, responsible-use objectives
Both	A platform that builds its own models and also embeds vendor models	All of the above, plus clear allocation of responsibilities across the supply chain

The practical trigger for most B2B companies is commercial, not regulatory. Enterprise procurement and security teams have started adding AI governance questions to vendor reviews, and a certificate from an accredited body answers many of those questions at once.

How the standard is structured

ISO 42001 follows the ISO harmonized structure, the same clause layout used by ISO 27001 and ISO 9001. Clauses 1 to 3 cover scope, normative references, and terms. Clauses 4 to 10 contain the requirements you are audited against.

Clause	Topic	What you need to show, in plain terms
4	Context of the organization	You understand internal and external issues, interested parties and their requirements, your role with respect to AI, and you have defined the AIMS scope
5	Leadership	Top management is accountable, an AI policy exists, and roles and responsibilities are assigned
6	Planning	You assess AI risks (6.1.2), choose treatments (6.1.3), assess impacts of AI systems (6.1.4), and set measurable AI objectives
7	Support	People are competent and aware, resources are in place, communication is planned, and documented information is controlled
8	Operation	Planned processes are actually run: risk treatment, impact assessments (8.4), and operational controls across the AI life cycle
9	Performance evaluation	You monitor and measure, run internal audits (9.2), and hold management reviews (9.3)
10	Improvement	Nonconformities are corrected, root causes addressed, and the system improves over time

Key artifacts an auditor will ask for

Most first-time projects underestimate how many of these need to exist and show evidence of use before the audit:

• AIMS scope statement (which AI systems, products, teams, and locations are in)
• AI policy, approved by top management
• AI objectives with owners and measures
• AI risk assessment methodology and completed risk assessment
• Risk treatment plan
• Statement of Applicability (SoA), listing every Annex A control as included or excluded, with justification
• AI system impact assessments for in-scope systems
• Competence and awareness records (training, role descriptions)
• Controlled documented information (procedures, records, version history)
• Internal audit program and at least one completed internal audit
• Management review minutes
• Nonconformity and corrective action log

For a working list you can tick off, use the ISO 42001 checklist.

Annex A: the 38 controls

Annex A is normative, meaning it is part of the requirements. It lists 38 controls grouped under 9 control objective areas. You do not have to implement every control, but your Statement of Applicability must address all of them and justify any exclusion.

Area	Topic	Number of controls	Examples of control topics
A.2	Policies related to AI	3	AI policy; alignment with other policies; policy review
A.3	Internal organization	2	AI roles and responsibilities; reporting of concerns
A.4	Resources for AI systems	5	Documenting data, tooling, compute, and human resources
A.5	Assessing impacts of AI systems	4	Impact assessment process and records; impact on individuals, groups, and society
A.6	AI system life cycle	9	Responsible design and development; requirements; verification and validation; deployment; operation and monitoring; technical documentation; event logs
A.7	Data for AI systems	5	Data acquisition, quality, provenance, and preparation
A.8	Information for interested parties	4	User documentation; external reporting; incident communication
A.9	Use of AI systems	3	Processes and objectives for responsible use; intended use
A.10	Third-party and customer relationships	3	Allocating responsibilities; suppliers; customers

The rest of the annexes support Annex A. Annex B gives implementation guidance for each control. Annex C lists potential AI-related organizational objectives and risk sources, which is a useful starting point for your risk assessment. Annex D covers use of the AIMS across domains and sectors.

A control-by-control walkthrough, with what evidence typically satisfies each one, is in the ISO 42001 Annex A controls guide.

Auditor's note: In audits, one of the first things we look for is whether the AI impact assessment and the AI risk assessment are actually connected. Many organizations produce both as separate documents that never reference each other. An auditor will pick an in-scope AI system, ask for its impact assessment, and then ask which risks and controls it fed into. If you cannot trace that line, expect a finding.

Related standards worth knowing

ISO 42001 is part of a family of AI standards from the same committee. You do not need to buy all of them, but knowing what each does saves time:

Standard	What it is	When it helps
ISO/IEC 22989	AI concepts and terminology	Agreeing definitions across legal, product, and engineering
ISO/IEC 23894:2023	Guidance on AI risk management	Designing the risk methodology used in Clause 6
ISO/IEC 42005 (2025)	Guidance on AI system impact assessment	Building the impact assessment process required by 6.1.4 and A.5
ISO/IEC 42006 (2025)	Requirements for bodies that audit and certify AIMS	Understanding how your certification body plans audit time and auditor competence

On the US side, the NIST AI RMF is a free, voluntary framework that many organizations use for day-to-day risk practice, with ISO 42001 as the certifiable management system around it. NIST publishes crosswalks between the two. See ISO 42001 vs NIST AI RMF.

How ISO 42001 certification works

Certification is performed by an accredited certification body, not by a consultant and not by ISO itself. In the US, ANAB operates an accreditation program for ISO/IEC 42001 certification bodies; in the UK, UKAS plays the same role. Before you sign with a certification body, confirm it is accredited for ISO 42001 specifically, not only for ISO 27001.

The cycle looks like this:

1. Stage 1 audit. A documentation and readiness review. The auditor checks your scope, policy, risk and impact assessment methods, SoA, and whether you are ready for Stage 2.
2. Stage 2 audit. The implementation and effectiveness audit. The auditor samples evidence that your processes and controls are operating as documented.
3. Certification decision. Any major nonconformities must be closed first. The certificate is then issued, valid for three years.
4. Surveillance audits. One in each of the two following years, covering a subset of the system.
5. Recertification audit. Before the three-year cycle ends, to renew the certificate.

Certification bodies generally expect the AIMS to have been operating for a period before Stage 2, commonly around three months of records, including at least one internal audit and one management review. That operating period is the main reason certification cannot be compressed into a few weeks.

The full step-by-step process, with a phased timeline, is in how to get ISO 42001 certified.

A note on independence

The body that certifies you cannot also consult for you on the same management system. That rule protects the value of the certificate. TrustAIMS is an advisory firm, not a certification body: we help you build and run the AIMS, and an independent accredited body audits it.

How long ISO 42001 certification takes

For a prepared SaaS company with a clear scope, a realistic range is roughly three to six months from kickoff to certificate. Organizations that already run ISO 27001 can often move faster, because document control, internal audit, and management review processes already exist.

Starting point	What usually drives the timeline
No formal management system	Writing the core documents, running the first risk and impact assessments, and building three months of operating records
ISO 27001 certified	Adding AI-specific risk, impact assessment, life cycle, and data controls to an existing system
Large or multi-product AI scope	The number of AI systems needing impact assessments and the number of teams involved

What ISO 42001 certification costs

Cost depends on scope, the number of AI systems, whether you already have ISO 27001, how much work you do internally, and your certification body's audit-day estimate. Published figures vary widely. For example, compliance platform Vanta estimates gap analysis at roughly $3,000 to $10,000+ and the initial certification audit at roughly $7,000 to $20,000, while certification body Schellman states that its year-one Stage 1 and Stage 2 audit typically ranges from the $20,000s to the $40,000s.

Our own fixed fees start at $12,500 for a gap assessment and $35,000 for certification readiness. A line-by-line breakdown, including surveillance years, tooling, and internal effort, is in ISO 42001 certification cost.

How ISO 42001 relates to AI laws

ISO 42001 is not a law, and certification does not by itself make you compliant with any law. It can, however, give you the governance machinery that legal obligations depend on: an inventory of AI systems, risk and impact assessments, documentation, human oversight, and incident handling.

• EU AI Act. Regulation (EU) 2024/1689 entered into force on August 1, 2024, with obligations applying in phases. As of October 2026, the Digital Omnibus on AI, in force since July 27, 2026, moved obligations for Annex III high-risk systems to December 2, 2027 and for high-risk AI in regulated products to August 2, 2028. ISO 42001 does not equal AI Act compliance, but a working AIMS covers much of the risk management, documentation and oversight the Act expects. Check current dates with counsel; this is not legal advice.
• Colorado. Colorado's AI Act, SB 24-205, refers to recognized risk management frameworks such as the NIST AI RMF and ISO/IEC 42001. Its effective date has been moved more than once; as of October 2026, confirm its current status before relying on it.

This is general information, not legal advice.

Is ISO 42001 worth it?

It is usually worth pursuing when one or more of these is true:

• Enterprise customers are asking for it in security reviews or contract terms, and deals are stalling.
• You ship AI features that affect people (hiring, lending, health, education, content moderation) and need defensible governance.
• You already run ISO 27001 and can add 42001 to the same management system at lower marginal cost.
• You expect to face AI regulation and want a single governance system that can absorb new requirements.

It may be premature if you have no AI systems in production, no customer demand, and no regulatory exposure. In that case, a lighter-weight AI governance framework, an AI policy, and a basic AI risk assessment may be the right first step, with certification later.

Where to start

1. Take the free self-assessment. Our 10-question ISO 42001 readiness assessment gives you a quick view of where you stand.
2. Define a candidate scope. List your AI systems and decide which products, teams, and locations a first certificate should cover. A narrower first scope is easier to certify and can be expanded later.
3. Run a gap assessment. Map current practice against Clauses 4 to 10 and all 38 Annex A controls. Our ISO 42001 gap assessment does this in about two weeks for a fixed fee and delivers a prioritized remediation plan and draft Statement of Applicability.
4. Build and operate the AIMS. Close gaps, run the processes, and generate records. If you want hands-on help through Stage 1 and Stage 2, see certification readiness.
5. Keep it running. After certification, internal audits, management reviews, and surveillance prep continue every year. Our AIMS retainer covers that work.

Questions about scope or pricing? See pricing or contact us.