What ISO 42001 is and why buyers ask for it
ISO/IEC 42001, published in 2023, is the first international standard for an Artificial Intelligence Management System (AIMS). It gives organisations a certifiable framework for governing AI responsibly — managing the risks, transparency, accountability and human oversight that come with developing or using artificial intelligence.
AI adoption has moved faster than most organisations’ governance around it, and that gap is now a commercial and regulatory concern. Buyers want to know that the AI in a product is managed deliberately; regulators, including under the EU AI Act, are raising expectations. ISO 42001 lets an organisation demonstrate, through an independent audit, that it takes AI governance seriously. It is one of the newest and fastest-growing standards in the ISO Certifications portfolio and it complements ISO 27001 for security and ISO 27701 for privacy.
What the certification audit covers
Certification follows the same two-stage assessment as other ISO management systems. The audit examines how your AIMS operates, including:
- The scope and AI policy of the management system, and the roles and accountability around AI
- AI risk assessment and impact assessment — understanding what could go wrong and who could be affected
- Controls across the AI lifecycle — data, design and development, deployment and ongoing monitoring
- Transparency and human oversight of AI systems and their outputs
Surveillance audits across the three-year cycle confirm the system keeps pace with how your use of AI evolves.
How ABS helps
We prepare you for the certification audit in five steps, tailored to ISO 42001:
- Scope and gap assessment — we agree the scope of your AI management system and assess what you already have against the standard, so you know exactly what to close.
- Implementation — we help you define the scope and AI policy, run AI risk and impact assessments, and put in place controls across the AI lifecycle, with transparency and human oversight.
- Internal audit and management review — we help you run the internal audit and management review the standard requires, so the system has a record of operating before the audit.
- Readiness check — a pre-assessment, approached the way an auditor would approach it, highlights anything still to close.
- Audit support — we support you through the certification body’s Stage 1 and Stage 2 audits and help you close any findings.
Typical timeline
For most organisations, ISO 42001 certification takes around 12–16 weeks, depending on how extensively AI is used and how much governance already exists. Organisations with a large or fast-changing AI footprint take longer. Each engagement begins with a fixed-price scoping call and a proposal within 24 hours.
Common questions
What is an AI Management System (AIMS)?
An AIMS is the management system ISO 42001 certifies: a structured framework of policies, roles, risk and impact assessments, controls and oversight for developing and using artificial intelligence responsibly across its lifecycle — from data and design through deployment and monitoring.
Who needs ISO 42001?
Organisations that develop or deploy AI — SaaS and software companies building AI features, and increasingly any business embedding AI in its products, decisions or operations. As customers and regulators scrutinise how AI is governed, certification is a credible way to show it is managed deliberately.
How does ISO 42001 relate to ISO 27001 and ISO 27701?
ISO 27001 covers information security and ISO 27701 covers privacy; ISO 42001 adds governance specific to artificial intelligence. The three share the common ISO management-system structure and integrate well, so organisations with significant AI and data activity often pursue them together.
Does ISO 42001 mean we comply with the EU AI Act?
Not automatically. ISO 42001 gives you an audited governance framework that supports responsible AI practices and builds much of the foundation regulations expect — but certification to a management system standard is not the same as legal compliance with any specific regulation. It does, however, make demonstrating responsible governance considerably easier.
How long does ISO 42001 certification take?
For most organisations, ISO 42001 certification takes around 12–16 weeks, depending on how extensively AI is used and how much governance already exists. Organisations with a large or fast-changing AI footprint take longer.
What does ABS do, and what does the certification body do?
ABS prepares you for certification: we agree the scope of your AI management system, assess the gaps, help you implement it, support your internal audit and management review, check readiness and support you through the audits. The certification body, an independent, accredited organisation you choose, carries out the Stage 1, Stage 2 and surveillance audits, makes the certification decision and issues the certificate.
How long is an ISO 42001 certificate valid?
Three years. The certification body carries out surveillance audits in the first and second years, and a recertification audit before the three-year cycle ends.
Which edition of ISO 42001 is current, and is there a transition?
The current edition is ISO/IEC 42001:2023, the first edition of the standard, so there is no transition.
