ISO/IEC 42001 AI Management System Standard

ISO 42001 provides the governance framework to manage AI-specific security and privacy risks systematically. If your organization develops or deploys AI at scale, this is the international benchmark for demonstrating responsible AI management to regulators and partners.

• ☐Assess overlap with existing ISO 27001 ISMS — the shared Annex SL structure accelerates implementation
• ☐Map AI system inventory to ISO 42001 scope requirements
• ☐Evaluate joint ISO 27001 + 42001 certification with your existing audit body

Use an AI management system to organize scope, responsibilities, risk treatment and evidence. Keep management-system conformity and applicable AI Act duties as separate review questions; certification alone does not resolve the legal assessment.

• ☐Begin gap assessment against ISO 42001 Annex A controls
• ☐Engage an accredited certification body (BSI, SGS, TÜV SÜD) for scoping
• ☐Plan evidence collection, internal audit and management review around the scope and identified gaps

Treat certification as evidence about a defined management system. Assess AI Act scope, duties and conformity routes separately, and verify any claimed harmonised-standard reference against the EU Official Journal and the requirements it covers.

• ☐Verify the applicable legal provisions and any cited harmonised-standard references
• ☐Check a supplier certificate's scope and current status before relying on it
• ☐Separate contractual assurance requirements from legal compliance obligations

Understanding the organization's context, stakeholder needs, and scope of the AI management system including internal and external factors affecting AI objectives.

Top management commitment to the AIMS, establishing AI policy, assigning roles and responsibilities, and ensuring resources for responsible AI governance.

AI risk assessment, opportunity identification, and planning to achieve AI objectives including actions to address risks related to AI system development and deployment.