Overview

ISO/IEC 42001:2023 is the world's first management system standard for Artificial Intelligence. Published by ISO and IEC, it specifies requirements for establishing, implementing, maintaining and continually improving an AI Management System (AIMS) within an organisation. It applies to any organisation that develops, provides or uses AI-based products or services – regardless of size, sector or the type of AI involved.

The standard follows the same high-level structure as ISO 9001 and ISO/IEC 27001, so it integrates naturally with existing quality and information security systems. It focuses on the unique challenges of AI: ethical use, transparency, fairness, safety, accountability and the management of risks and impacts on individuals and society.

Key requirements of ISO/IEC 42001:

• Context of the organisation and the role it plays in the AI value chain (developer, provider, user)
• Leadership commitment, AI policy and defined roles and responsibilities
• AI risk assessment, risk treatment and AI system impact assessment
• Objectives, resources, competence and awareness for responsible AI
• Operational controls across the AI system lifecycle – data, development, deployment, monitoring
• Performance evaluation, internal audit and management review
• Continual improvement and handling of non-conformities
• Annex A controls covering data quality, transparency, human oversight, third parties and more

Why Get Certified

Who Should Consider It

• Software and SaaS companies building AI or machine-learning features
• Organisations using AI for decisions affecting people – HR, finance, healthcare, insurance
• Service providers offering AI-enabled solutions to clients or government
• Companies already certified to ISO/IEC 27001 that want to extend governance to AI

Certification Process

Our process follows the same steps as our other management system certifications: application and questionnaire, free estimate, Stage 1 (documentation review) and Stage 2 (implementation audit), certification decision, then annual surveillance audits and re-certification after three years. See our Compliance Process page for details.