AI management
ISO 42001: the AI management system standard
In short
ISO/IEC 42001 is the first international standard for an AI management system (AIMS). Published in 2023, it sets out how an organization should govern the development and use of artificial intelligence responsibly — with policies, risk and impact assessments, and controls across the AI lifecycle. Like ISO 27001 it can be certified by an accredited body, and it is the natural management-system route to demonstrating trustworthy, well-governed AI.
Last reviewed: August 2026
Who it is for
ISO 42001 applies to any organization that provides or uses AI systems and wants a structured, auditable way to govern them — from AI-native product companies to enterprises deploying AI internally. It is increasingly relevant as customers, regulators and procurement teams ask how AI is governed, and it gives a recognized framework for answering that.
Core requirements
ISO 42001 follows the same high-level structure as other ISO management standards (clauses 4–10), so it integrates cleanly with ISO 27001. On top of that it adds AI-specific expectations.
- An AI policy and clear roles and responsibilities for AI
- AI risk assessment across the AI lifecycle
- AI system impact assessments (effects on individuals and society)
- Data governance for the data used by AI systems
- Lifecycle controls: development, deployment, monitoring and change
- A Statement of Applicability against the Annex A controls
- Internal audit, management review and continual improvement
Typical governance challenges
- Maintaining an inventory of AI systems as models and use cases change
- Keeping impact assessments current as systems are retrained
- Governing the data that feeds models, not just the models themselves
- Documenting the AI lifecycle in a way an auditor can follow
- Aligning the AIMS with the EU AI Act, GDPR and ISO 27001 without duplication
What can reasonably be automated
- An AI-system inventory captured as structured, maintainable records
- AI risk and impact assessments linked to each system
- Continuous control monitoring and evidence collection
- Documentation that travels with a model as it is retrained and redeployed
- Mapping AIMS controls onto ISO 27001 and EU AI Act obligations
Evidence auditors expect
- AI policy, objectives and scope of the AIMS
- AI risk assessments and AI system impact assessments
- Statement of Applicability against Annex A controls
- Data-governance and AI-lifecycle records
- Internal audit reports and management review minutes
- Corrective actions and continual-improvement records
Relationship to the EU AI Act and ISO 27001
ISO 42001 is voluntary and certifiable; the EU AI Act is binding law. Implementing an AIMS does not automatically make you AI-Act compliant, but it gives you the governance structure — inventory, risk and impact assessment, lifecycle controls — that supports AI Act readiness. Because it shares the ISO management-system backbone, a mature ISO 27001 program covers much of the underlying control work, so the practical task is extending and evidencing, not starting over.
How Isodora supports ISO 42001
ISO 42001 is a built-in framework in Isodora, run on the same engine as your other standards.
AI system inventory
Capture every AI system, its purpose and its risk as structured, maintainable records.
Risk & impact assessments
Link AI risk assessments and AI system impact assessments to each system and keep them current.
Shared controls
Reuse ISO 27001 and GDPR evidence for the security and data-governance parts of the AIMS.
Continuous audit trail
A regulator-grade, time-stamped trail so an ISO 42001 audit is a report, not a reconstruction.
Isodora helps you build and maintain an AIMS. ISO 42001 certification is issued by an independent accredited body after its own audit; no software can guarantee a certificate.
Frequently asked questions
- What is ISO 42001?
- ISO/IEC 42001 is the international standard for an AI management system — a structured, certifiable way for organizations to govern the responsible development and use of AI, covering policy, risk and impact assessment, and lifecycle controls.
- Is ISO 42001 the same as the EU AI Act?
- No. ISO 42001 is a voluntary, certifiable management-system standard; the EU AI Act is binding EU law. Implementing ISO 42001 supports AI Act readiness by giving you the governance structure, but it does not by itself make you legally compliant.
- Can ISO 42001 be integrated with ISO 27001?
- Yes. Both share the same high-level ISO management-system structure, so context, leadership, internal audit, management review and improvement can run as one integrated system, reusing shared evidence.
- Who should adopt ISO 42001?
- Organizations that build or use AI and need a recognized, auditable way to show it is well governed — especially those facing customer, procurement or regulatory questions about how their AI is managed.