ISO/IEC 42001 is the world’s first international, certifiable standard for managing Artificial Intelligence responsibly and securely. Think of it as ISO 27001 for AI — a full management system that defines how an organisation should govern, operate, monitor, and continually improve its AI systems.
It was published in December 2023 and is now the global benchmark for AI governance, risk management, transparency, and accountability.
ISO/IEC 42001 is an AI Management System (AIMS) standard. It tells organisations how to run AI safely, not just how to build AI securely.
It defines:
Policies
Governance structures
Roles & responsibilities
Risk management processes
Documentation requirements
Operational controls
Monitoring & continuous improvement
It is auditable and certifiable, meaning organisations can earn an official ISO 42001 certification just like ISO 27001.
AI introduces risks that traditional security and governance frameworks do not cover:
Bias & discrimination
Model drift
Data poisoning
Transparency failures
Safety risks
Ethical concerns
Regulatory compliance (EU AI Act, GDPR, etc.)
ISO 42001 provides a structured, globally recognised way to manage these risks.
Defines leadership responsibilities, oversight structures, and accountability mechanisms.
Requires organisations to identify, assess, and mitigate risks across the AI lifecycle.
Controls for data quality, model training, deployment, monitoring, and retirement.
Ensures AI systems are explainable, traceable, and well‑documented.
Mandates human‑in‑the‑loop or human‑on‑the‑loop controls for critical systems.
Aligns with cybersecurity, privacy, and safety requirements.
Requires ongoing monitoring, auditing, and refinement of AI systems.
It is most relevant for:
Enterprises deploying AI at scale
Organisations using AI in regulated sectors (finance, healthcare, public sector)
Companies preparing for EU AI Act compliance
Vendors selling AI products to enterprise clients
Any organisation wanting a trustworthy AI certification