ISO/IEC 42001 is the first international management-system standard for artificial intelligence, published by ISO and IEC in December 2023. It defines an AI Management System (AIMS) covering governance, risk treatment, and lifecycle controls for AI systems an organization develops or operates. Certification is voluntary and follows the same audit pattern as ISO 27001.
What does an ISO 42001 management system actually cover?
The standard uses clauses 4 through 10 on context, leadership, planning, support, operation, evaluation, and improvement, plus an Annex A control set.
Annex A covers AI policy, roles, resources, impact assessment, data quality, lifecycle management, third-party AI use, and information for users of AI systems. Annex B is the implementation guide and Annexes C and D map AI risk sources and use across sectors (ISO).
Why are buyers asking AI vendors for ISO 42001?
It is the first auditable framework that lets a customer ask "do you have AI governance?" and get an answer backed by a third-party certificate.
Microsoft was independently audited against ISO 42001 in 2024 across its AI systems, and SAP announced certification in 2025 covering Joule and SAP AI Core. Adoption is growing fastest among enterprise AI vendors selling into regulated buyers.
How does ISO 42001 relate to the EU AI Act?
ISO 42001 is voluntary and the EU AI Act is binding law, yet the standard has become the practical baseline for showing alignment with the Act.
Most teams shipping AI products into Europe over-invest in writing internal AI policies and under-invest in mapping those policies to a certifiable framework. ISO 42001 gives a buyer-side artifact the way SOC 2, ISO 27001, and HITRUST CSF do for security. It plugs straight into a TPRM review and the EU AI Act high-risk obligations under Regulation 2024/1689.
Related terms
These adjacent definitions place ISO 42001 inside the management-system family and the AI-governance frameworks customers compare it to.
- ISO 27001 - the ISMS standard ISO 42001 borrows its clause structure from
- NIST AI RMF - the US risk-management framework for AI, voluntary and not certifiable
- EU AI Act - the 2024 EU regulation that ISO 42001 helps high-risk AI providers demonstrate alignment with
- SOC 2 - the security audit US buyers usually pair with an AI governance ask