ISO/IEC 42001: the complete guide

ISO/IEC 42001:2023 was published on 18 December 2023 by ISO and the IEC, through their joint committee on artificial intelligence (ISO/IEC JTC 1/SC 42) ^[1]. It sets out requirements for establishing, implementing, maintaining and continually improving an AI management system: the policies, roles, processes and controls an organization uses to develop, provide or use AI responsibly ^[3].

It is a management-system standard, in the same family as ISO/IEC 27001 for information security. A certificate says how an organization governs AI; it does not certify any particular AI product ^[8]. Because it uses ISO’s harmonized structure, with the same clause numbers and core text as other management-system standards, it can be run alongside ISO 27001 or ISO 9001 as one integrated system ^[3].

Certification is voluntary and is carried out by independent certification bodies; ISO itself does not certify anyone, and the standard does not replace any law ^[2].

The standard is written for any organization that provides or uses products or services that rely on AI systems, of any size, type or sector ^[3][2]. A company that only deploys third-party AI can be certified: controls that don’t apply to it, such as some development controls, are left out of its Statement of Applicability with a written justification ^[22].

Clause 4.1 asks each organization to decide its role in relation to its AI systems, using the roles defined in ISO/IEC 22989: for example AI provider, AI producer, AI customer or AI partner ^[3][12]. The role shapes which controls matter most.

Organizations that have announced certification, from our verified list of ISO 42001 certified companies, include:

• AI platforms and model developers, such as AWS, Microsoft, Google Cloud, Anthropic and IBM (for its Granite models).
• Software companies with AI features, such as Salesforce, Workday, ServiceNow, Zendesk and Datadog.
• Professional-services firms, such as KPMG, PwC Taiwan and EY Greece, and compliance platforms such as Vanta and Drata.

No authority publishes a count of certificates. One independent tracker of public announcements counted 220 certified organizations in 29 countries as of 11 October 2026; it does not check accreditation registers ^[21].

The requirements sit in clauses 4 to 10, which follow the same pattern as every modern ISO management-system standard ^[3]. The table paraphrases each clause; the standard’s own wording is copyrighted and has to be bought from ISO or a national standards body.

Two requirements are specific to AI. The AI risk assessment looks at risks to meeting your AI objectives. The AI system impact assessment (6.1.4) looks outward: the potential consequences of an AI system for individuals, groups of individuals and societies. Its results are documented and feed into the risk assessment ^[7]. ISO/IEC 42005:2025 gives detailed guidance on running impact assessments ^[10]; our AI impact assessment template is a practical starting point.

Annex A lists 38 reference controls in 9 areas, A.2 to A.10. Annex B gives implementation guidance for each control under matching numbers (B.2.2 for A.2.2, and so on). Both annexes are normative. Annex C lists potential AI-related objectives and risk sources, and Annex D covers using an AI management system across domains and sectors; both are informative ^[3][4].

You don’t have to implement all 38. During risk treatment (6.1.3) you decide which controls you need, compare them with Annex A so nothing necessary is missed, and record the result in a Statement of Applicability that justifies each inclusion and exclusion ^[22].

A practical checklist of the evidence certification auditors typically examine, mapped to the clauses and controls above ^[3][7][18]:

1. 01

   Scope and context (4.1–4.3)

   A written AIMS scope, the issues and interested parties you considered, and your role(s) for each AI system.

2. 02

   AI policy (5.2, A.2)

   An approved AI policy, aligned with your other policies and reviewed on a schedule.

3. 03

   Roles and reporting (5.3, A.3)

   Named owners for AI governance and a channel for staff to report concerns.

4. 04

   AI system inventory and resources (A.4)

   Documentation of each AI system’s data, tooling, computing and people.

5. 05

   Risk assessment and treatment (6.1.2–6.1.3, 8.2–8.3)

   A defined method and risk criteria, current results, a treatment plan and the Statement of Applicability.

6. 06

   Impact assessments (6.1.4, 8.4, A.5)

   Documented assessments of effects on individuals, groups and society for each in-scope AI system.

7. 07

   Life cycle, data and transparency controls (A.6–A.9)

   Evidence the controls you selected operate: requirements, validation, deployment approvals, monitoring, event logs, data provenance and quality, user information and incident communication.

8. 08

   Suppliers and customers (A.10)

   Responsibilities allocated with AI suppliers and customers, and supplier checks.

9. 09

   Internal audit and management review (9.2–9.3)

   At least one completed internal audit of the AIMS and a management review before the certification audit.

10. 10

    Corrective action (10.2)

    A log of nonconformities found and how they were fixed.

An independent certification body audits your AIMS in two stages. Stage 1 reviews the design and documentation; Stage 2 tests whether it operates as described, including clause 8 activities, monitoring, internal audit and management review. After a positive decision, the certificate runs for three years, with surveillance audits every calendar year and a full recertification audit before it expires ^[18][17].

Choose a certification body that is accredited for ISO/IEC 42001 by a national accreditation body. ANAB in the US opened its program in January 2024, and in September 2024 Schellman announced it was the first ANAB-accredited body ^[8][20]; UKAS granted its first accreditation, to BSI, in January 2026 ^[19]. ISO/IEC 42006:2025 sets auditor competence rules and how audit time is calculated for AI management systems, and accreditation bodies such as the Standards Council of Canada are moving certification bodies onto it ^[9][28].

• Certification, step by step →Readiness, Stage 1 and 2, audit days, timelines and surveillance in detail.
• Certification cost calculator →Estimate audit days and first-year cost for your size and scope.
• ISO 42001 audit firms →Compare certification bodies by accreditation, region and services.
• Who is certified →Our verified, primary-sourced list of ISO 42001 certified companies.

More detail: NIST AI RMF vs ISO 42001 and SOC 2 vs ISO 42001.

ISO 42001 is not a harmonised standard under the EU AI Act, so certification does not give a presumption of conformity. The European Commission says the standard’s goals and definitions are not aligned with the quality management system the AI Act requires, which is why it asked European standards bodies for a new one ^[13]. The European adoption, EN ISO/IEC 42001:2026, carries no annex linking it to the Act ^[15].

ISO 42001 is still useful groundwork. An analysis of the draft EN 18286 by the Cloud Security Alliance found that the draft maps its requirements to ISO 42001’s Annex A controls, so parts of an existing AIMS can be reused ^[25]. But the AI Act regulates AI systems, not organizations: providers of high-risk systems still need system-level technical documentation, testing and a conformity assessment, which a 42001 certificate does not replace ^[15]. After the Digital Omnibus, high-risk obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems ^[26]; see our AI compliance timeline.

ISO sells ISO/IEC 42001:2023 for CHF 225 (51 pages) ^[1]; national standards bodies sell their own adoptions, such as EN ISO/IEC 42001:2026 in Europe ^[15]. ISO’s official sample shows the foreword, contents and scope ^[3]. Free full-text “ISO 42001 PDF” copies circulating online are not licensed by ISO.

Compliance platforms can hold your AI inventory, policies, risk and impact assessments and evidence in one place, and map them to Annex A. Compare them in our independent ranking of ISO 42001 software, or browse every vendor that supports the standard below.