ISO/IEC 42001

Why does it matter?

The Introduction to ISO/IEC 42001 names what is different about AI: automatic decision-making that can be non-transparent and non-explainable, systems built from data and machine learning rather than human-coded logic, and continuous-learning systems whose behavior changes during use. The standard does not answer these with a list of technical fixes. It asks the organization to manage them through a management system with a policy, risk assessment, impact assessment, controls and audit, so that an organization that conforms can generate evidence of its responsibility and accountability for the AI systems it provides or uses.

Key benefits include:

• Leadership that owns AI

Clause 5 covers leadership and commitment (5.1), the AI policy (5.2) and roles, responsibilities and authorities (5.3).

• An impact assessment for each AI system

Clauses 6.1.4 and 8.4 both address AI system impact assessment, a step separate from AI risk assessment (6.1.2 and 8.2).

• Risks and opportunities managed together

Clause 6.1 covers actions to address risks and opportunities, and clauses 8.2 and 8.3 repeat AI risk assessment and treatment in operation.

• Suppliers and partners in scope

The Introduction lists management of suppliers, partners and third parties that provide or develop AI systems among the crucial processes.

• A fit with other management systems

The harmonized structure lets the AIMS sit beside quality, safety, security and privacy management systems.

How does it work?

Clause 4 sets the foundation. The organization understands its context (4.1) and the needs and expectations of interested parties (4.2), determines the scope of the AI management system (4.3) and establishes the AI management system itself (4.4). Clause 5 then places responsibility with top management through leadership and commitment (5.1), an AI policy (5.2) and assigned roles, responsibilities and authorities (5.3).

Clause 6 plans the work: actions to address risks and opportunities (6.1), including an AI risk assessment (6.1.2), AI risk treatment (6.1.3) and an AI system impact assessment (6.1.4), then AI objectives and planning to achieve them (6.2) and planning of changes (6.3). Clause 7 supplies resources, competence, awareness, communication and documented information (7.1 to 7.5). Clause 8 puts the plans into operation through operational planning and control (8.1) and the AI risk assessment, risk treatment and AI system impact assessment steps (8.2 to 8.4).

Clause 9 evaluates the system through monitoring, measurement, analysis and evaluation (9.1), internal audit (9.2) and management review (9.3). Management review has defined inputs (9.3.2) and results (9.3.3), and the internal audit follows an audit program (9.2.2). Clause 10 closes the loop with continual improvement (10.1) and nonconformity and corrective action (10.2). Annex A (normative) holds the reference control objectives and controls, and Annex B (normative) holds the implementation guidance for them.

Key Elements

• AI policy (5.2)

The intentions and direction of the organization for AI, expressed by top management, against which the AI objectives of 6.2 are set.

• AI risk assessment and treatment (6.1.2, 6.1.3, 8.2, 8.3)

Planned in clause 6 and carried out again in clause 8, so risk decisions about AI systems are kept current.

• AI system impact assessment (6.1.4, 8.4)

A distinct assessment step; ISO/IEC 42005:2025 gives guidance on assessing effects on individuals, groups or society.

• Annex A controls and Annex B guidance

Normative reference control objectives and controls, with normative implementation guidance for the AI controls.

• Documented information (7.5)

General requirements, creating and updating, and control of the documents and records that show the AI management system operates.

• Internal audit and management review (9.2, 9.3)

An internal audit program (9.2.2) and a management review with defined inputs (9.3.2) and results (9.3.3).

What does it cover?

Clause 1 applies ISO/IEC 42001 to any organization, regardless of size, type and nature, that provides or uses products or services that utilize AI systems. It is intended to help the organization develop, provide or use AI systems responsibly while meeting applicable requirements and its obligations to interested parties and their expectations. Annex D covers use of the AI management system across domains or sectors. The Introduction asks organizations to focus on the features that are unique to AI and to apply the requirements with a risk-based approach to the AI use cases, services or products within the organization's scope.

What are its objectives?

Clause 1 and the Introduction state what the standard is for.

Help the organization develop, provide or use AI systems responsibly in pursuing its own objectives (clause 1).

Meet applicable requirements, obligations to interested parties and their expectations (clause 1).

Address trustworthiness concerns such as security, safety, fairness, transparency, data quality and quality of AI systems throughout their life cycle (Introduction).

Strike the appropriate balance between governance mechanisms and innovation by applying controls according to risk (Introduction).

Let the organization generate evidence of its responsibility and accountability for its role with respect to AI systems (Introduction).

Framework in Context

ISO/IEC 42001 is the AI management system standard in the ISO family. It applies the harmonized structure (identical clause numbers, clause titles, text and common terms) used across management system standards such as ISO/IEC 27001:2022, so one organization can run both. Related ISO documents on AI include ISO/IEC 22989 (AI concepts and terminology, a normative reference), ISO/IEC 23894 (guidance on AI-related risk management), ISO/IEC 42005:2025 (AI system impact assessment) and ISO/IEC 42006:2025 (certification bodies). It is not a law: obligations under legislation such as the EU Artificial Intelligence Act come from the legislation itself, and this page does not state that conformity with ISO/IEC 42001 satisfies them.

Common Framework Mappings

Organizations map ISO/IEC 42001 clauses and Annex A controls to the AI, risk, privacy and governance frameworks below so that one set of policies, assessments and records serves several audiences.

Mapped frameworks include:

EU Artificial Intelligence Act

ISO 31000:2018

ISO 27001:2022

ISO 27701

ISO/IEC 38500

ISO/IEC TR 24028

NIST AI RMF v1.0

OECD AI Principles