ISO/IEC 42001:2023
The international standard for an AI management system (AIMS), published by ISO and IEC in December 2023. It uses the ISO High Level Structure (Annex SL) and provides requirements and guidance for establishing, implementing, maintaining, and continually improving an AI management system. It maps closely to the prEN 18286 structure (Annex D of prEN 18286 provides the correspondence), making it a strong foundation for Article 17 QMS implementation.
Defined in 6 GAGE programs, which carry 17 distinct definitions of it. The wording above is taught in EU AI Act Implementation Expert.
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
The international standard for an AI management system (AIMS), published by ISO and IEC in December 2023. It uses the ISO High Level Structure (Annex SL) and provides requirements and guidance for establishing, implementing, maintaining, and continually improving an AI management system. It maps closely to the prEN 18286 structure (Annex D of prEN 18286 provides the correspondence), making it a strong foundation for Article 17 QMS implementation.
The international standard for AI management systems, published by ISO in December 2023, specifying organizational requirements (policy, risk assessment, competence, operational controls, performance evaluation, continual improvement) for how an organization governs its AI development and deployment; functions as connective tissue across jurisdictions but does not substitute for any jurisdiction's substantive legal requirements.
The first international management-system standard for artificial intelligence, providing a certifiable framework for operational controls, monitoring, and continual improvement of AI systems, structured similarly to how ISO 27001 governs information security. A mature agent trail program provides direct evidentiary support toward this standard's operational-control and monitoring requirements.
The first international standard specifying requirements for an AI management system, published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in December 2023. It is voluntary but certifiable by an accredited third party.
The first international standard for an Artificial Intelligence Management System (AIMS), published December 18, 2023, certifiable by accredited bodies, providing external proof of AI governance.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- Regulatory Landscapes: AI Laws and Governance Frameworks · Ethical and Responsible AI and Operational Governance, Certified AI Practitioner: Workplace Foundations
- Data poisoning: how an attacker teaches your model on purpose · Poison, Leaks, and the Adversary, Certified AI Data Governance Professional (CADGP)
- The agent's trail: who acted, on whose authority, using what, and why, recorded for every autonomous touch of your estate · Access and the Keys, Certified AI Data Governance Professional (CADGP)
- The poisoned quarter: an attacker has been feeding your pipelines, find the entry point · Adversarial Data Governance, Certified AI Data Governance Professional (CADGP)
- The board inspection: the seven-seat AI board audits the estate end to end · The Estate Audit, Certified AI Data Governance Professional (CADGP)
- NIST AI RMF as an operating system: mapping your organization onto govern, map, measure, manage · The World's Rulebooks, Certified AI Governance Professional (CAIGP)
- ISO/IEC 42001: standing up an AI management system without drowning in it · The World's Rulebooks, Certified AI Governance Professional (CAIGP)
- Standards versus law: what certification buys you and what it never will · The World's Rulebooks, Certified AI Governance Professional (CAIGP)
- The agent audit trail: logging actions so you can reconstruct any decision it made · Agents Under Command, Certified AI Governance Professional (CAIGP)
- Agent governance policy: the one-page rules for every agent your organization runs · Agents Under Command, Certified AI Governance Professional (CAIGP)
Where it shows up at work
A definition is where ISO/IEC 42001:2023 starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Builds and audits an AI management system: context, leadership, planning, support, operation, performance evaluation, improvement and the Annex A controls.
2 lessons on this page teach it as a primary outcome.
Collects, labels and preserves the evidence that a control operated, a decision was made, and a claim can be defended to an auditor or regulator.
2 lessons on this page teach it as a primary outcome.
Compares the EU AI Act, NIST AI RMF, ISO/IEC 42001 and sector rules by intent and control objective, and says where they do not overlap.
2 lessons on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- Senior AI Compliance Analystneeds it at depth
- Security Compliance Managerneeds it at depth · 4 open postings this week
- AI Compliance Specialistneeds working knowledge · 1 open posting this week
- AI Auditorneeds it at depth · 9 open postings this week
- GRC Associate (AI)needs it at depth
- AI Governance Analystneeds working knowledge · 3 open postings this week
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: ISO/IEC 42001:2023; ISO/IEC 23894; ISO/IEC 42005; EU AI Act Articles 11 and 12.
One interview question about it
What does an ISO/IEC 42001 management system add that a set of policies does not, and how would you prepare for certification?
Asked of candidates for iso/iec 42001 management systems. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Compliance and regulatory affairs carries it as work you can show: Audit-ready documentation is what you produce.
- Internal audit and IT audit carries it as work you can show: Evidence evaluation is the profession.
- Project and program management carries it as a claim to back up: Decision logs and repositories are familiar.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.