ISO/IEC 42001: the complete guide

ISO/IEC 42001:2023 is the first international management system standard for artificial intelligence, published in December 2023 by ISO and the IEC. It specifies what an organization must have in place to govern AI responsibly: a defined scope, leadership commitment, risk processes, lifecycle controls, and continual improvement. It follows the same Harmonized Structure as ISO 9001 (quality) and ISO/IEC 27001 (information security), so it bolts onto a management system an organization already runs.

Yes, and that is what sets it apart from frameworks like the NIST AI RMF. Accredited certification bodies audit an organization's AI management system against the standard and issue certificates. Two honest caveats: ISO itself certifies no one (certification bodies do), and a certificate covers the management system, not the goodness of any single AI product.

No. The standard and the Act overlap heavily in spirit (risk management, documentation, lifecycle control), and running a certified AI management system puts much of the Act's expected machinery in place. But the Act is law with its own specific obligations and its own conformity procedures, and no ISO certificate discharges them. Treat 42001 as strong preparation, never as a legal safe harbor.

They are different instruments that fit together. The NIST AI RMF is a voluntary risk framework: it tells you what good AI risk work looks like, in 72 subcategories, and certifies nothing. ISO/IEC 42001 is a certifiable management system standard: it tells you what organizational machinery must exist, and an auditor can attest that it does. Many organizations run the RMF's risk process inside a 42001 management system.

The Statement of Applicability (SoA) is the document where an organization lists which of Annex A's 38 controls it has adopted, and justifies every exclusion. Annex A is a reference set, not a mandatory checklist: the controls you implement are chosen through your risk assessment (Clause 6.1), and the SoA is the record of that choice. Auditors read it first.

Any organization that develops, provides or uses AI-based products or services, in any sector and at any size. The obligations scale with your role: a company building foundation models and a hospital deploying a triage model both run AI management systems, but the scope, risk profile and control selection differ. Clause 4 is where that scoping happens.

Clauses 1 to 3 are the standard's front matter (scope, normative references, terms) and are not auditable requirements; every Harmonized Structure standard works this way. Annex A.1 is the annex's introduction, so the nine control objectives run A.2 through A.10, and within each objective the first numbered entry is the objective itself, which is why the controls start at A.2.2.

No, and no training provider can. Certification is issued by accredited certification bodies after an audit of your management system. What a training program can do is build the competence the standard demands: Clause 7.2 makes competence an auditable requirement, and the AI Governance program exists to close exactly that gap.