Insights · Question
What is ISO/IEC 42001?
ISO/IEC 42001 is the international standard, published in 2023, for an artificial intelligence management system: the policy, roles, risk and impact assessments, controls, lifecycle processes and records by which an organization governs the AI it develops, provides or uses. An accredited certification body audits the system and issues a certificate, as with ISO/IEC 27001, with which it shares structure and can be integrated. It is asked for by customers and markets that want documented AI governance, and it applies to organizations that use AI as well as those that build it; the scope determines which controls apply.
In more detail
The reasoning.
Readiness means a gap assessment against every clause and control, the AI policy and objectives, the AI use inventory, risk and impact assessments, the Statement of Applicability, lifecycle procedures, an evidence pack, and the internal audit and management review completed before certification.
The NIST AI Risk Management Framework is the voluntary alternative for organizations that want recognized structure without certification; alignment with it can stand alone or be a step toward 42001.
See ISO/IEC 42001 readiness, NIST AI RMF alignment and the glossary entries for ISO/IEC 42001 and NIST AI RMF.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 90 days