ISO/IEC 42001 certificationArtificial Intelligence Management

Any organisation that develops, provides or uses AI systems can be certified, regardless of size or sector. The standard applies whether you build models yourself, integrate third-party AI into products, or use AI tools in your own operations. Your scope and role, for example AI provider or AI user, determine which controls are relevant.

Clause 6.1.4 requires a process to assess the potential consequences for individuals, groups and societies that can result from the development, provision or use of AI systems. It considers intended use and reasonably foreseeable misuse, and the technical and societal context. Results feed into AI risk assessment and treatment and must be retained as documented information.

Annex A of ISO/IEC 42001:2023 contains 38 controls grouped under nine control objectives, covering policies, internal organisation, resources, impact assessment, AI system life cycle, data, information for interested parties, use of AI systems, and third-party and customer relationships. As with ISO/IEC 27001, you justify inclusion and exclusion of each control in a Statement of Applicability.

No. The EU AI Act sets legal obligations that depend on the risk category of AI systems and your role. ISO/IEC 42001 provides a management system that can support many governance activities the Act expects, such as risk management and documentation, but certification is not a legal conformity assessment under the Act. Organisations should seek legal advice on specific obligations.

Yes. Organisations that use AI systems, including generative AI tools, can still face risks around data, decision-making, transparency and supplier dependency. The standard lets you define your role as an AI user and apply relevant controls, such as responsible use processes, supplier management and monitoring. The scope and controls will be narrower than for a developer.

Both use the Harmonized Structure and a similar approach to risk assessment, risk treatment and a Statement of Applicability. ISO/IEC 27001 focuses on information security, while ISO/IEC 42001 addresses wider AI risks such as bias, transparency and societal impact. Many organisations extend an existing ISMS to create an integrated system and choose combined audits.

No. ISO/IEC 17021-1 does not allow certification bodies to provide management system consultancy to the organisations they certify. You can develop your AI governance internally or with an independent adviser. We can offer an optional pre-assessment that provides an impartial view of readiness against the standard.

Before Stage 2 you need your AI risk and impact assessments, Statement of Applicability, controls in operation, an internal audit and a management review. Most organisations at that stage complete Stage 1 and Stage 2 within eight to twelve weeks of booking. The number of AI systems and their complexity strongly influence audit duration.