ISO/IEC 42001
The international standard for an AI management system (AIMS), which specifies how an organisation should govern, risk-assess and continually improve its use of AI.
Definition
ISO/IEC 42001, published in 2023, is the first international management-system standard for artificial intelligence. Like ISO 27001 for information security or ISO 9001 for quality, it does not prescribe specific technology. It specifies what an organisation must have in place to manage AI responsibly: leadership commitment, a defined scope, an AI policy, roles and responsibilities, risk and impact assessments, operational controls, performance evaluation, internal audit and continual improvement.
Its annexes list controls covering areas such as data for AI systems, system lifecycle, transparency to users, third-party and supplier relationships, and use of AI by the organisation itself. Certification is carried out by accredited bodies through an audit, and it can cover an organisation that develops AI, one that only uses it, or both.
Example: a SaaS vendor already certified to ISO 27001 adds AI features. Rather than build new processes, it extends its existing management system: AI risks join the risk register, an AI impact assessment is added to the release checklist, and the internal audit plan gains an AI scope. Certification follows an external audit.
Why it matters for your business
- It is the recognised way to demonstrate AI governance to customers, partners and regulators.
- Its structure maps well onto the EU AI Act's risk-management and documentation duties.
- It forces an AI inventory and clear ownership, which most organisations lack.
- It is proportionate: the scope and depth are set by your own risk assessment.
How Teksmobile uses it
Our ISO/IEC 42001 service runs a gap assessment against the standard, drafts the AIMS documentation and helps you prepare for the certification audit. It sits within our AI governance practice and connects to technical controls such as LLM security audits.
Related terms
Part of the Teksmobile AI Glossary. For longer reads, see our guides.
Frequently asked questions
Is ISO/IEC 42001 mandatory?
No. It is a voluntary standard. Certification is increasingly requested in procurement and can support, but does not by itself establish, compliance with laws such as the EU AI Act.
How does it relate to ISO 27001?
It uses the same management-system structure (context, leadership, planning, support, operation, evaluation, improvement). Organisations with ISO 27001 can extend existing processes rather than start again.
How long does certification take?
It depends on the starting point. Organisations with mature security governance often need months of focused work; those without a management system need longer. We scope this in an initial gap assessment.