ISO/IEC 42001: The AI Management System Standard Explained

What is ISO/IEC 42001?

ISO/IEC 42001 is an international standard that specifies requirements for an artificial intelligence management system, meaning the policies, processes and controls an organization uses to govern how it develops, provides or uses AI. ISO describes it as applying to organizations of all sizes and sectors, and its title is "Information technology: Artificial intelligence: Management system."

ISO's pages describe a Plan-Do-Check-Act approach, which means an organization sets up the system, runs it, checks it and improves it, and repeats the cycle.

Is ISO/IEC 42001:2023 still the current edition?

As of October 26, 2026, the ISO committee page for the standard lists Edition 1, published in December 2023, with the status "Published." The page lists no amendments.

The standard is ISO/IEC 42001:2023 and runs to 51 pages in English and French. This guide does not reproduce the standard's text. It describes the standard only as ISO's own pages and a national standards body describe it. If you plan to build a system against the standard, obtain the current text from ISO or your national standards body and work from that, not from any summary, including this one.

What does ISO/IEC 42001 require?

The standard requires an organization to run an AI management system with defined leadership, policy, planning, support, operation, evaluation and improvement. ISO's overview lists these requirement areas:

• leadership and organizational context
• AI policy and objectives
• AI risk management
• data governance and lifecycle controls
• transparency
• performance evaluation
• continual improvement

What are the annexes in ISO/IEC 42001?

Standards Australia describes four annexes. Annex A lists reference control objectives and controls, such as AI policy, data quality, information for users, logs, human oversight and supplier and customer relationships. Annex B gives implementation guidance for those controls. Annexes C and D cover example AI-related objectives and risk sources, and use of the management system across domains and alongside other management system standards.

Check any annex against the published standard before you rely on it.

Who needs ISO/IEC 42001?

The standard is written for organizations that develop, provide or use AI. ISO's overview names AI developers, organizations that embed AI in products or services, organizations that use AI for decisions or automation, and organizations that rely on third-party AI.

Whether you pursue it is a business decision. A management system standard gives you a recognized structure for governing AI. It does not replace legal advice about the laws that apply to you.

Is ISO/IEC 42001 certification required, and who certifies?

Certification is voluntary, and ISO does not certify organizations. ISO's overview says certification for ISO/IEC 42001 is voluntary and is carried out by independent certification bodies, which may be accredited by national accreditation bodies.

A second ISO standard covers the certifiers. ISO/IEC 42006:2025, published in July 2025, sets out additional requirements for bodies that audit and certify AI management systems. ISO's page says it builds on ISO/IEC 17021-1, the general standard for management system certification bodies, and does not replace it. It is aimed at certification bodies and at the accreditation bodies that assess them.

Accreditation bodies have set up programs to match. The ANSI National Accreditation Board (ANAB) lists an ISO/IEC 42001 accreditation program for certification bodies, and the UK Accreditation Service (UKAS) has announced accreditation of certification bodies for the standard. Before you choose an auditor, ask which accreditation body accredits it, for which standard and edition, and confirm the scope in that body's own directory.

How does ISO/IEC 42001 relate to ISO/IEC 27001?

Both are management system standards, and ISO's own pages place them side by side. ISO's AI overview lists ISO/IEC 42001 alongside other management system standards, including ISO 9001, ISO 14001 and ISO/IEC 27001. ISO's committee page for the standard also lists ISO/IEC 27001:2022 in a bundle with it.

Standards Australia says the AI standard follows ISO's harmonized structure, so it aligns with existing management system standards, and includes guidance on integrating AI governance with information security and privacy management systems. An organization that already runs an information security management system under ISO 27001 will find familiar ideas such as policy, risk assessment, internal audit and management review.

The subject matter differs. ISO/IEC 27001 is about information security. ISO/IEC 42001 is about governing AI, including topics such as AI risk, AI system impact assessment, and responsible development and use. The two systems can support each other, but one does not stand in for the other, and a certificate for one is not a certificate for the other.

If your AI systems process personal data, a privacy management system is a third piece. See our guide to ISO 27701.

How does ISO/IEC 42001 relate to the NIST AI RMF?

ISO/IEC 42001 is a management system standard with an audit-based certification route, and the NIST AI RMF is a voluntary framework from the US National Institute of Standards and Technology. NIST says the AI RMF is "intended for voluntary use" and released AI RMF 1.0 on January 26, 2023. As of October 26, 2026, NIST's page also says AI RMF 1.0 is being revised as part of the White House AI Action Plan.

NIST's AI Resource Center lists a crosswalk titled "NIST AI RMF to ISO/IEC FDIS 42001 AI Management system Crosswalk." It pairs AI RMF subcategories, starting with Govern 1.1, with clause numbers and clause titles from the ISO/IEC FDIS 42001, such as AI policy, AI risk assessment and AI system impact assessment. FDIS means final draft, so the crosswalk predates the published standard. Check each mapping against the published 2023 text.

The Resource Center says listed crosswalks are submitted by the AI RMF user community, that inclusion does not imply NIST endorsement, and that neither resource necessarily covers the other comprehensively. Treat a crosswalk as a starting point for your own analysis. For the framework itself, see our NIST AI RMF guide.

Does ISO/IEC 42001 satisfy AI laws such as the EU AI Act?

The ISO pages read for this guide do not say that following the standard satisfies any law. ISO/IEC 42001 is a voluntary management system standard, and AI laws set their own obligations, scope and dates.

Read the law itself and take legal advice on how it applies to your systems. Our EU AI Act guide covers that regulation separately.

How does Purplecop AIMS relate to ISO/IEC 42001?

Purplecop AIMS is Purplecop Security's product for governing the AI estate, and its product page says it is mapped to ISO 42001, the NIST AI RMF and the EU AI Act. Purplecop AIMS is built in the same shape as Purplecop GRC and has 10 modules.

The modules named on the product page are:

• AI Frameworks, which maps ISO 42001, the NIST AI RMF and the EU AI Act "like any other framework"
• Model Inventory, for every model, its owner, its purpose and its risk classification
• AI Controls, the control library extended to AI-specific obligations
• AI Policies, covering acceptable use, model lifecycle and human oversight
• AI Risk Register, where model risk is scored on impact and autonomy, not just likelihood
• AI Vendor Assessment, for third-party models and AI services
• AI Audit, internal audit of the AI management system with the evidence attached
• Conformity Evidence, AI Awareness and AI Trust Center

Where should an organization start with ISO/IEC 42001?

Start by deciding what you want the standard for, then work through the standard's own clause areas. The standard asks for scope, leadership commitment and an AI policy, followed by AI risk assessment and treatment, impact assessment, operation, internal audit and management review, so those are a sensible order of work.

These questions help:

• Which AI systems do we develop, provide or use, including third-party ones, and who owns each?
• Do we want certification, or only a governance structure?
• Which parts of an existing management system can we reuse?

What is ISO/IEC 42001?

ISO/IEC 42001 is the international standard for AI management systems. It specifies requirements for establishing, implementing, maintaining and continually improving a management system for AI in organizations that provide or use AI-based products or services.

When was ISO/IEC 42001 published?

ISO published Edition 1, ISO/IEC 42001:2023, in December 2023. As of October 26, 2026, ISO's committee page lists it as published and lists no amendments.

Is ISO/IEC 42001 certification mandatory?

No. ISO says certification for ISO/IEC 42001 is voluntary. Whether a customer, contract or regulator asks for it is a separate question to answer in your own situation.

Who issues ISO/IEC 42001 certificates?

Independent certification bodies issue them, not ISO. ISO says these bodies may be accredited by national accreditation bodies, and ISO/IEC 42006:2025 sets additional requirements for bodies that audit and certify AI management systems.

Is ISO/IEC 42001 the same as ISO/IEC 27001?

No. Both are management system standards, and ISO's pages place them alongside each other, but ISO/IEC 27001 addresses information security and ISO/IEC 42001 addresses the governance of AI. Standards Australia says the AI standard follows ISO's harmonized structure and includes guidance on integrating with information security management systems.

How is ISO/IEC 42001 different from the NIST AI RMF?

ISO/IEC 42001 is an international standard with requirements for an AI management system, and its pages describe voluntary third-party certification. The NIST AI RMF is a voluntary framework from NIST, and its text describes no certification scheme for organizations. NIST's AI Resource Center lists a crosswalk between them that maps to the final draft of ISO/IEC 42001, not the published text.

Does ISO/IEC 42001 compliance mean we comply with the EU AI Act?

The ISO pages read for this guide do not say so. The standard is voluntary and the EU AI Act is a law with its own obligations, so take legal advice on how the law applies to you.

Does Purplecop AIMS map to ISO/IEC 42001?

The Purplecop AIMS product page says it is mapped to ISO 42001, the NIST AI RMF and the EU AI Act. Mapping is not certification or a compliance status, and Purplecop AIMS does not make an organization certified or audit-ready.