ISO 42001: Definition
ISO/IEC 42001:2023 is the first international standard for an artificial intelligence management system. It is published by ISO and the IEC, as outlined on the official ISO page. It specifies the requirements for establishing, implementing, maintaining, and continually improving an AI management system, often abbreviated as AIMS.
It is intended for organizations that develop, provide, or use AI systems, regardless of their size or sector. An industrial SME using a third-party AI tool is therefore just as concerned as a software publisher.
What is the purpose of the standard?
The goal is to make the use of AI controlled, traceable, and responsible. In practical terms, the management system helps to:
- define an AI policy and clear roles
- identify the risks and impacts of an AI system on people and the organization
- manage data, suppliers, and the system lifecycle
- monitor performance and address discrepancies
- continuously improve the framework
Structure of the standard
ISO 42001 follows the common structure for management system standards (clauses 4 to 10), the same as ISO 9001, 14001, or 45001 :
- context of the organization
- leadership
- planning (risks, objectives, impact assessment)
- support (resources, skills, documentation)
- operational activities
- performance evaluation (internal audit, management review)
- improvement
This similarity facilitates integration into an existing management system, a point explored in our article on integrating ISO 42001 into a QHSE management system.
Annex A : control measures
The standard includes an Annex A that lists control measures categorized into major areas : AI-related policies, internal organization, resources, impact assessment, system lifecycle, data, stakeholder information, usage, and third-party relationships. The organization selects those that address its risks and justifies its choices. The detailed text of these measures is provided in the standard, which is available from ISO or AFNOR.
Certification : what to expect ?
Certification is voluntary. It is issued by an accredited body following a multi-stage audit, followed by surveillance audits. AFNOR Certification presents its ISO 42001 certification offering and the expected process. Organizations that do not require a certificate can also use the standard as an internal framework.
ISO 42001 and the AI Act : a point of caution
The European AI Act imposes legal obligations based on the risk level of systems. ISO 42001 is a voluntary standard. To date, it is not a harmonized standard under the AI Act ; therefore, following it does not equate to a presumption of conformity. However, it does provide a useful governance foundation for preparation. Details can be found in our article ISO 42001 and the AI Act. For the obligations of the regulation itself, consult our guide on the AI Act obligations for user companies.
Where to start ?
Three initial concrete actions, accessible without a certification project :
- Inventory the AI tools used within the company, including those adopted by teams without formal approval.
- Classify each use case according to its impact (personal data, decisions affecting individuals, security).
- Designate a person in charge and set a simple usage policy.
To learn more about personal data issues in AI usage for prevention, download the white paper on AI, prevention, QHSE safety, and GDPR.
