ISO 42001, demystified — what teams need to know before certification
ISO/IEC 42001 is the AI equivalent of ISO 27001 for information security or ISO 9001 for quality. It defines an AI Management System (AIMS) — the set of policies, processes and controls an organisation uses to govern AI responsibly.
Unlike NIST AI RMF (voluntary guidance) and the EU AI Act (law), ISO 42001 is a certifiable standard. You can hire an accredited body to audit you and grant a certificate. That certificate is increasingly what enterprise buyers ask for in security reviews.
ISO 42001: step-by-step practical framework
The standard is structured like every other ISO management-system standard. If your team has done ISO 27001 or 9001, the shape will feel familiar.
- Clauses 4–10 — the core management system requirements
- Annex A — the catalogue of AI-specific controls (around 38 controls)
- Annex B — implementation guidance for each control
- Annex C — AI-related organisational objectives and risk sources
What an AI Management System actually contains
An AIMS is not a software product — it's documentation, processes and evidence that prove you're managing AI risk systematically.
- AI policy approved by leadership
- Defined AI roles and responsibilities
- Risk and impact assessment process
- Lifecycle controls (data, design, validation, deployment, monitoring, decommissioning)
- Third-party / vendor management process
- Internal audit and management review cadence
Certification process for best results
Certification has three phases: prepare, audit, maintain. Most organisations underestimate phase one.
Stage 1 — Documentation review
An accredited auditor checks your AIMS exists on paper: policies, procedures, risk register, statement of applicability. If the documents are missing or inconsistent, you don't progress.
Stage 2 — Implementation audit
The auditor checks the AIMS is actually being used. Interviews with staff, review of evidence, sample checks of controls. Findings are categorised as conformities, observations, minor non-conformities, or major non-conformities.
Surveillance
After certification, you face annual surveillance audits and a full recertification audit every three years.
Timeline and cost
Realistic numbers for a mid-sized organisation starting from a mature ISO 27001 baseline: 6–9 months to certification, $40k–$80k in consulting and audit fees, plus 0.5–1 FTE of internal effort.
Starting from no management-system experience at all: budget 12+ months and double those numbers.
ISO 42001 vs EU AI Act vs NIST AI RMF
These three are the trio most compliance programs converge on. They overlap but don't substitute for each other.
- EU AI Act — law. You comply or you face fines.
- ISO 42001 — certifiable standard. You comply to demonstrate maturity to buyers.
- NIST AI RMF — voluntary guidance. You use it to structure how you manage risk.