Your product now uses AI, and buyers have started asking how you govern it: who approves a new model, how you assess its impact, where the training data came from, and what happens when it gets something wrong. Readiness builds an AI management system under ISO/IEC 42001 that answers those questions with policy, records and accountable owners. You can pursue certification with confidence and answer AI due-diligence questionnaires from evidence instead of assurances.
ISO/IEC 42001:2023 is the first international management-system standard for artificial intelligence. It specifies an AI management system (AIMS) using the same clause 4 to 10 structure as ISO 27001, covering context, leadership, planning, support, operation, performance evaluation and improvement, applied to the responsible development, provision and use of AI systems. You determine your role in relation to AI, such as provider, developer or user, and the AIMS is shaped by that role.
Its distinctive requirements are an AI policy, AI risk assessment and treatment, and AI system impact assessment: a documented look at the potential consequences of an AI system for individuals, groups of individuals and society, not only for your own organization. Annex A sets out reference controls for policies related to AI, internal organization, resources for AI systems, assessing impacts, the AI system lifecycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships. Annexes B, C and D add implementation guidance, possible AI objectives and risk sources, and use across domains and sectors.
Teams come to ISO 42001 because AI questions have moved into security reviews and contracts, and a recognized, auditable framework is a stronger answer than a principles page. Because it shares the harmonized management-system structure, organizations that already run an ISO 27001 ISMS can extend their governance, risk, document control and audit machinery to AI rather than build a parallel program.
Your SaaS now includes generative or predictive features, and customers want to know how you control them. Readiness gives you a governed lifecycle, impact assessments and transparency information you can share with buyers.
Your product is the model or the AI system. Buyers now treat AI governance the way they treat security, and a certifiable AIMS lets you meet that expectation with a recognized international standard rather than your own framework.
You have an ISMS, internal audit and management review in place. Readiness extends them to AI risk, impact assessment and the Annex A AI controls, and shows which policies and records can serve both management systems.
You mostly buy and deploy AI rather than build it. ISO 42001 applies to AI users too, so readiness covers how you select, approve, monitor and retire AI systems and the suppliers behind them.
An accredited certification body you choose, accredited for ISO/IEC 42001 by an IAF-member accreditation body such as ANAB or UKAS
ISO/IEC 42001:2023 certificate for your defined AI management system scope, kept in force through surveillance audits and recertification
As with ISO 27001, the certification body cannot be the one that helps you build the system it certifies. We work with you on the AIMS and its evidence; the certification body you select reaches its own independent conclusion.
A register of the AI systems you develop, provide or use in scope, with owner, purpose, your role and data sources: the foundation every other ISO 42001 requirement depends on.
Each requirement and each Annex A control rated against your current practice, with the evidence that exists and what an auditor would find missing.
An AI policy aligned with your business objectives and the procedures beneath it for approving, changing, monitoring and retiring AI systems.
Risk criteria that account for AI-specific sources such as data quality, opacity, automation and model drift, and a register populated for your systems.
An impact assessment method consistent with ISO/IEC 42005 guidance, and completed assessments for the systems that matter most to your customers.
A draft SoA for the Annex A controls, linked to your AI risk treatment, with reasons for every inclusion and exclusion.
Templates and starter records for verification and validation criteria, release approval, data provenance and quality, and model change history.
Where your ISO 27001 processes, policies and records can be reused for the AIMS, and where AI needs its own, so you avoid duplicating a management system.
How your AIMS lines up with the NIST AI Risk Management Framework and, where it applies to you, the EU AI Act, so one body of evidence answers several kinds of questions.
Better found now, by people on your side, than by your assessor.
No complete inventory of AI systems in use, including AI features embedded in third-party tools
AI risk folded into the general security risk register, with no assessment of impact on individuals or society
No documented role determination: the organization has not decided whether it acts as provider, developer, user or several of these
Model and data provenance undocumented, with training or fine-tuning data sources, licensing and quality checks unrecorded
Model and prompt changes released without defined verification, validation and approval criteria
No channel for users or affected people to report problems with AI outputs
AI supplier contracts silent on data use, model changes and incident notification
Human oversight described in policy but never designed into the system or evidenced in operation
Verification and validation in the AI lifecycle, and AI risks such as prompt injection, sensitive data disclosure and insecure output handling, are best evidenced by testing the system adversarially.
What the test coversMost AI features are reached through APIs; testing them shows that model endpoints enforce authorization and do not expose one customer’s data to another.
What the test coversThe application wrapped around your model is part of the AI system, and its weaknesses are AI-system risks your impact and risk assessments should account for.
What the test coversTraining data, model artifacts and inference infrastructure usually live in cloud services; a configuration review checks that access to them matches your data-for-AI controls.
What the test coversNo. The EU AI Act is a regulation whose obligations depend on how your AI systems are classified and on your role, and ISO 42001 certification does not by itself demonstrate conformity with it. What an AIMS gives you is the management system, with inventory, risk and impact assessment, lifecycle controls, documentation and oversight, into which many of the Act’s requirements can be organized. If the Act applies to you, its specific obligations still have to be assessed and met on their own terms.
The NIST AI RMF is a voluntary US framework organized around four functions, Govern, Map, Measure and Manage, and it has no certification. ISO 42001 is a certifiable management-system standard. They complement each other: many US organizations use the AI RMF and its Generative AI Profile to shape their risk work and ISO 42001 to make that work auditable.
No. ISO 42001 can be certified on its own. Because the two standards share the same clause structure, organizations that already run an ISMS can usually reuse document control, internal audit, management review and corrective action, and many choose to have both systems audited by the same certification body.
Yes. The standard applies to organizations that provide or use AI systems. If you build a provider’s model into your product, or deploy AI tools internally, you remain responsible for how those systems are selected, configured, monitored and used, and Annex A includes controls specifically for third-party and customer relationships.
It is a documented assessment of the potential consequences of an AI system for individuals, groups of individuals and society, such as unfair outcomes, loss of privacy or harm from incorrect outputs, across the system’s intended uses and reasonably foreseeable misuse. ISO 42001 requires it as an exercise distinct from risk assessment, and its results feed your risk treatment. ISO/IEC 42005 gives further guidance on how to conduct one.
A certification body accredited for ISO/IEC 42001 by an IAF-member accreditation body. Accreditation programs for 42001 are newer than those for 27001, so confirm the body’s accreditation scope before you engage it. ISO/IEC 42006 sets the requirements for bodies that audit and certify AI management systems, and the same impartiality rule applies: the body that certifies you cannot be the one that built your AIMS.
One conversation with someone who does this work. You leave knowing where you likely stand and what readiness would involve for you.
Not sure where to start? One of our testers reviews your internet-facing footprint and sends you a short summary of what an attacker would see — free. Nothing you don’t own is ever touched, and there’s no sales sequence.
Free. No obligation.
