Skip to content
ESHETell us your idea

Home › Technology blog › ISO quality

ISO/IEC 42001 explained: what it requires from a company that uses AI

ISO/IEC 42001 is the first international standard for artificial intelligence management systems. What it asks for in practice, how it relates to ISO 27001 and where to start if you want to certify.

Farid Jiménez · · 7 min read

  • ISO/IEC 42001
  • ISO/IEC 27001
  • AI governance
  • Compliance

ISO/IEC 42001 is the international standard published in December 2023 that defines an artificial intelligence management system (AIMS). It does not certify a model or a product: it certifies that the organization responsibly governs how it develops, buys and uses AI. It follows the same high-level structure as ISO 9001 and ISO/IEC 27001, which is why it integrates with them.

What ISO/IEC 42001 is and who it applies to

It applies to any organization that develops, provides or uses AI systems, whatever its size or sector. A company that only uses an AI assistant for customer service is in scope, just like one that trains its own models. The standard asks you to show, with evidence, that the risks of those systems are identified, treated and reviewed.

What it asks for in practice

  1. An AI policy approved by management: what AI is used for, what it is not used for, and who is accountable.
  2. An inventory of AI systems: every model, assistant or agent in use, its provider, its data and its internal owner.
  3. An impact assessment per system: who it affects, what can go wrong (bias, error, data leak) and what is done about it.
  4. Annex A controls: human oversight, data quality, transparency with affected people, decision logging, incident response.
  5. Continual improvement: internal audit, management review and corrective actions, as in any management system.

How it relates to ISO/IEC 27001 and ISO 9001

StandardWhat it managesWhat it shares with 42001
ISO 9001Quality of products and servicesDocumented processes, continual improvement, audits
ISO/IEC 27001Information securityRisks, controls, incident management, suppliers
ISO/IEC 42001Responsible use of AIThe same structure; adds impact on people and transparency

If you already have 27001, about half the road is done: risk analysis, supplier control and incident management extend to AI. What is new is the impact assessment on people and transparency.

Where to start if you want to certify

  • Do the inventory first. Nobody can govern what they do not know they use; AI tools the team adopted on their own will surface.
  • Write the policy in your company's language, not copied from a generic template; the auditor checks it against practice.
  • Start logging today what your assistants and agents do: evidence accumulates, it is not manufactured.
  • Integrate, do not duplicate: one management system covering quality, security and AI, with one management review.
  • Certification is issued by an accredited body after an external audit; a consultancy prepares you, it does not certify you.
The AI management cycle: the same logic already familiar to anyone with 9001 or 27001.

ISO/IEC 42001 does not ask which model you use. It asks whether you know what it does, who it affects and who is accountable.

Have a similar case? Tell us your idea and we tell you what makes sense, how long it takes and how we control it.

Tell us your ideahola@neona.tech