ISO/IEC 42001:2023 is the current published first edition of the AI management-system standard. It applies to organisations of any size or sector that provide or use products or services using AI systems and sets requirements for establishing, implementing, maintaining, and continually improving an artificial intelligence management system ().
Start with scope and inventory, then move through Clauses 4-10, risk and impact decisions, the , operating evidence, internal audit, management review, and corrective action.
Clauses 4-10 contain the management-system requirements. Normative is a reference control set used during ; normative Annex B gives adaptable implementation guidance; informative Annexes C and D provide possible objectives, risk sources, and cross-domain context. Certification is voluntary and concerns the defined scope, not an individual model or automatic legal compliance.
Common starting points
Use these guides to define the Artificial Intelligence Management System () required by ISO/IEC 42001, choose controls, assess impacts, and design . Certification covers the defined management-system scope; it does not certify an individual model or automatically prove legal compliance.
ISO/IEC 42001 controls can assign trained people to review AI outputs, monitor performance and accuracy, report concerns, and override decisions under defined authority. For example, a credit reviewer can check the recommendation and its inputs, record a concern, and use the organization's documented override route.
Review human oversight requirementsThe scope states which business units, locations, AI activities, systems, suppliers, and interfaces the management system covers. are people or organizations that affect, use, regulate, or are affected by that scope, such as workers, customers, regulators, and model suppliers.
Define the AIMS boundaryAn records how a specific use could affect people, groups, or society. For a hiring tool, examine exclusion, accessibility, biased ranking, privacy, explanation, appeal, and human intervention in the actual legal and workplace setting. Reassess on schedule and before a significant change.
Use the impact assessment templateselects controls for assessed AI risks. Compare the controls needed with , add any necessary controls outside it, and record inclusion and exclusion reasons in the . The treatment plan also needs management approval and acceptance of residual risk.
Map controls and governanceDefine the boundary and AI-system inventory first. Then map Clauses 4-10, run and impact assessment, operate necessary controls, and evaluate the system. These pages explain the decision path but do not replace the licensed standard.
Determine the organisational boundary, AI activities and roles, relevant interested parties and requirements, external interfaces, and system inventory that later risk and control decisions depend on.
Understand Clauses 4-10, the distinct roles of Annexes A-D, leadership and policy, risk planning, support, operation, performance evaluation, and improvement.
Turn risk and impact methods, the statement of applicability, residual-risk approval, selected controls, supplier responsibilities, monitoring, audit, and corrective action into traceable records.
See how ISO/IEC 42001 differs from risk guidance and law, and where ISO/IEC 23894, the NIST AI RMF, or the EU AI Act still require separate interpretation and mapping.
Route ISO/IEC 42001 implementation into owned tasks, evidence requests, and review checkpoints so standards work does not remain scattered across documents.