Framework Cross-Industry Management Systems
ISO/IEC 42001 is the first international management system standard for artificial intelligence. Published in December 2023, it gives an organization that develops, provides, or uses AI systems a structure for governing them: an AI policy, defined roles, risk and impact assessments for AI systems, controls over the AI life cycle, and ongoing monitoring and improvement.
It follows the same high-level structure as ISO 27001 and ISO 9001, so it is usually bolted onto an existing management system rather than built alone.
In writing, the standard expects an AI policy, a scope statement listing the AI systems and roles in scope, an AI risk assessment and treatment plan, AI system impact assessments, a statement of applicability against the Annex A controls, documented processes for the AI life cycle (data, development, deployment, operation, retirement), records of responsibilities and competence, and the usual internal audit, management review, and corrective action records.
Voluntary. Adopted by AI vendors, cloud and SaaS providers, and enterprises using AI at scale, mostly to answer customer due diligence and to show a governance program that lines up with laws such as the EU AI Act. No regulator currently mandates certification.
AI policy and scope; inventory of AI systems and their roles (provider, user, developer); AI risk assessment methodology, results, and treatment plan; AI system impact assessments; statement of applicability and control implementation evidence; data management and data quality records; development, testing, deployment, and monitoring procedures; supplier and third-party AI controls; incident and change records; competence and awareness records; internal audit, management review, and corrective action records.
Where the requirement sits: 5.2 AI policy; 7.3 awareness; 7.5; 6.1.2 AI risk assessment; 6.1.4 impact assessment; Annex A A.2 policies, A.3 roles
Because the standard is new, the accredited certification body pool is still expanding. Before signing, check the certification body appears in an accreditation body directory (for example the ANAB directory) with ISO/IEC 42001 in its scope. Unaccredited certificates exist in the market and carry less weight with customers.
Public estimates put the number of certified organizations worldwide in the hundreds as of early 2026.
Writes, approves and proves acknowledgment of the AI policy set - the 5.2 / 7.3 / A.2 layer.
AllyMatter publishes this site.
Assessors
Accredited certification body accredited to ISO/IEC 17021-1 with ISO/IEC 42006 requirements for AI management system certification. Accredited by National accreditation bodies; ANAB launched its ISO/IEC 42001 accreditation program in January 2024 and several US and international certification bodies now hold ANAB accreditation for it.
Other accreditation bodies have followed or are in progress (verify for the specific certification body you choose).
Public register of assessors: https://search.anab.org/
No firm has claimed a ISO 42001 assessor listing yet. Claim yours →
Consultants
A fast-growing consultant ecosystem exists, largely the same firms that implement ISO 27001 and SOC 2. Implementers inventory AI systems, run risk and impact assessments, draft the AI policy and life cycle procedures, map controls to the Annex A list, and prepare the organization for audit. Engagements commonly run three to six months where an ISO 27001 system already exists.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
Software
Tools that name this framework in their own material.
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Approve the policies ISO 42001 asks for, keep every version, and record a named acknowledgment from each person who has to read them.