ISO 42001

Who has to comply

Voluntary. Adopted by AI vendors, cloud and SaaS providers, and enterprises using AI at scale, mostly to answer customer due diligence and to show a governance program that lines up with laws such as the EU AI Act. No regulator currently mandates certification.

What the assessor asks to see

AI policy and scope; inventory of AI systems and their roles (provider, user, developer); AI risk assessment methodology, results, and treatment plan; AI system impact assessments; statement of applicability and control implementation evidence; data management and data quality records; development, testing, deployment, and monitoring procedures; supplier and third-party AI controls; incident and change records; competence and awareness records; internal audit, management review, and corrective action records.

Where the requirement sits: 5.2 AI policy; 7.3 awareness; 7.5; 6.1.2 AI risk assessment; 6.1.4 impact assessment; Annex A A.2 policies, A.3 roles

Accreditation status

Because the standard is new, the accredited certification body pool is still expanding. Before signing, check the certification body appears in an accreditation body directory (for example the ANAB directory) with ISO/IEC 42001 in its scope. Unaccredited certificates exist in the market and carry less weight with customers.

Public estimates put the number of certified organizations worldwide in the hundreds as of early 2026.