Standard status
- Current published edition
- ISO/IEC 42001:2023 (first edition, published December 2023)
- Assessments conducted against
- The 2023 edition.
- Scheme type
- Management systems (artificial intelligence)
ISO/IEC 42001 is the international standard for an artificial intelligence management system, the way an organization governs its development, provision and use of AI so that it happens responsibly, deliberately and with its consequences understood. The system assists in ensuring that AI risks are assessed and treated, that the impacts of AI systems on people are examined before they are felt, and that the organization's use of AI stays aligned with its obligations and its own policy. An organization certified to ISO/IEC 42001 has had that system assessed against the standard by a certification body. The current edition is ISO/IEC 42001:2023, the first edition. For a buyer to rely on an ISO/IEC 42001 certificate, the standard must be paired with independent accreditation of the certification body that issued it.
What an AI management system is
An AI management system is the set of policies, processes and responsibilities through which an organization decides what it will and will not do with AI, understands the risks and impacts of the AI systems it builds or uses, and keeps that understanding current as the systems and their uses change. The standard applies to organizations on both sides of the technology, those providing AI products and services and those using them, so a company that never writes a line of model code but deploys AI in its operations is squarely within scope.
Like the other management system standards, ISO/IEC 42001 does not set performance thresholds for the technology itself and does not certify any individual AI system. It defines what the organization's governance of AI must address: policy, roles, risk assessment, impact assessment, controls over the AI system life cycle, and the records that demonstrate all of it is operating.
The standard is new territory in one respect. Alongside the familiar risk assessment, it requires an AI system impact assessment that looks outward, at the consequences of an AI system for individuals, for groups and for societies, not only at the risks to the organization itself. That outward look is what distinguishes AI governance from ordinary IT governance, and it is built into the requirements rather than added as commentary.
What ISO/IEC 42001 requires
The requirements are set out across seven areas, clauses 4 to 10, using the harmonized structure ISO now applies to its management system standards, with the plan-do-check-act cycle underneath. The subject matter threaded through them is the organization's AI systems, their risks, and their effects on people.
Context of the organization
The organization works out which internal and external issues affect what its AI management system is meant to deliver, identifies the interested parties who matter and their requirements, and draws the system's boundaries around the AI systems and activities it covers.
Leadership
Top management demonstrates leadership and commitment to the system, establishes an AI policy that frames what the organization will do with AI and on what terms, and assigns the roles, responsibilities and authorities that keep the system working.
Planning
Planning is where the standard does its most distinctive work. The organization:
• assesses its AI risks, shaped by the domain and application context of each AI system, its intended use, and the organization's own circumstances;
• treats those risks, determining the necessary controls and recording them in a statement of applicability with the reasons for including or excluding controls;
• carries out an AI system impact assessment: a defined, documented process examining what an AI system could do to individuals, to groups and to societies, through its deployment, the use it is meant for and the misuse that can be foreseen, in the setting and jurisdictions where it runs;
• feeds the impact assessment results back into the risk assessment, so what the system could do to people informs what the organization does about the system;
• sets measurable AI objectives and plans how to achieve them, and makes changes to the system in a planned manner.
Support
The resources the system needs, the competence of the people governing and operating AI, awareness across everyone working under the organization's control, the communication the system depends on, and the documented information the standard and the organization require.
Operation
Running the planned processes with criteria established and controls implemented, including the controls over the AI system life cycle determined at the planning stage, with their effectiveness monitored. Repeating the AI risk assessment at planned intervals or when significant change is proposed or occurs, implementing the risk treatment plan and verifying its effectiveness, and performing the AI system impact assessment likewise. Externally provided processes, products and services relevant to the system are controlled.
Performance evaluation
Monitoring, measuring, analyzing and evaluating the system, internal audit under a planned program, and management review by top management.
Improvement
Continual improvement of the system, and reaction to nonconformity with correction, cause analysis and corrective action so the problem does not return.
The AI system impact assessment
The requirement most worth understanding before reading a certificate is the AI system impact assessment. The organization must operate a defined process for assessing the consequences that developing, providing or using an AI system can have for individuals, for groups of individuals and for societies. The assessment covers how the system is deployed, how it is meant to be used and how it could foreseeably be misused, judged in the technical and social setting the system actually runs in and under the jurisdictions that apply. The result is documented, can be made available to interested parties where the organization decides it is appropriate, and feeds the organization's risk assessment.
This is governance of a different shape from most management system requirements, which look at risks to the organization. The impact assessment looks at what the organization's technology can do to other people, and obliges the organization to know the answer and act on it.
Two normative annexes carry the detail into practice. Annex A is the reference set of control objectives and controls for AI governance, used in the same way ISO/IEC 27001 uses its Annex A: the organization determines its controls from its own risk and impact work, checks them against the reference set, and justifies inclusions and exclusions in its statement of applicability. Annex B gives implementation guidance for those controls. Two informative annexes follow, covering potential AI-related organizational objectives and risk sources, and use of the system across domains and sectors.
Certification is not the whole story
An ISO/IEC 42001 certificate records a certification body's judgment that an organization's AI management system meets the standard, at the scope stated and at the time assessed. Who, in turn, checked that certification body?
Accreditation exists to answer exactly that. ASCB assesses bodies certifying AI management systems against ISO/IEC 17021-1 together with ISO/IEC TS 42006, which adds the requirements specific to auditing and certifying AI management systems, and ASCB itself works to ISO/IEC 17011, the international standard for accreditation bodies.
An accredited ISO/IEC 42001 certificate carries both checks, the organization's and the certifier's; an unaccredited one carries only the first, with no independent check on the certifier that issued it.
Accreditation is a periodic, risk-based assessment of a certification body against the requirements of the relevant standards, carried out by sampling and reflecting what was found at the time of assessment. It is not a continuous or exhaustive check, and it is not a guarantee of any individual certification decision or of any certified organization's products, services or outcomes. What it provides is independent, repeated assessment of the body issuing certificates against the requirements of the relevant standards, including its impartiality and the consistency of its decisions.
Why an accredited ISO/IEC 42001 certificate carries more weight
Claims about responsible AI are easy to make and hard to evaluate, and the market is full of them. An ISO/IEC 42001 certificate is a claim of a different kind: that an independent body assessed the organization's AI governance against an international standard. Whether that claim deserves weight depends on the certifier, which is why the question behind every new certification scheme is who checked the certification body. An accredited certificate answers it: the governance was assessed, and so was the assessor, against the standards written for each job.
Both checks are public. The certificate’s current status can be confirmed on IRQAO, the independent register and validation service recording certificates issued by ASCB-accredited bodies, and the certifier’s accreditation, with its scope, on ASCB’s verify page.
For anyone evaluating an AI governance claim, in procurement or due diligence, the version worth specifying is accredited certification: it is the form of the claim that can be independently confirmed, at the level of the certificate and at the level of the certifier.
Is ISO/IEC 42001 certification the same as accreditation?
No, and the two words are often used as if they mean the same thing. Certification applies to the organization: a certification body certifies that an organization's AI management system meets ISO/IEC 42001. Accreditation applies to the certification body: an accreditation body assesses the certification body against ISO/IEC 17021-1 and ISO/IEC 42006. An organization is certified to ISO/IEC 42001. A certification body is accredited against those standards. Accreditation is the final check in the sequence: accreditation bodies are not themselves accredited by a higher body, and what stands behind an accreditation body is the standard it works to. ASCB works to ISO/IEC 17011, the international standard setting the requirements for accreditation bodies.
How to check an ISO/IEC 42001 certificate
There are three things to check:
• To confirm a specific certificate, verify it on the register on which the issuing body records its certificates; for ISO/IEC 42001 certificates issued by ASCB-accredited bodies, that is IRQAO.
• To confirm that the certification body itself is accredited, and for what, use
ASCB's verify page.
• Read the scope statement on the certificate, because an AI management system certificate covers the system as scoped, which may be particular AI systems, services or parts of the organization.
The checks together confirm that the certificate is current, that the body that issued it was independently assessed, and that the certificate covers the activity you care about.
Where ISO/IEC 42001 sits among the standards
ISO/IEC 42001 is the certifiable requirements standard for AI governance:
• ISO/IEC 17021-1: the standard a certification body is assessed against to certify management systems, and part of the accreditation behind an accredited ISO/IEC 42001 certificate.
• ISO/IEC 42006: the requirements for bodies providing audit and certification of AI management systems, applied alongside ISO/IEC 17021-1.
• ISO/IEC 23894: guidance on AI risk management, which the standard points to for its risk processes.
• ISO/IEC 22989: AI concepts and terminology.
• ISO/IEC 38507: guidance on the governance implications of AI for governing bodies.
• ISO 9001, ISO/IEC 27001 and the other management system standards sharing the same high-level structure, so AI governance can run inside an integrated system; ISO/IEC 27001 is the natural companion where the AI risks are also information security risks.
Common questions
What is ISO/IEC 42001?
ISO/IEC 42001 is the international standard for an AI management system. It sets out what an organization's governance of its development, provision and use of AI must address, including risk assessment, impact assessment and controls over the AI system life cycle.
What does ISO/IEC 42001 certification mean?
It means a certification body has assessed an organization's AI management system and judged it to meet the requirements of ISO/IEC 42001, at the scope stated on the certificate and at the time of assessment.
Does ISO/IEC 42001 apply to organizations that only use AI rather than build it?
Yes. The standard is written for both sides of the technology, the providers of AI products and services and the organizations that use them, so an organization deploying AI built by others is within its intended scope.
Does ISO/IEC 42001 certify an AI system or model?
No. Certification is of the organization's management system for governing AI, not of any individual AI system, model or product. The certificate says the governance meets the standard, not that a particular system is approved.
What is an AI system impact assessment?
A documented process, required by the standard, for assessing what an AI system could do to individuals, to groups and to societies, through its deployment, the use it is meant for and the misuse that can be foreseen, in the setting and jurisdictions where it runs. Its results feed the organization's risk assessment.
What is the latest version of ISO/IEC 42001?
ISO/IEC 42001:2023, the first edition, published in December 2023.
What is the difference between ISO/IEC 42001 certification and accreditation?
Certification is of the organization against ISO/IEC 42001. Accreditation is of the certification body against ISO/IEC 17021-1 and ISO/IEC 42006. Accreditation is the independent check on the certifier behind the certificate.
How do I check an ISO/IEC 42001 certificate is genuine?
Verify the certificate on the register on which the issuing body records it, confirm on
ASCB's verify page that the certification body is accredited and for what scope, and read the scope statement on the certificate itself.
How to apply
How to apply for accreditation to certify other organizations against ISO/IEC 42001, under ISO/IEC 17021-1 and ISO/IEC 42006, including the process, the fees and the application documents, is set out on Become Accredited.