ISO/IEC 42001 certification: how to build and certify an AI management system

Overview

A practical path for organizations that develop, provide, or use AI to establish an AIMS, assess impacts and risks, control the lifecycle, and complete independent certification.

What it is

ISO/IEC 42001:2023 is the first international AI management-system standard. It specifies requirements for establishing, implementing, maintaining, and continually improving governance for responsible development, provision, or use of AI.

Why it matters

It gives boards, customers, and procurement teams a structured way to examine accountability, transparency, data, lifecycle, suppliers, impact, and risk controls as AI systems and laws change.

How to obtain it or demonstrate compliance

1. Access the standard, obtain leadership commitment, assign accountable AI governance roles, and define the AIMS scope.
2. Build an AI inventory and determine organizational context, interested parties, legal requirements, and intended uses.
3. Perform AI impact and risk assessments; define treatment, objectives, controls, metrics, and documentation.
4. Operate lifecycle, data, supplier, human-oversight, competence, communication, monitoring, and incident processes with evidence.
5. Conduct internal audit and management review and correct nonconformities.
6. Choose a competent accredited certification body, complete Stage 1 and Stage 2 audits, then maintain surveillance and recertification.

What to review

1. Use the exact claim ISO/IEC 42001:2023 and publish the certified organization and scope.
2. Distinguish an AI management-system certificate from product approval, model-safety certification, or automatic EU AI Act compliance.
3. Inventory AI systems, roles, owners, intended uses, affected people, suppliers, data, models, impacts, risks, and opportunities.
4. Establish AI policy, objectives, competence, impact/risk assessment, lifecycle controls, data governance, human oversight, incident handling, and monitoring.
5. Integrate with ISO 27001 or other management systems where useful while preserving AI-specific evidence.
6. Complete internal audit, management review, corrective action, certification audit, surveillance, and recertification.

What to do next

ISO/IEC 42001 is relevant to both AI providers and users. Certification demonstrates that the scoped AIMS was assessed against the standard; it does not certify that every output is accurate, lawful, unbiased, or safe.

Official sources and further reading

• ISO/IEC 42001:2023 — AI management systems — International Organization for Standardization
• ISO/IEC 27001:2022 — Information security management systems — International Organization for Standardization
• AI Act — regulatory framework and application timeline — European Commission