Implement ISO 42001: govern AI instead of letting it happen

What is ISO/IEC 42001?

ISO/IEC 42001 was published in December 2023 and is the first international standard for an AI management system, or AIMS. It addresses every organisation that develops, provides or uses AI systems, regardless of size and sector. Like ISO 27001 and ISO 9001, it follows the harmonised structure for management system standards. It is certifiable.

The standard consists of clauses 4 to 10 with the requirements for the management system and four annexes. Annex A contains 38 reference controls across nine control objectives, Annex B the implementation guidance for them, Annex C potential objectives and risk sources, and Annex D notes on use across sectors. A family of standards has formed around it: ISO/IEC 22989 for terminology, ISO/IEC 23894 as guidance on AI risk management, ISO/IEC 42005 on impact assessment and ISO/IEC 42006 with the requirements for certification bodies.

Roles, scope and AI inventory

Clause 4 requires the context of the organisation, the interested parties and the scope of the AIMS to be determined. This includes the question of in which role the organisation deals with AI. ISO/IEC 22989 distinguishes among others AI providers, AI producers, AI customers and users, AI partners and AI subjects. Many organisations hold several roles at once: they buy an assistant and also develop their own model for a specialist application.

The basis for this is an inventory of the AI systems in use. AI rarely enters as a project but as a feature in tools that are already there. Without a complete list, every classification is a guess, see Deferred is not suspended. In isidaten, AI systems are kept in asset management, with purpose, role, provider and risk class under the AI Act.

The requirements of clauses 4 to 10

Anyone familiar with ISO 27001 will recognise the structure. What is new are mainly the AI-specific parts in planning and operation:

• Context (clause 4): internal and external issues, interested parties, role of the organisation and scope.
• Leadership (clause 5): commitment of top management, an AI policy and clearly assigned roles and responsibilities.
• Planning (clause 6): AI risk assessment, AI risk treatment with a statement of applicability, AI system impact assessment and AI objectives.
• Support (clause 7): resources, competence, awareness, communication and documented information.
• Operation (clause 8): carry out the assessments at planned intervals and on significant changes, and implement the treatment.
• Evaluation (clause 9): monitoring and measurement, internal audit and management review.
• Improvement (clause 10): continual improvement, handling of nonconformities and corrective action.

Annex A: 38 controls across nine control objectives

Annex A is a reference catalogue from which the organisation selects the controls for its risk treatment. Controls that do not apply must be justified in the statement of applicability. The nine control objectives:

• A.2 Policies: an AI policy, its relation to other policies and its regular review.
• A.3 Internal organisation: roles and responsibilities, a way to report concerns.
• A.4 Resources: data, tools, computing resources and people needed for the AI systems, documented.
• A.5 Impact assessment: assess and document impacts on individuals, groups and society.
• A.6 Life cycle: objectives, requirements, design, verification, validation, deployment, operation and monitoring of AI systems.
• A.7 Data: provenance, quality and preparation of data for development and operation.
• A.8 Information: what users and interested parties learn about the system, including incident communication.
• A.9 Use: responsible use according to defined purposes and rules.
• A.10 Third parties and customers: responsibility along the supply chain, with suppliers, partners and customers.

In isidaten, the Annex A catalogue exists as its own OSCAL-native control catalogue, not as an appendix to ISO 27001. Implementations are documented per control and produce the coverage the cockpit reports together with clauses 4 to 10.

AI risk assessment: what goes into it

The AI risk assessment under clause 6.1.2 follows the same pattern as in any management system: define criteria, then identify, analyse and evaluate risks. The difference lies in the subject. It considers not only risks to the organisation but also to individuals and society, and the risk sources are AI-specific, such as lack of transparency, bias in the data, lack of robustness, unclear accountability or a model that behaves differently in operation than in testing. ISO/IEC 23894 provides more detailed guidance.

A usable template for an AI risk assessment contains for each entry:

• the AI system with purpose, role of the organisation and provider,
• the data processed and the groups of people affected,
• the risk source and the possible event,
• likelihood and impact for the organisation and those affected,
• the selected controls with reference to Annex A, an owner and the residual risk.

In the risk register, ISO 42001 can be selected as a framework. AI risks thus sit alongside all other risks, with the same measures and the same method.

AI system impact assessment

Clause 6.1.4 and control objective A.5 require a dedicated impact assessment: what impacts can an AI system have on individuals, groups and society when used as intended, and when not? The result must be documented and feeds into the risk assessment. ISO/IEC 42005 describes how such an assessment is structured.

It overlaps with two legal duties but replaces neither: the data protection impact assessment under Article 35 GDPR when personal data are processed with high risk, see GDPR, and the fundamental rights impact assessment under Article 27 of the AI Act, which applies to certain deployers of high-risk systems, such as bodies governed by public law, private entities providing public services, and deployers using AI for credit scoring or for pricing life and health insurance. It makes sense to feed all three from the same information about the system.

ISO 42001 and the EU AI Act

The AI Act, Regulation (EU) 2024/1689, classifies AI systems by risk. Prohibited practices and the AI literacy duty under Article 4 have applied since February 2025, the obligations for general-purpose AI models since August 2025. Since 2 August 2026 the regulation has applied generally, including the transparency duties under Article 50. For systems already on the market before then, the marking duty under Article 50(2) applies from 2 December 2026. Amending Regulation (EU) 2026/1744 deferred the obligations for high-risk systems under Annex III to 2 December 2027, and for high-risk AI in products under Annex I to 2 August 2028.

ISO 42001 is not a harmonised standard and therefore does not create a presumption of conformity. But it provides exactly the framework the regulation presupposes: an inventory, roles, risk assessment, documentation, training and monitoring. Anyone running an AIMS has a solid basis for the literacy duty under Article 4 and can build the quality management system under Article 17 on it. The presumption of conformity for Article 17, however, comes only from the harmonised standard EN 18286:2026, cited in the Official Journal since October 2026. Which duties apply when is tracked at the level of individual provisions by the legal register, see The law changes quietly.

ISO 42001 certification: the process

Certification works as for other management system standards. Before an auditor comes, the AIMS must have been operating for some time, because what is audited is not only the documentation but whether it is lived.

1. Preparation: scope, gap analysis, AI policy, inventory, risk assessment, impact assessment and statement of applicability.
2. Operation and evidence: implement controls, produce records, carry out an internal audit and a management review.
3. Stage 1: the certification body reviews documentation and readiness.
4. Stage 2: it audits whether the AIMS is effectively implemented and issues the certificate if successful.
5. Surveillance: the certificate is valid for three years, with annual surveillance audits and a recertification afterwards.

An accredited certification body matters. ISO/IEC 42006 defines what competence its auditors need for AI management systems. Audit management keeps internal audits, findings and corrective actions through to closure.

Running ISO 42001 together with ISO 27001

Because both standards share the same basic structure, they can be run as an integrated management system: one shared context, one risk method, one internal audit programme, one management review, one document control. What ISO 42001 adds are the AI-specific objectives, the impact assessment and the view of those affected outside the organisation. The security of the AI systems themselves, from access to the supply chain, remains the business of the ISMS under ISO 27001.

How little an AI-driven attack needs when the basics are missing is shown by The first AI ransomware walked in through an open door: the entry point was a known vulnerability in an AI framework.

Checklist: introduce ISO 42001 in nine steps

The order follows the standard. Anyone who already has an ISMS can extend many steps instead of building them anew.

1. Capture the AI systems in use, including purchased features in existing tools.
2. Determine the organisation’s role per system and the scope of the AIMS.
3. Adopt an AI policy and appoint those responsible.
4. Define criteria and method for AI risk assessment and impact assessment.
5. Assess risks, select controls from Annex A and prepare the statement of applicability.
6. Train staff, also in line with the AI literacy duty under Article 4 of the AI Act.
7. Include providers of AI services and models in supplier management.
8. Carry out an internal audit and a management review.
9. Select a certification body and plan stage 1.