Implementation walkthrough
How to implement ISO/IEC 42001: video walkthrough
A walkthrough of implementing an ISO/IEC 42001 AI management system, from naming the AI systems in scope to the risk and impact assessments and the certification audit.
Key takeaways
- Name every AI system in scope and your role for each: developer, provider or user.
- The AI risk assessment and the AI system impact assessment are separate pieces of work.
- Selected controls are compared with Annex A and recorded in a Statement of Applicability.
- An existing ISO/IEC 27001 system can be reused rather than rebuilt.
- An accredited certification body audits the AIMS and makes the certification decision.
The first management system standard written for AI
ISO/IEC 42001 is the international standard for artificial intelligence management systems. Published by ISO and IEC in December 2023, it specifies the requirements for establishing, implementing, maintaining and continually improving a system for the responsible development, provision and use of AI systems, and applies to any organisation that provides or uses products or services built on AI.
Three mechanisms make it more than a policy statement: an AI risk assessment of the risks that help or hinder your AI objectives, an AI risk treatment that selects controls, compares them with Annex A and records the result in a Statement of Applicability, and an AI system impact assessment of what each system's deployment could mean for individuals and society. This short film walks through how those pieces are built.
From scope to certificate
Define the scope the certificate must cover: which AI systems are developed, provided or used, your role for each, the data, sites, functions and suppliers involved, and the requirement the certificate has to answer. A gap analysis compares current policies, practices and records with clauses 4 to 10 and the Annex A controls, keeps what already works, including an existing information security management system, and sets an action plan with owners and dates.
Implementation brings the AI policy, the risk criteria, the risk and impact assessments, the selected controls and the Statement of Applicability into use, with people trained and records building up. Internal audit and management review follow, and findings are closed with evidence before an independent certification body, accredited with the AIMS-specific requirements of ISO/IEC 42006, audits the system and decides.
Sterling's expert and experienced consultants carry the scoping, the assessments, the controls and the documentation with your people under Sterling OS™, with the work held in Effivity.
Organisations often start from a customer asking how AI is governed, a board wanting assurance, or a regulatory obligation on the horizon; the scope then names exactly which AI systems the certificate speaks for.
ISO/IEC 42001 at a glance
- Purpose
- AI governance: responsible development, provision and use of AI systems, with risks and impacts assessed, treated and evidenced
- Relevant to
- Any organisation that develops, provides or uses AI systems, from a start-up training its first model to an enterprise using AI in decisions about people
- Edition
- ISO/IEC 42001:2023, the first edition; no amendment and no revision published
- Certification
- Assessed and decided by an independent certification body, accredited to ISO/IEC 17021-1 with the AIMS requirements of ISO/IEC 42006
- Sterling's role
- Scoping, risk and impact assessment, controls and documentation with your team, Effivity, training, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO/IEC 42001 AIMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 8 months
ISO/IEC 42001: questions people ask
We only use AI tools such as ChatGPT or Copilot. Does ISO/IEC 42001 apply to us?
It can. The standard applies to any organisation that provides or uses products or services that use AI systems, and use includes generative tools and AI embedded in suppliers' services. Whether certification is worth pursuing depends on what your customers and regulators ask of you; the readiness check and a discovery call tell you quickly.
Do we need ISO/IEC 27001 before ISO/IEC 42001?
No. ISO/IEC 42001 stands alone. In practice an organisation with an ISMS extends it, because the two share the harmonised structure and much of the document control, audit and review machinery. An organisation without one often makes the AIMS its first system when AI is its main exposure, and adds security later on the same base.
Does ISO/IEC 42001 certification make us compliant with the EU AI Act?
No. The EU AI Act, Regulation (EU) 2024/1689, is law, with obligations that depend on your role and the risk class of the system. ISO/IEC 42001 is a voluntary management system standard and not a harmonised standard under the Act, so certification carries no presumption of conformity; the harmonised standards are being developed by CEN and CENELEC. What the AIMS gives you is the governance, documentation and evidence that the Act's obligations and other regulators draw on.
What is the difference between the AI risk assessment and the AI system impact assessment?
The risk assessment (6.1.2) looks at the risks to your AI objectives, including consequences for the organisation, individuals and society, and prioritises them for treatment. The impact assessment (6.1.4) looks outward from each AI system at what its deployment, intended use and foreseeable misuse could do to individuals, groups and societies. The standard requires both and feeds the impact assessment into the risk assessment. ISO/IEC 42005:2025 gives guidance for the impact assessment and ISO/IEC 23894:2023 for AI risk management.
Is accredited ISO/IEC 42001 certification available?
Yes, though it is newer than for the established standards. Accreditation bodies assess certification bodies against ISO/IEC 17021-1 and the additional AIMS requirements of ISO/IEC 42006:2025, published in July 2025. Ask the body for its accreditation for ISO/IEC 42001 specifically and verify it with the accreditation body. A certificate issued outside accreditation may satisfy some buyers, but it should be a choice made knowingly.
Keep exploring
Related to this video
Read next
- ISO/IEC 42001: the full guideStandard hub
- ISO 42001 Implementation Plan: Phases, Owners and DeliverablesGuide
- ISO 42001 Gap Analysis: What It Covers and What You GetGuide
- ISO 42001 Certification Process: AIMS Certification Step by StepGuide
- ISO 42001 Timeline: How Long AIMS Certification Takes, Stage by StageGuide
The complete guide
Everything on ISO/IEC 42001
Start with the ISO/IEC 42001 page, or go straight to the guide you need.
On the ISO/IEC 42001 page
- What are the main ISO/IEC 42001 requirements?
- How do you get ISO/IEC 42001 certified?
- How much does ISO/IEC 42001 certification cost?
- How long does ISO/IEC 42001 certification take?
- Who needs ISO/IEC 42001 certification?
- How ISO/IEC 42001 supports trusted AI and a stronger business case
- Frequently asked questions about ISO/IEC 42001
Guides
- ISO 42001 AI impact assessment
- AI impact assessment
- ISO 42001 risk assessment and treatment
- ISO 42001 Annex A controls
- ISO 42001 audit questions
- ISO 42001 benefits
- ISO 42001 certification process
- ISO 42001 checklist
- ISO 42001 certification body
- ISO 42001 common mistakes
- ISO 42001 certification cost
- Do I need ISO 42001? A decision guide to ISO/IEC 42001 for AI providers and users
- ISO 42001 documentation
- Effivity ISO 42001
- ISO 27001 to ISO 42001
- ISO 42001 gap analysis
- ISO 42001 implementation plan
- ISO 42001 internal audit
- ISO 42001 management review
- ISO 42001 nonconformities
- ISO 42001 requirements explained
- ISO 42001 scope
- ISO 42001 Stage 1 and Stage 2 audit
- ISO 42001 for start-ups and small AI teams
- ISO 42001 surveillance audit and recertification
- ISO 42001 timeline
- ISO 42001 training
- How to verify an ISO/IEC 42001 certificate, and spot a fake or misleading one
- ISO 42001 vs EU AI Act
- ISO 42001 vs ISO 27001
By country
By industry
Often combined with ISO/IEC 42001
Talk to a consultant
Plan your ISO/IEC 42001 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice