Two-minute brief
ISO/IEC 42001 requirements explained: video brief
A two-minute brief on what ISO/IEC 42001:2023 requires of an AI management system: the clauses, the AI-specific planning and operation requirements and the Annex A controls.
Key takeaways
- Clauses 4 to 10 follow the harmonised structure, with AI-specific planning and operation.
- Annex A lists 38 reference controls in nine groups; Annex B guides their implementation.
- AI risks and AI system impacts are assessed separately.
- The Statement of Applicability records which controls apply and why.
- ISO/IEC 42001:2023 is the first and current edition.
Two working parts: clauses and controls
ISO/IEC 42001:2023 has two working parts. Clauses 4 to 10 carry the management system requirements on the harmonised structure shared with ISO 9001 and ISO/IEC 27001, with AI-specific requirements in planning and operation. Annex A, which is normative, lists 38 reference controls in nine groups that your risk treatment must be compared against, and Annex B, also normative, gives implementation guidance for them. This short film sets out both parts.
Context asks you to understand the issues that shape your AI systems, including whether climate change is relevant, and the interested parties and their requirements, and to define the scope: in practice a scope statement naming the AI systems, your roles for each and the sites and functions involved. Leadership means top management committing to the system and establishing an AI policy that frames the AI objectives, with an AIMS lead and system owners given authority.
Where the AI-specific requirements sit
Planning is where the standard becomes specific to AI: setting risk criteria, assessing AI risks, treating them by selecting controls and comparing them with Annex A, producing the Statement of Applicability and assessing the impact of AI systems on individuals and society. Operation then requires those assessments and treatments to be carried out and kept current as systems change. Support, performance evaluation and improvement work as in the other ISO management system standards.
ISO/IEC 42001:2023 is the first edition, with no amendment or revision published. It applies to every role in the AI value chain, from the company that trains models to the business that uses AI on clients' data, and certification is assessed and decided by an independent certification body. It is a management system standard; how it relates to laws such as the EU AI Act is a separate question.
The certificate's scope should name the AI systems covered, your role for each and the sites and functions involved, so that customers can see exactly what has been assessed.
ISO/IEC 42001 at a glance
- Purpose
- AI governance: responsible development, provision and use of AI systems, with risks and impacts assessed, treated and evidenced
- Relevant to
- Any organisation that develops, provides or uses AI systems, from a start-up training its first model to an enterprise using AI in decisions about people
- Edition
- ISO/IEC 42001:2023, the first edition; no amendment and no revision published
- Certification
- Assessed and decided by an independent certification body, accredited to ISO/IEC 17021-1 with the AIMS requirements of ISO/IEC 42006
- Sterling's role
- Scoping, risk and impact assessment, controls and documentation with your team, Effivity, training, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO/IEC 42001 AIMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 8 months
ISO/IEC 42001: questions people ask
We only use AI tools such as ChatGPT or Copilot. Does ISO/IEC 42001 apply to us?
It can. The standard applies to any organisation that provides or uses products or services that use AI systems, and use includes generative tools and AI embedded in suppliers' services. Whether certification is worth pursuing depends on what your customers and regulators ask of you; the readiness check and a discovery call tell you quickly.
Do we need ISO/IEC 27001 before ISO/IEC 42001?
No. ISO/IEC 42001 stands alone. In practice an organisation with an ISMS extends it, because the two share the harmonised structure and much of the document control, audit and review machinery. An organisation without one often makes the AIMS its first system when AI is its main exposure, and adds security later on the same base.
Does ISO/IEC 42001 certification make us compliant with the EU AI Act?
No. The EU AI Act, Regulation (EU) 2024/1689, is law, with obligations that depend on your role and the risk class of the system. ISO/IEC 42001 is a voluntary management system standard and not a harmonised standard under the Act, so certification carries no presumption of conformity; the harmonised standards are being developed by CEN and CENELEC. What the AIMS gives you is the governance, documentation and evidence that the Act's obligations and other regulators draw on.
What is the difference between the AI risk assessment and the AI system impact assessment?
The risk assessment (6.1.2) looks at the risks to your AI objectives, including consequences for the organisation, individuals and society, and prioritises them for treatment. The impact assessment (6.1.4) looks outward from each AI system at what its deployment, intended use and foreseeable misuse could do to individuals, groups and societies. The standard requires both and feeds the impact assessment into the risk assessment. ISO/IEC 42005:2025 gives guidance for the impact assessment and ISO/IEC 23894:2023 for AI risk management.
Is accredited ISO/IEC 42001 certification available?
Yes, though it is newer than for the established standards. Accreditation bodies assess certification bodies against ISO/IEC 17021-1 and the additional AIMS requirements of ISO/IEC 42006:2025, published in July 2025. Ask the body for its accreditation for ISO/IEC 42001 specifically and verify it with the accreditation body. A certificate issued outside accreditation may satisfy some buyers, but it should be a choice made knowingly.
Keep exploring
Related to this video
Read next
The complete guide
Everything on ISO/IEC 42001
Start with the ISO/IEC 42001 page, or go straight to the guide you need.
On the ISO/IEC 42001 page
- What are the main ISO/IEC 42001 requirements?
- How do you get ISO/IEC 42001 certified?
- How much does ISO/IEC 42001 certification cost?
- How long does ISO/IEC 42001 certification take?
- Who needs ISO/IEC 42001 certification?
- How ISO/IEC 42001 supports trusted AI and a stronger business case
- Frequently asked questions about ISO/IEC 42001
Guides
- ISO 42001 AI impact assessment
- AI impact assessment
- ISO 42001 risk assessment and treatment
- ISO 42001 Annex A controls
- ISO 42001 audit questions
- ISO 42001 benefits
- ISO 42001 certification process
- ISO 42001 checklist
- ISO 42001 certification body
- ISO 42001 common mistakes
- ISO 42001 certification cost
- Do I need ISO 42001? A decision guide to ISO/IEC 42001 for AI providers and users
- ISO 42001 documentation
- Effivity ISO 42001
- ISO 27001 to ISO 42001
- ISO 42001 gap analysis
- ISO 42001 implementation plan
- ISO 42001 internal audit
- ISO 42001 management review
- ISO 42001 nonconformities
- ISO 42001 requirements explained
- ISO 42001 scope
- ISO 42001 Stage 1 and Stage 2 audit
- ISO 42001 for start-ups and small AI teams
- ISO 42001 surveillance audit and recertification
- ISO 42001 timeline
- ISO 42001 training
- How to verify an ISO/IEC 42001 certificate, and spot a fake or misleading one
- ISO 42001 vs EU AI Act
- ISO 42001 vs ISO 27001
By country
By industry
Often combined with ISO/IEC 42001
Talk to a consultant
Plan your ISO/IEC 42001 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice