ISO 42001 certification in the Philippines: client demand, accreditation and the Data Privacy Act

Why Philippine organisations pursue ISO/IEC 42001 certification

The question usually arrives in a client's vendor questionnaire. A contact centre using speech analytics or AI-assisted agents is asked by its US or European client how those tools are risk-assessed and monitored. A shared-services centre running automated document processing for its parent group is told the group wants one AI governance framework across every site. A Manila software house selling a product with machine-learning features finds an AI management system question in an enterprise buyer's security review.

A second group is local: banks, fintechs, insurers and hospitals using AI in decisions about customers or patients, whose boards want assurance that someone owns each system and its risks.

Certification is voluntary. We have not found a Philippine law that requires an ISO/IEC 42001 certificate, so the case rests on client contracts, parent-company policy and trust. The ISO/IEC 42001 decision guide helps you judge whether you need it now.

Accreditation and certificate checks in the Philippines

The Philippine Accreditation Bureau (PAB), under the Department of Trade and Industry, accredits management system certification bodies through its Management System Accreditation Division against PNS ISO/IEC 17021-1, scheme by scheme. Its schemes include quality and information security management. We have not confirmed a PAB scheme for ISO/IEC 42001, so ask any body quoting for local accreditation to show it on PAB's published accreditation certificate and scope appendix.

Accredited certification for this standard is new everywhere. Accreditation bodies abroad, UKAS in the United Kingdom among them, now accredit certification bodies for ISO/IEC 42001 against ISO/IEC 17021-1 with the additional requirements of ISO/IEC 42006. A Philippine organisation can use such a body, provided its accreditation names ISO/IEC 42001 and the accreditation body is recognised internationally, since 1 January 2026 through the Global ACI arrangement. Confirm the current recognition status of PAB, or of the accreditation body behind your certificate, on that body's own site and on the Global ACI list before you rely on it. Our guide to choosing an ISO/IEC 42001 certification body sets out the questions.

To check a supplier's or competitor's certificate, PAB's guidance points to IAF CertSearch.

Local practice that changes an AIMS project

The Data Privacy Act and NPC issuances

Most AI systems here process personal information, so the Data Privacy Act of 2012 (Republic Act No. 10173) and the National Privacy Commission's issuances sit beside the AIMS. NPC Advisory No. 2017-03 expects a privacy impact assessment for every processing system, before a new one is adopted. NPC Circular No. 2022-04 covers registration of processing systems and notification regarding automated decision-making or profiling. The NPC also lists an advisory on AI systems, Advisory No. 2024-04, among its issuances; read it on the NPC's site before you design the impact assessment. The practical rule is one inventory: every AI system in the AIMS scope should trace to its privacy impact assessment and, where it applies, its registration entry.

Client tools inside your delivery

BPO and shared-services teams often operate AI tools that the client selects and supplies. For each system, record whether you are its provider, its user or both, and agree in writing who assesses its impact, who monitors it and who reports incidents. Auditors test that allocation of responsibilities with suppliers and customers.

An existing ISMS

Where ISO/IEC 27001 already runs, the document control, internal audit, management review and corrective action processes carry over; the AI policy, risk and impact assessments, Statement of Applicability and life-cycle records are added. Extending an ISMS into an AIMS explains the method.

Multi-site delivery

A Metro Manila head office with delivery centres elsewhere should expect the certification body to sample sites where AI systems are operated and monitored.

Local items to check, and where

How Sterling works in the Philippines

Sterling runs Philippine AIMS projects from its Manila office, working on site with your AI owners, data teams and privacy officer. Local contacts are on Sterling in the Philippines. Behind the team sit 8,100+ client engagements in 60+ countries since 2003. Sterling does not certify: an independent, accredited certification body audits and decides, and we help you choose one your clients accept.

ISO/IEC 42001 in the Philippines: questions buyers ask