Do I need ISO 42001? A decision guide to ISO/IEC 42001 for AI providers and users

Who asks for ISO/IEC 42001, and why now

The question rarely starts internally. It arrives in a supplier questionnaire that has grown a section on artificial intelligence, in a tender asking how the bidder governs its models, or from a group company that wants one recognisable standard across its subsidiaries. ISO/IEC 42001:2023 is the first certifiable management system standard written for AI, which is why procurement teams now name it.

• Enterprise customers procuring AI-enabled software, analytics or outsourced services who want more than a vendor's own statement.
• Regulated buyers, such as banks, insurers and healthcare providers, who remain accountable for the AI their suppliers bring in.
• Parent companies and investors who want AI risk reported like information security or quality.
• Boards who approved AI projects and now ask who owns the risks.

Mandatory, expected or optional: reading the request

ISO/IEC 42001 is voluntary. It becomes mandatory for you only when a contract, tender condition or group policy you are bound by makes it so, and many requests are softer than they look.

If the wording is unclear, ask the buyer in writing whether the certificate must be accredited and which services it must cover.

Does it matter whether you build AI or only use it?

It matters for the size of the system, not for whether the standard applies. ISO/IEC 42001 covers any organisation that provides or uses products or services built on AI, and your role is recorded for each system in scope.

A developer or provider carries the life-cycle controls on design, verification, deployment and monitoring, the records of where training and test data came from, and the information customers receive about intended use. A user of AI built by others concentrates on approving systems, agreeing responsibilities with suppliers, impact assessment, human oversight and monitoring. Many organisations are both; the scope guide covers how to draw that line. A provider with several models in production should expect the longer end of the timeline, and a user with a few well-understood systems the shorter end.

The alternatives to certification, and when they are enough

The NIST AI Risk Management Framework

Voluntary US guidance built on four functions, Govern, Map, Measure and Manage. It is a sound risk method, often used inside an AI management system, but NIST does not certify against it, so it cannot answer a request for a certificate.

An EU AI Act compliance programme

If you place AI on the EU market, the Act is law and your obligations follow your role and each system's risk tier. The Commission has said the aims of ISO/IEC 42001 are not aligned with the quality management system the Act requires of high-risk providers, so the Act sets the deadline and the certificate remains a separate choice. The guide on ISO/IEC 42001 and the EU AI Act explains the gap.

A self-declaration or a customer assessment

A responsible AI statement, or a customer's review of your controls, may satisfy a buyer who does not name a standard. Neither is independent, and customer reviews multiply as the customer base grows.

Conformity now, certification later

You can build and run the system to the standard and certify when a customer asks. Saying you are "aligned with" it is accurate if you can show the evidence; saying you are certified is not, until an accredited body has decided.

Decision table: situation, recommendation and why

Questions to settle before you commit

• Which requirement must the certificate answer, and by when? Keep the exact words from the contract or tender.
• Which AI systems are in scope, and what is your role for each? If nobody can produce the list within a week, start with the inventory.
• Is an accredited certification body available where you operate? Accredited ISO/IEC 42001 certification is newer than for established standards: bodies are accredited to ISO/IEC 17021-1 with the additional requirements of ISO/IEC 42006:2025, by accreditation bodies recognised through the Global ACI arrangement, which replaced the IAF MLA on 1 January 2026. Check the accreditation covers this standard.
• What system do you already run? An ISMS, quality system or privacy programme shortens the work.
• Who will own it? Top management establishes the AI policy and holds the management review, and designated management approves the treatment plan and residual risk.

When not to do it yet

Hold back when you cannot say which AI systems you use, because an audit tests a scope and a scope needs an inventory. Hold back when the systems are prototypes or about to change model or supplier, because the risk and impact assessments would be stale before the Stage 2 audit. Hold back when no senior owner will approve the AI policy and accept residual risk. And be realistic when a deadline falls well inside four months: controls must operate and records accumulate before an auditor can test them, and a certificate promised in weeks is a warning sign. The inventory, the policy and a first impact assessment are still worth starting; the timeline guide sets out each stage.

Deciding on ISO/IEC 42001: questions buyers ask