ISO 42001: Don’t fall behind on AI governance

ISO/IEC 42001 is the world's first international standard for AI Management Systems (AIMS), published in December 2023. It gives organizations that develop, deploy, or use AI a framework for managing AI-related risks, ensuring transparency and accountability, and addressing ethical, privacy, and safety concerns. It matters now because AI governance expectations are arriving faster than AI regulation: enterprise procurement teams and regulators are asking for evidence of responsible AI management before any law requires it, and ISO 42001 is the recognized benchmark that evidence is measured against.

Achieving ISO 42001 certification involves establishing an AI Management System (AIMS) covering leadership commitment, AI risk assessment and treatment, AI impact assessments, lifecycle controls for AI systems, transparency and accountability measures, and a process for continual improvement. Certification follows the same two-stage audit structure as ISO 27001: a Stage 1 documentation review confirms the AIMS is designed correctly, and a Stage 2 audit evaluates whether it is implemented and operating effectively. Most organizations begin with a readiness assessment to identify gaps before Stage 1. Certificates are valid for three years, with annual surveillance audits in between.

ISO 42001 and the EU AI Act share common objectives around risk-based AI governance, transparency, and accountability, but certification does not constitute legal compliance with the EU AI Act and is not a safe harbor under it. What certification does provide is a documented governance posture – risk management processes, impact assessments, data governance, human oversight, and post-market monitoring – that maps directly onto the Act's requirements for high-risk AI systems. Organizations that establish an AIMS to ISO 42001 are better positioned to meet those requirements as enforcement progresses, and to evidence due diligence in a regulatory review. ISO 42001 also maps to the NIST AI Risk Management Framework, so a single AIMS can serve both.

ISO 42001 certification cost varies with the number and complexity of AI systems in scope, organizational size, existing governance maturity, and whether a readiness assessment and AI impact assessments are included. Contact A-LIGN for a scoping assessment specific to your AI systems and intended scope.

ISO 27001 is the international standard for Information Security Management Systems; it governs how an organization protects the confidentiality, integrity, and availability of information. ISO 42001 is the international standard for AI Management Systems; it governs how an organization manages AI-specific risks such as bias, transparency, human oversight, and the impact of AI decisions on individuals. The two are complementary rather than overlapping: AI systems handle data protected under ISO 27001, while the risks those systems create are addressed by ISO 42001. Both follow the same management-system structure, so organizations pursuing both can share evidence and run the audits together. A-LIGN is accredited for both standards and assesses them concurrently.

ISO 42001 certifies the organization's AI Management System, not any individual AI model. The certificate states that the organization's processes for developing, deploying, monitoring, and governing AI systems within the defined scope have been independently audited and conform to the standard.

An ISO 42001 certificate carries international recognition only when the certification body is accredited by a member of the International Accreditation Forum, such as ANAB or UKAS in the United Kingdom. A certificate from an unaccredited body may not satisfy contract language or regulatory expectations that specify accredited certification. When comparing bodies, verify accreditation in the accreditation body's public registry, ask how many ISO 42001 audits the body has actually completed – the standard is new and completed-audit volume varies widely – and confirm the auditors have AI and data governance experience. A-LIGN was among the first accredited ISO 42001 certification bodies and has certified AI management systems across multiple industries.