ISO 42001, explained for teams building with AI

ISO/IEC 42001:2023 specifies the requirements for an AI management system, or AIMS: how an organization governs the AI systems it develops, provides or uses. It covers AI risk, the impact of AI on people and society, data, the AI life cycle and human oversight.

It follows the same high-level structure as ISO 27001, so a team that already runs an information security management system can extend much of it rather than start again.

• Companies building AI products, asked by enterprise customers how their AI is governed.
• Companies that build on third-party AI models and need to show how they manage that dependency.
• Teams preparing for the EU AI Act, since an AI management system supports much of the governance the Act expects.

Like ISO 27001, it is voluntary. Customers and partners are what usually make it a requirement.

• Context (clause 4): the AI systems in scope, and your role, such as developer, provider or user.
• Leadership (clause 5): an AI policy and accountable roles.
• Planning (clause 6): AI risk assessment, AI risk treatment and AI system impact assessment.
• Support (clause 7): resources, competence and awareness.
• Operation (clause 8): carrying out the risk treatment and impact assessments.
• Performance evaluation (clause 9): monitoring, internal audit and management review.
• Improvement (clause 10): corrective action and continual improvement.

Annex A lists 38 reference controls under nine objectives. As with ISO 27001, you choose the ones that apply through your risk and impact assessments and justify the choice, rather than implementing every control by default.

• Scope and gap assessment: decide which AI systems and activities the AIMS covers.
• Build and run the AIMS: AI policy, risk and impact assessments, selected controls, and evidence that they operate.
• Internal audit and management review.
• Stage 1 and Stage 2 audits by an accredited certification body.
• Certificate and surveillance: valid for three years, with yearly surveillance audits.

The EU AI Act is law; ISO 42001 is a voluntary standard. An ISO 42001 certificate does not by itself make you compliant with the Act. They overlap heavily, though: risk management, data governance, documentation, transparency and human oversight appear in both, so work done for one carries over to the other.

• No inventory of the AI systems in use, including third-party models and APIs.
• No impact assessment before an AI system is deployed.
• Training data with unknown provenance or licensing.
• No monitoring for drift or unexpected behaviour after launch.
• No defined human oversight for decisions the AI makes or supports.

The free SwaSec ISO 42001 assessment asks 14 questions across 2 domains and takes about 10 minutes. It scores where you stand and ties each gap to the clause, control or article it relates to.

• AIMS Clauses (4-10). AI management system requirements covering context, leadership, planning, support, and performance evaluation for AI governance.
• Annex B Controls. AI-specific controls covering policies, governance, data, development, operations, third-party AI, and human oversight.

Start the ISO 42001 assessment. It is a self-assessment, not an audit or a certification.

ISO 42001 shares 7 areas with the other frameworks SwaSec covers. Where it can, the assessment asks a shared area once, and the answer counts toward each framework.

• Security Policy, shared with ISO 27001, SOC 2 and GDPR. Asked once.
• Risk Assessment, shared with ISO 27001, SOC 2, GDPR and EU AI Act. Asked separately, because each framework wants something different.
• Vendor/Supplier Management, shared with ISO 27001, SOC 2 and GDPR. Asked once.
• Data Governance, shared with GDPR and EU AI Act. Asked separately, because each framework wants something different.
• Human Oversight of AI, shared with EU AI Act. Asked once.
• Change Management / Secure Development, shared with ISO 27001 and SOC 2. Asked once.
• Training and Awareness, shared with ISO 27001 and SOC 2. Asked once.

• ISO/IEC 42001:2023, ISO

This guide is general information, not legal advice. Last updated 1st October 2026.