ISO/IEC 42001: AI Management System Standard
Understand the international standard for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS).
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is an international standard for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within an organization.
An AIMS provides a structured way to establish AI policies, objectives, processes, responsibilities, and governance practices. Rather than focusing on one particular AI model or application, ISO/IEC 42001 helps organizations manage AI-related risks and opportunities at an organizational level.
ISO describes ISO/IEC 42001 as the world's first AI management system standard. It uses a management-system approach to help organizations govern AI responsibly while addressing areas such as risk, transparency, and continuous improvement.
What does ISO/IEC 42001 require?
ISO/IEC 42001 establishes the requirements for implementing and continually improving an Artificial Intelligence Management System (AIMS). The standard follows the ISO management system structure, with requirements organized across Clauses 4–10 and AI-specific controls provided in Annex A.
Organizational Context
Define the scope of the AIMS, understand the organization's context, and identify relevant stakeholders and requirements.
Leadership & AI Governance
Establish an AI policy, demonstrate leadership commitment, and assign roles and responsibilities for AI governance.
Planning & AI Risk Management
Identify AI-related risks and opportunities, conduct risk assessments, define treatment plans, and establish AI objectives.
Support & Resources
Ensure the necessary resources, competence, awareness, communication, and documented information to support the AIMS.
AI System Operations
Plan, implement, and control AI system lifecycle processes including design, data management, testing, and deployment.
Performance Evaluation
Monitor, measure, and evaluate AIMS performance through internal audits, management reviews, and continuous improvement cycles.
Continual Improvement
Address nonconformities, take corrective actions, and continually improve the suitability and effectiveness of the AIMS.
AI-Specific Controls
Apply 38 controls across 8 control objectives covering data governance, transparency, human oversight, and responsible AI operations.
ISO/IEC 42001 at a Glance
ISO/IEC 42001 establishes the requirements for implementing and continually improving an Artificial Intelligence Management System (AIMS). The standard follows the ISO management system structure, with requirements organized across Clauses 4–10 and AI-specific controls provided in Annex A.
ISO states that ISO/IEC 42001 can apply across different AI applications and contexts and to organizations of any size involved in developing, providing, or using AI-based products or services.
Who should consider ISO/IEC 42001?
ISO/IEC 42001 is designed for organizations of different sizes, industries, and sectors involved in developing, providing, or using AI-based products and services. This includes private companies, nonprofits, and public-sector organizations.
AI developers
Organizations designing, training, integrating, or developing AI systems and AI-enabled products.
Regulated organizations
Organizations operation in environments where AI use intersects with privacy, security, risk management, or sector-specific requirements
Public sector organizations
Government agencies and other public-sector entities developing or using AI to support operations and public services
Organizations using AI
Enterprises adopting third-party or internally developed AI across business processes, applications, and employee workflows.
AI providers
Organizations designing, training, integrating, or developing AI systems and AI-enabled products.
ISO/IEC 42001 Readiness Checklist
How ISO/IEC 42001 fits into the AI compliance landscape
ISO/IEC 42001 can sit alongside other standards, frameworks, and regulations addressing AI risk, information security, and responsible AI.
NIST AI Risk Management Framework
NIST AI RMF provides a voluntary framework for managing AI risks through four core functions: Govern, Map, Measure, and Manage. ISO/IEC 42001 takes a management-system approach, establishing organizational requirements for managing AI-related risks and opportunities.
ISO/IEC 42005
ISO/IEC 42005:2025 provides guidance on AI system impact assessment (AI SIA), helping organizations assess and mitigate potential impacts across the AI system lifecycle.
ISO/IEC 23894
ISO/IEC 23894:2023 provides guidance specifically for managing AI-related risks. It is intended for organizations that develop, produce, deploy, or use AI-enabled products, systems, and services.
ISO/IEC 27001
ISO/IEC 27001:2022 establishes requirements for Information Security Management Systems (ISMS), providing foundational cybersecurity and data protection controls complementary to ISO/IEC 42001.
Frequently Asked Questions
Official ISO/IEC 42001 Resources
For authoritative information about ISO/IEC 42001 and related AI standards, refer to the official sources:
ISO/IEC 42001
Simplify your ISO/IEC 42001 Journey.
Explore practical guidance for implementing AI governance and supporting ISO/IEC 42001 requirements.