certification
ISO 42001
A voluntary standard for running AI as a management system. No law requires it, and it does not replace the AI Act. Customers and tenders ask for it, and it gives the work an owner and a yearly cycle.
at a glance
- what it is
- An international standard, ISO/IEC 42001:2023, edition 1, published in December 2023, for an artificial intelligence management system.
- who it covers
- Whoever chooses it, or whose customer or tender requires it. ISO says it is for organisations of any size that develop, provide or use AI-based products or services.
- who checks
- An external certification body, against a scope you define. ISO does not certify.
- penalties
- None under law. You can lose the certificate, the contract or the tender.
- legal weight
- The Commission says the standard helps set up an AI management system, and that its goals and definitions do not match the quality management system the AI Act requires.
basis ISO/IEC 42001:2023, ISO catalogue page; European Commission FAQ on AI Act standardisation
does it apply to you?
A few questions, answered in your browser, tell you which rules are yours. Nothing is sent anywhere.
find my ruleswhat the AI management standard adds: a loop
- 1list the AI useswho owns each, what data it touches
- 2assess risk and impactwhat could go wrong for people and for the business
- 3set rules and rolespolicies, owners, training
- 4run and checkcontrols, monitoring, internal audit
- 5management reviewwhat changes
every year, with a certification body checking the cycle
basis working practice. No legal text sets this.
the whole job, in order
Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.
- decide whether to certify, and what for
Find out who needs the certificate, what they would accept instead and which AI work it should cover.
- check where you stand
List the AI you use, compare your practice with the standard and turn the differences into a plan.
- build the management system
Write the AI policy, assess risk and impact for each system and set the rules for approving new AI.
- audit yourself and review with management
Check that the rules run as written, and put the results in front of management.
- pass the external audit
Choose a certification body, go through its audit and deal with what it finds.
- keep it alive each year
Keep the inventory true, repeat the audit and review, and meet the certification body's follow-up.
what a certificate does and does not show
Read this before a customer asks you for one.
organisations that develop, provide or use AI, voluntarily
an AI management system, assessed by a certification body
what it asks, and ways to meet it
The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.
- also in the plan
the long read
The full explanation, section by section, with the sources.