the whole job

ISO 42001: the whole job, in order

Customers and tenders ask for an ISO 42001 certificate from suppliers that build, sell or use AI. A certificate shows that an auditor looked at your AI management system, within a scope you chose, at a point in time. It does not show that each AI system is accurate, fair or lawful, and it does not show compliance with the AI Act. This plan runs from the decision to certify to the yearly cycle, in six stages.

last checked 2 November 2026

how to read this plan

ISO 42001 is a standard for running AI as a management system, so most steps set up scope, owners, rules and checks that repeat. The standard is paid and its clauses were not read for this plan, which is why every step says practice and no clause is cited: check clause and control numbers against your licensed copy. Where a step also helps with the AI Act, the step says so and links a page, and the basis stays practice. The European Commission says the standard does not match the quality management system that the AI Act requires, so do not assume that a certificate gives you a presumption of conformity. The order follows dependencies. Under each step a small note names the basis.

  • decide and documentchoices, policies and records that someone with authority signs
  • build and configuresystems, settings and procedures that make the choice real
  • prove and operatechecks, logs and records that show it keeps working
01

decide whether to certify, and what for

Find out who needs the certificate, what they would accept instead and which AI work it should cover.

  1. ask who requires the certificate

    Ask the customers and tenders that raised it whether they require a certificate or would accept a written description of your AI governance or your answers to a questionnaire. Record each answer with the date. No EU rule on this site requires the certificate.

    • owner board
    • decide and document
    what it produces
    a short list of customers and tenders, what each asked for and what each would accept
    the proof it leaves
    the list, with the source of each answer

    the work page

    basis working practice. No legal text sets this.

  2. set the scope in writing

    Decide which part of the company and which AI systems the management system covers, and write down what is out. A system outside the scope is not covered, so a certificate for the product team says nothing about the AI that the HR team uses.

    • owner board
    • decide and document
    what it produces
    a scope statement that names what is in and what is out
    the proof it leaves
    the statement, approved by management

    basis working practice. No legal text sets this.

  3. name who answers for AI

    Name one accountable owner for AI at management level and one operational lead, and give them time and a budget line. Say which role you play for each system: provider, deployer or both, because the AI Act treats them differently.

    • owner board
    • decide and document
    what it produces
    a decision naming the accountable owner, the operational lead and the role for each system
    the proof it leaves
    the minutes of that decision

    basis working practice. No legal text sets this.

you are done with this phase when you can show a board decision to certify or not, the customers or tenders behind it and a written scope.
02

check where you stand

List the AI you use, compare your practice with the standard and turn the differences into a plan.

  1. list every AI system and give each an owner

    List every AI system you build, sell or use, including tools that nobody approved, with an owner for each. The same list is the first step of the AI Act work, so build it once and keep it current.

    • owner head of IT
    • build and configure
    what it produces
    an AI inventory with an owner and a purpose for each system
    the proof it leaves
    the inventory, with the date of its last review

    the work pagethe control: ai-inventory

    basis working practice. No legal text sets this.

  2. get a licensed copy and compare it with your practice

    Buy the standard from the publisher or a national standards body, and go through it with the people who run the AI work. Mark what you already do, what you do in part and what is missing, within your scope. This plan did not read the clauses, so use your copy for every number.

    • owner head of IT
    • prove and operate
    what it produces
    a gap list with the finding, the owner and the proof you already hold
    the proof it leaves
    the gap list, dated and signed by the operational lead

    basis working practice. No legal text sets this.

  3. order the gaps into one plan of work

    Put the gaps in the order in which they depend on each other, give each an owner and a date, and decide what you will accept for now. Management approves the plan, so that the work has authority behind it.

    • owner board
    • decide and document
    what it produces
    an ordered plan of work with owners and dates
    the proof it leaves
    the plan, approved by management

    basis working practice. No legal text sets this.

you are done with this phase when you can show an AI inventory, a gap list and an ordered plan of work approved by management.
03

build the management system

Write the AI policy, assess risk and impact for each system and set the rules for approving new AI.

  1. write the ai policy and the rules for new tools

    Write a short AI policy that management signs, and the rule for approving a new AI tool or a new use of an existing one: who asks, who decides and what they check first. Make the rule easy enough that people use it instead of going round it.

    • owner board
    • build and configure
    what it produces
    a signed AI policy and an approval rule
    the proof it leaves
    the policy with its version and approval, and the approval log

    basis working practice. No legal text sets this.

  2. assess the risk and the impact of each system

    For each system, record what could go wrong for the company and for the people the system affects, decide which risks you will reduce, accept or hand to someone else, and record who accepted what. ISO lists ISO/IEC 42005:2025 beside 42001 in a package on impact. Its content was not read.

    • owner head of IT
    • build and configure
    what it produces
    a risk and impact record for each system, with a treatment decision for each risk
    the proof it leaves
    the records and the sign-off for accepted risks

    the work pagethe control: risk-register

    basis working practice. No legal text sets this.

  3. put the controls in place and record them

    Build or fix the controls that the gap list and the risk records call for, and write down for each what it does and who runs it. Where the AI Act applies to a system, check which of its duties the control also serves.

    • owner head of IT
    • build and configure
    what it produces
    controls running for the scope, with a one-page description of each
    the proof it leaves
    the descriptions and the records that show each one working

    basis working practice. No legal text sets this.

  4. bring suppliers and people into scope

    Sort the suppliers of models, data and AI-based services by what they can reach, ask the critical ones how they manage AI and put terms in the contract. Train the people inside the scope on the policy and keep the record.

    • owner procurement
    • build and configure
    what it produces
    a supplier register with contract terms, and a training record
    the proof it leaves
    the register, the answers received and the attendance record

    the work pagethe control: supplier-management

    basis working practice. No legal text sets this.

you are done with this phase when you can show a signed AI policy, a risk and impact record for each system and an approval rule in use.
04

audit yourself and review with management

Check that the rules run as written, and put the results in front of management.

  1. audit the system from inside

    Have someone who did not build the system check that the rules run, for the systems in scope and against the standard. Plan the audit, keep notes and write a report with findings.

    • owner everyone
    • prove and operate
    what it produces
    an internal audit plan and report with findings
    the proof it leaves
    the report, dated, with the auditor named

    basis working practice. No legal text sets this.

  2. fix the findings and record the fix

    For each finding, decide the fix, an owner and a date, and record when it was done. Fix the cause as well as the symptom, so that it does not return next year.

    • owner head of IT
    • build and configure
    what it produces
    a corrective action list with owners and dates
    the proof it leaves
    the list, with each item closed or dated

    basis working practice. No legal text sets this.

  3. hold the management review

    Once a year, put the audit result, the risk picture and open gaps in front of management, and record what changes. Check the inputs the standard lists against your copy.

    • owner board
    • prove and operate
    what it produces
    a management review record with decisions and actions
    the proof it leaves
    the record and the minutes

    basis working practice. No legal text sets this.

you are done with this phase when you can show an internal audit report, a management review record and a list of corrective actions.
05

pass the external audit

Choose a certification body, go through its audit and deal with what it finds.

  1. choose a certification body and check its accreditation

    ISO does not certify. Ask each candidate which accreditation it holds for 42001, from which accreditation body, and check the answer with that body. ISO/IEC 42006:2025 sets requirements for bodies that audit and certify AI management systems, so ask how the body meets it.

    • owner procurement
    • decide and document
    what it produces
    a chosen certification body and its accreditation scope
    the proof it leaves
    the written answers and the accreditation check

    basis working practice. No legal text sets this.

  2. prepare the evidence and the people

    Gather the policy, the inventory, the risk and impact records, the audit report and the review record in one place organised by what the standard asks. Brief the people who will be interviewed.

    • owner everyone
    • prove and operate
    what it produces
    an evidence folder and a list of interviewees
    the proof it leaves
    the folder, with each item dated

    basis working practice. No legal text sets this.

  3. go through the audit and answer the findings

    Give the auditor access, answer what is asked and note every finding. For each, agree the fix with the certification body and carry it out in the time it sets.

    • owner everyone
    • prove and operate
    what it produces
    the audit report, the finding responses and the fixes
    the proof it leaves
    the report, the responses and the closing records

    basis working practice. No legal text sets this.

  4. read the certificate and say what it covers

    Check the scope, the dates and the issuer printed on the certificate, and use them as written when you answer a customer or a tender. Say plainly what it covers and what it does not, and do not describe it as compliance with the AI Act, GDPR or a sector rule.

    • owner legal or DPO
    • decide and document
    what it produces
    a short statement of what the certificate covers, for sales and legal
    the proof it leaves
    the certificate and the statement

    basis working practice. No legal text sets this.

you are done with this phase when you can show a certification body's decision and the scope it states.
06

keep it alive each year

Keep the inventory true, repeat the audit and review, and meet the certification body's follow-up.

  1. ask what follows the certificate

    Ask the certification body what it checks after the certificate is issued, how often and what happens if findings stay open. Put the dates in the same calendar as your own audit and review.

    • owner procurement
    • decide and document
    what it produces
    a calendar of the body's follow-up and your own internal dates
    the proof it leaves
    the written answer and the calendar

    basis working practice. No legal text sets this.

  2. keep the inventory and the approvals current

    Review the inventory on a fixed rhythm, add what teams started using and remove what they stopped. Check the AI Act dates that apply to your systems, because they have moved before.

    • owner head of IT
    • prove and operate
    what it produces
    a reviewed inventory and a list of dates that apply
    the proof it leaves
    the inventory with its review date, and the dated list

    the work pagethe control: ai-inventory

    basis working practice. No legal text sets this.

  3. repeat the internal audit and the review

    Run the internal audit and the management review again on a fixed rhythm, with fresh evidence. Re-run the risk and impact work when a system, a use or the scope changes.

    • owner everyone
    • prove and operate
    what it produces
    a yearly internal audit and management review
    the proof it leaves
    the reports and the minutes, dated

    basis working practice. No legal text sets this.

you are done with this phase when you can show a current inventory, a second internal audit and management review, and the body's follow-up outcome.

who carries what

The same steps, grouped by the person who has to act.

board

head of IT

procurement

everyone

legal or DPO

controls you will need

Each control has its own page: what it is, what to look for, where it goes wrong and the proof it leaves.

    check it yourself

    your next step

    Ask your three largest customers whether they require an ISO 42001 certificate or would accept a written description of how you manage AI.

    read the AI Act guide