ISO 42001

Customers and tenders ask for an ISO 42001 certificate. The AI Act and your customers ask whether you know where AI is used in your company and who answers for it. The standard is a way to keep that answer true over time: a management system, with a scope, owners, rules, checks and a yearly review. The ISO catalogue describes it as the requirements for establishing, implementing, maintaining and continually improving an AI management system, for organisations that provide or use AI-based products or services.

It is a management system standard, so it asks how you run AI work. It does not test a model or approve a product. ISO calls it the first standard of this kind for AI.

No for the law. No EU rule on this site requires the certificate. Check your national law and your sector rules for anything that does.

Possibly for sales. Customers and public tenders can ask for it from suppliers. The reasons ISO lists for it are a framework for managing the risks and opportunities of AI, a way to show responsible use of AI, and traceability, transparency and reliability. Those are ISO’s claims, so ask your own customers what they need. Before you commit a year to it, find out which customers would accept less: a written description of your AI governance, or your answers to a questionnaire.

The Commission’s page on standardisation says what matters here. European harmonised standards for the AI Act are developed by European standardisation bodies, which prefer international standards where those fit the legal requirements. ISO/IEC 42001:2023 helps to set up an AI management system, but its goals and definitions do not align with the quality management system that the AI Act requires, which is why the Commission asked for a new standard for that system.

That is all the source says on the point. This page did not find a source that makes 42001 a harmonised standard under the AI Act, so do not assume a certificate gives a presumption of conformity. Ask your lawyer which standards the AI Act currently recognises for your use.

ISO says it does not certify or assess conformity. A certificate comes from an external certification body, which is a third-party conformity assessment. ISO/IEC 42006:2025, published in July 2025, sets requirements for bodies that audit and certify AI management systems. Whether a given body is accredited for 42001, and by whom, was not read in an accreditation body’s own listing. Before you pick one, ask the body for its accreditation scope and check it with the accreditation body.

A certificate shows that a certification body checked your AI management system, within a scope you defined, against the standard. That is what ISO means by certification: written assurance that a system meets specific requirements.

It does not show that each AI system you run is accurate, fair or lawful. It does not show compliance with the AI Act, with GDPR or with sector rules. A system outside the scope is not covered, so a certificate for your product team says nothing about the AI that your HR team uses. When a regulator or a customer asks about something outside the scope, the certificate does not answer.

None of these is a clause of the standard as read for this page. They are a sensible order to work in.

1. Scope. Decide which part of the company and which AI systems the system covers, and write down what is out.
2. Inventory. List every AI system you build, sell or use, including tools nobody approved, with an owner for each. The inventory is also the first step of the AI Act work.
3. Roles. Name who answers for AI at management level and who owns each system.
4. Risk and impact assessment. For each system, record what could go wrong for the company and for the people the system affects. ISO also lists ISO/IEC 42005:2025 beside 42001, in a package on impact. Its content was not read.
5. Policies. Write a short AI policy and the rules for approving a new tool or use.
6. Internal audit. Check once, with someone who did not build it, that the rules run, and keep the record.
7. Management review. Put the results in front of management once a year and record what changes.

The standard is paid. The ISO catalogue listed the English edition at CHF 225 on 2 November 2026. This page used public sources only: the ISO catalogue pages, ISO’s page on conformity assessment and the Commission’s FAQ. Clause numbers, control lists and annexes of ISO/IEC 42001 were not read, and none is cited. Check them against your licensed copy before you scope or answer a customer.