Prepare for ISO 42001 AI governance certification with confidence

ISO/IEC 42001:2023 is the international standard for an artificial intelligence management system (AIMS). Published by ISO and IEC in December 2023, it sets requirements for establishing, implementing, maintaining and continually improving how an organisation governs AI. It covers AI risk assessment, AI system impact assessment, lifecycle controls, data quality and supplier relationships, and it is the first AI management system standard that organisations can be certified against by an independent certification body.

No. ISO 42001 is a voluntary standard, and no law requires certification in itself. Organisations adopt it because customers, investors and procurement teams increasingly ask for evidence of responsible AI governance. It can also help organisations show how they manage AI risk when preparing for AI regulation such as the EU AI Act, although certification does not by itself demonstrate legal compliance with any regulation.

ISO 42001 suits any organisation that develops, provides or uses AI systems, whatever its size or sector. It is most valuable for AI product companies, SaaS providers embedding AI features and businesses selling to enterprise or public sector buyers who ask about AI governance in due diligence. Organisations that already hold ISO 27001 often add ISO 42001 because both follow the same management system structure.

Annex A of ISO 42001 contains 38 reference controls grouped under nine control objectives, numbered A.2 to A.10. They cover AI policies, internal organisation, resources for AI systems, impact assessment, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships. Organisations select the applicable controls through a Statement of Applicability, and Annex B gives implementation guidance for each one.

ISO 42001 and ISO 27001 share the same harmonised management system structure, with matching clauses 4 to 10 for context, leadership, planning, support, operation, performance evaluation and improvement. ISO 27001 protects information security, while ISO 42001 governs how AI systems are developed and used responsibly. Organisations can run both as one integrated management system, reusing their risk process, document control, internal audit and management review.

You get ISO 42001 certified by implementing an AI management system that meets clauses 4 to 10, completing AI risk and impact assessments, producing a Statement of Applicability for the Annex A controls, and running an internal audit and management review. An accredited certification body then performs a two-stage external audit. Certificates are typically valid for three years, with surveillance audits in between.

ISO 42001 implementation time depends on how many AI systems are in scope, how mature your existing governance is, and whether you already run an ISO management system such as ISO 27001. Organisations with an existing management system can reuse much of their documentation, risk process and audit cycle, which shortens the work considerably. The certification audit itself is scheduled with your chosen certification body.

Yes. OneClickComply supports ISO 42001 today. Its requirements are linked to the same controls used for frameworks such as ISO 27001, so evidence you already collect can count towards your AI management system. OneClickComply does not issue certificates: certification comes from an independent certification body.