ISO/IEC 42001:2023, published in December 2023, sets out requirements for establishing, implementing, maintaining and continually improving an AI management system. It is described as the only AI-specific ISO standard against which an organization can be independently certified. As customers, auditors and procurement teams ask more detailed questions about how AI is governed, it has become a common reference point.
What it asks for
- An AI policy approved by top management — stating how the organization intends to use AI responsibly.
- A process for assessing AI risks and impacts — with records kept, for each system.
- Defined roles and responsibilities — clear ownership of AI governance, with leadership setting objectives, providing resources and reviewing performance.
- A Statement of Applicability — which of the standard's Annex A controls apply to you and why. Annex A contains 38 controls in nine objectives, according to DataGuard's guide.
- Monitoring and improvement — internal audits, management review and a Plan-Do-Check-Act cycle.
How certification works
An accredited certification body audits the management system in two stages: first documentation and readiness, then implementation in practice. A certificate is valid for three years, with annual surveillance audits in between, per DataGuard's summary.
What it does and doesn't prove
- It shows a management system exists — that the organization has policies, risk processes, ownership and review for AI.
- It doesn't certify a product — a certified company can still ship a weak system. Certification is about how you manage AI, not whether a given model is accurate.
- It isn't legal compliance — it's voluntary, and it is not a harmonized standard under the EU AI Act, so it doesn't give a legal presumption of conformity. Its governance requirements do overlap with many of the Act's expectations, which makes it useful preparation.
Use the standard as a structure even if you never certify. A short AI policy, a risk assessment per system, a named owner and a regular review are worth having whatever a buyer asks.
A pragmatic path
Start by inventorying the AI systems you build and use, then write a one-page policy and a lightweight risk assessment template. Assign owners and schedule a quarterly review. If customers begin requiring certification, you will already have most of the evidence. If they don't, you will still have the discipline, and that is what the standard is really for.