ISO/IEC 42001 and the AI management system standards

ISO/IEC 42001:2023 is the international standard that specifies requirements for establishing, implementing, maintaining and continually improving an artificial intelligence management system (AIMS) within an organization. It is the first certifiable management system standard for artificial intelligence.

Standards Academy teaches ISO/IEC 42001 from implementation practice, and reads it through the governance lens of ISO 37000, the standard developed in ISO/TC 309, on which Standards Academy's director serves as Vice-Chair.

That second point carries practical weight. Organizations that develop, provide or use AI systems can now be assessed against a defined set of requirements by an accredited certification body, in the same way they have long been assessed against ISO 9001 or ISO/IEC 27001. The standard was developed by ISO/IEC JTC 1/SC 42, the joint committee responsible for artificial intelligence standardization. On 23 October 2026 its page listed 44 published standards and 51 under development (ISO, 2026).

Scope and purpose of ISO/IEC 42001

ISO/IEC 42001:2023 applies to any organization, regardless of size, type and nature, that provides or uses products or services that utilize AI systems (ISO, 2023a, Clause 1). The standard does not regulate individual AI models or algorithms. It regulates the management system around them: the policies, roles, processes, documentation and review cycles through which an organization governs AI across its lifecycle.

The purpose is systematic governance of AI across the whole life cycle. An AI management system under ISO/IEC 42001 requires an organization to define its AI policy, assign accountability, assess risks and impacts, select and carry out controls, monitor performance and improve continually. The same discipline that ISO 9001 brought to quality and ISO/IEC 27001 brought to information security is applied here to artificial intelligence.

Two distinctions matter at the outset, and both recur throughout this article.

First, certification to ISO/IEC 42001 is organizational. It is granted by an accredited certification body following an audit of the management system. The publication of ISO/IEC 42006:2025 in July 2025 established the requirements that bodies auditing and certifying AI management systems shall themselves meet, which is the condition for accredited certification to operate on a consistent basis (ISO, 2025b). Neither PECB nor any training provider certifies an organization to the standard.

Second, personal credentials are separate. A PECB credential attests an individual's competence, to carry out, audit or manage within an AIMS, and is held by the person, not the organization. An organization seeking certification will typically need people holding such credentials, but the two instruments answer different questions: one asks whether the management system conforms, the other asks whether a named individual is competent.

PECB credentials and training routes for artificial intelligence

PECB operates two distinct credential ladders for artificial intelligence, and conflating them is a common error when selecting AI governance training.

The first ladder consists of ISO/IEC 42001 management system credentials: Foundation, Lead Implementer and Lead Auditor. These follow the familiar pattern used for other ISO management system standards. Foundation introduces AIMS concepts and leads to the PECB Certified ISO/IEC 42001 Foundation credential. The ISO 42001 Lead Implementer route covers planning, implementing, operating, monitoring and improving an AIMS. The Lead Auditor route prepares candidates to audit an AIMS against the standard.

The second ladder consists of AI practitioner credentials that are not tied to the management system itself: the Certified Artificial Intelligence Professional (CAIP), aimed at technical practitioners working directly with AI systems; the Certified Artificial Intelligence Manager (CAIM), aimed at those managing AI programmes and teams; and the Lead AI Risk Manager, aimed at specialists responsible for identifying, analysing and treating AI-related risk.

Standards Academy, a PECB-authorized training partner, delivers courses for both ladders. The table below matches each role to the appropriate credential and course.

The selection logic is straightforward. Someone accountable for getting an organization certified needs the Lead Implementer route; someone assessing conformity needs Lead Auditor; a data scientist or engineer benefits more from CAIP; a governance lead overseeing an AI portfolio fits CAIM; and a risk function building AI-specific risk capability fits the Lead AI Risk Manager credential.

Organizations and roles within scope

ISO/IEC 42001 is deliberately broad in its applicability. An organization falls within scope if it designs, develops, procures, deploys, operates, monitors or retires AI systems. That covers an AI vendor building foundation models, a bank deploying a third-party credit-scoring tool, a hospital using diagnostic support software, and a public authority running automated decision systems. The organization does not need to write a single line of model code: procuring and operating AI is sufficient.

Within the organization, several roles typically carry responsibilities under an AIMS:

Senior management, who shall demonstrate leadership and commitment, set the AI policy and allocate resources, which Clause 5.1 requires.

AI system owners, accountable for individual systems across their lifecycle.

Developers and data scientists, who carry out technical controls on data quality, testing, documentation and monitoring.

Risk and compliance teams, who run the risk assessment and treatment processes and maintain alignment with legal obligations.

Information security specialists, given the overlap between AI risk and security risk.

Human rights or ethics advisers, whose input feeds the impact assessment on individuals and society.

Internal auditors, who evaluate the AIMS at planned intervals.

Operational users, who interact with AI outputs and often provide the first signal that a system is behaving unexpectedly.

For training decisions, this mapping matters more than job titles. The governing question is who holds which responsibility under the management system. A compliance officer with no AIMS accountability may need only Foundation-level knowledge; a programme lead tasked with building the system towards ISO 42001 certification needs implementer-level depth.

Structure of the AI management system and its annexes

ISO/IEC 42001 follows the harmonized structure common to modern ISO management system standards: organizational context, leadership, planning, support, operation, performance evaluation and improvement (ISO, 2023a). Anyone who has implemented ISO 9001 or ISO/IEC 27001 will recognize the architecture immediately, which makes integration across management systems practical.

The distinctive substance of the standard sits in its four annexes. Annexes A and B are normative; Annexes C and D are informative (ISO, 2023a).

Annex A sets out the reference control objectives and controls in Table A.1, grouped under policies related to AI, internal organization, resources for AI systems, assessing impacts of AI systems, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships. The organization selects controls on the basis of its risk assessment and records the inclusions and exclusions, with justification, in a statement of applicability (ISO, 2023a, Clause 6.1.3).

Annex B provides implementation guidance for those controls, explaining how each control can be put into practice. It turns the control list from a checklist into a workable specification.

Annex C describes potential AI-related organizational objectives and risk sources, fairness, safety, security, privacy, transparency, accountability and others, which inform both the risk assessment and the setting of measurable AIMS objectives.

Annex D addresses the use of the AI management system across domains and sectors, and its integration with other management system standards, recognizing that a medical-device manufacturer and a financial-services firm will apply the same framework under very different regulatory and operational conditions.

In practice, implementation effort concentrates on Annexes A and B, risk framing draws on Annex C, and Annex D shapes how the AIMS coexists with sector rules and existing certified systems. ISO 42001 training at implementer level works through all four.

AI system impact assessment and AI risk management

ISO/IEC 42001 requires both an AI risk assessment (Clause 6.1.2) and an AI system impact assessment (Clause 6.1.4), and the two are distinct exercises. Two supporting standards make the distinction concrete.

ISO/IEC 23894:2023 provides guidance on AI risk management (ISO, 2023b). It adapts the general risk management principles of ISO 31000 to artificial intelligence, addressing how an organization identifies, analyses, evaluates and treats risks to the organization and its objectives arising from AI, risks relating to safety, security, privacy, data quality, model behaviour and accountability. The frame of reference is primarily organizational: what could go wrong, how likely, how severe, and what controls respond.

ISO/IEC 42005:2025 provides guidance on AI system impact assessment (ISO, 2025a). Its frame of reference is different: the foreseeable effects of an AI system on individuals, groups and society. An impact assessment under ISO/IEC 42005 considers who is affected by a system's outputs, how fairness, human rights and wellbeing may be touched, and under what conditions harm could occur, including harm that poses no direct commercial risk to the organization itself.

The practical consequence: a credit-scoring model might pass a risk assessment (the model is secure, accurate and monitored) while an impact assessment surfaces disparate outcomes for a protected group. ISO/IEC 42001 expects both lenses, with documented criteria, retained records and monitored outcomes feeding back into the management system.

For individuals building this capability, the PECB Lead AI Risk Manager credential addresses the risk-management discipline directly, while implementer-level study covers how both assessments are embedded in AIMS processes. Organizations that keep the two assessments distinct, different questions, different stakeholders, sometimes different assessors, tend to produce findings that auditors can actually verify.

Relationship with the EU Artificial Intelligence Act and other management systems

ISO/IEC 42001 and the EU Artificial Intelligence Act are complementary instruments with different legal standing. Regulation (EU) 2024/1689 imposes legal obligations on providers, deployers, importers and distributors of AI systems, with the most extensive requirements attaching to high-risk systems. Its obligations apply in stages. The timetable in Article 113 was amended by Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, in force from 27 July 2026, and the consolidated text on EUR-Lex is the authoritative statement of the application dates (European Union, 2024; European Union, 2026). ISO/IEC 42001 is a voluntary standard against which an organization's management system can be certified.

An AIMS built on ISO/IEC 42001 gives an organization the governance infrastructure, risk management, documentation, human oversight arrangements, monitoring, record-keeping, that many of the Act's obligations presuppose. Certification does not satisfy the Act. Legal conformity under the Regulation is determined by its own mechanisms, and an organization holding ISO/IEC 42001 certification remains bound to meet every applicable legal obligation on its own terms.

Integration with other ISO management systems is more direct. Because ISO/IEC 42001 uses the harmonized structure, it combines naturally with ISO 9001 for quality, ISO/IEC 27001 for information security, ISO/IEC 27701 for privacy and the ISO 31000 guidance on risk management. Organizations already certified to ISO/IEC 27001 frequently extend existing processes for document control, internal audit and management review to cover AI.

Standards Academy's ISO/IEC 42001 courses are built from that integration practice: the AI management system is taught as an extension of the governance and management systems an organization already runs.

Frequently asked questions

What is an AI management system under ISO/IEC 42001?

An AI management system is a set of policies, roles, processes, documentation and review cycles for governing AI (ISO, 2023a). ISO/IEC 42001:2023 requires the organization to define its AI policy and assign accountability. It assesses risks and impacts, selects and operates controls, monitors performance and improves continually. The standard governs the management system, not individual models.

Which organizations does ISO/IEC 42001 apply to?

ISO/IEC 42001:2023 applies to any organization that develops, provides or uses AI systems, whatever its size or sector (ISO, 2023a). An organization is within scope if it designs, develops, procures, deploys, operates, monitors or retires AI systems. Procuring and operating AI is sufficient. A bank using a third-party scoring tool is within scope.

Does ISO/IEC 42001 certification satisfy the EU Artificial Intelligence Act?

They are complementary instruments with different legal standing. The Act imposes binding legal obligations on AI providers, deployers and other actors; ISO/IEC 42001 is a voluntary certifiable standard. An AIMS supports compliance work, but certification does not satisfy the Regulation's requirements.

What is the difference between AI risk assessment and AI system impact assessment?

Risk assessment, guided by ISO/IEC 23894:2023, addresses risks to the organization and its objectives. Impact assessment, guided by ISO/IEC 42005:2025, addresses foreseeable effects on individuals, groups and society. ISO/IEC 42001 requires both, with separate criteria and records.

Which credential suits an AI practitioner and which a governance lead?

Technical practitioners building or operating AI systems suit the CAIP credential. Governance leads overseeing AI programmes suit CAIM, or the ISO/IEC 42001 Lead Implementer credential where the responsibility is building the management system itself towards organizational certification.

Who certifies an organization to ISO/IEC 42001?

An accredited certification body, audited against the requirements of ISO/IEC 42006:2025, published in July 2025. Neither PECB nor Standards Academy certifies organizations: PECB credentials attest an individual person's competence, which is a separate instrument from organizational certification.

References

European Union (2024) Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Available at: https://eur-lex.europa.eu/eli/reg/2024/1689/oj (Accessed: 23 October 2026).

European Union (2026) Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Available at: https://eur-lex.europa.eu/eli/reg/2026/1744/oj (Accessed: 23 October 2026).

International Organization for Standardization (2023a) ISO/IEC 42001:2023 Information technology. Artificial intelligence. Management system. Geneva: ISO. Available at: https://www.iso.org/standard/81230.html (Accessed: 23 October 2026).

International Organization for Standardization (2023b) ISO/IEC 23894:2023 Information technology. Artificial intelligence. Guidance on risk management. Geneva: ISO. Available at: https://www.iso.org/standard/77304.html (Accessed: 23 October 2026).

International Organization for Standardization (2025a) ISO/IEC 42005:2025 Information technology. Artificial intelligence. AI system impact assessment. Geneva: ISO. Available at: https://www.iso.org/standard/42005 (Accessed: 23 October 2026).

International Organization for Standardization (2025b) ISO/IEC 42006:2025 Information technology. Artificial intelligence. Requirements for bodies providing audit and certification of artificial intelligence management systems. Geneva: ISO. Available at: https://www.iso.org/standard/42006 (Accessed: 23 October 2026).

International Organization for Standardization (2026) ISO/IEC JTC 1/SC 42 Artificial intelligence. Available at: https://www.iso.org/committee/6794475.html (Accessed: 23 October 2026).