ISO/IEC 42001 Artificial Intelligence Management System
Artificial intelligence is quickly becoming part of everyday business, from chatbots and document processing to credit scoring, recruitment and quality control. Along with the opportunities, AI brings new risks: biased or inaccurate results, unclear decision-making, misuse of personal data, and growing regulatory requirements such as the EU AI Act.
These risks are often only addressed after something goes wrong, for example when a system makes an unfair decision, a customer complains, or a regulator asks how a model was tested. A structured approach to how AI is developed, used and monitored makes the organisation’s work more reliable and reduces potential risks before they turn into incidents.
Contact us!
Email: [email protected]
Phone no.: +44 7495 748770
If you want to receive a quote, please fill in the application form:
What is ISO/IEC 42001:2023?
ISO/IEC 42001:2023 is the first international standard for an Artificial Intelligence Management System (AIMS). Published in December 2023, it provides a stable framework for developing, providing and using AI systems responsibly, by identifying AI-related risks and impacts and putting the necessary measures in place to manage them.
Certification of an AI management system in accordance with ISO/IEC 42001 demonstrates your organisation’s commitment to AI that is transparent, accountable, fair and under appropriate human oversight, throughout the whole AI system life cycle.
The ISO/IEC 42001 standard can be applied to any organisation, regardless of its size or sector, that develops, provides or uses AI-based products or services. It is particularly relevant for software and SaaS companies, financial services, healthcare, telecommunications, HR and recruitment, manufacturing, and the public sector, as well as any organisation that supplies AI-enabled services to other companies.
ISO/IEC 42001 certification can also help meet procurement requirements where responsible AI governance is a criterion for selecting suppliers or tenderers.
How to obtain the ISO/IEC 42001 certification?
To be certified, the organisation needs to implement an effective AI management system that meets the requirements of ISO/IEC 42001. BM Certification can provide training on the requirements of the standard, as well as certification services.
The certification process includes:
- Application and quotation – you describe your organisation, its AI systems and the intended scope, and we prepare a quotation.
- Stage 1 audit – a review of your AIMS documentation and readiness for certification.
- Stage 2 audit – an assessment of how the AI management system is implemented and working in practice.
- Certification decision – once any nonconformities are closed, the certificate is issued for three years.
- Surveillance audits – annual audits confirm that the system is maintained and continually improved, followed by a recertification audit in the third year.
Contact us for more details.
Currently, we offer this service as a non-accredited certification.
Why certify according to the ISO/IEC 42001 standard?
By certifying and maintaining an AI management system in accordance with ISO/IEC 42001, your organisation demonstrates a commitment to using AI responsibly and continuously improving how AI risks are managed, giving customers, partners and regulators confidence in your AI-based products and services.
By choosing ISO/IEC 42001 certification, you will:
- have assurance that AI-related risks and impacts on people and society have been identified, assessed and managed;
- build trust with customers and partners through transparent and explainable use of AI;
- be better prepared for regulatory requirements, including the EU AI Act;
- ensure appropriate human oversight and clear responsibilities for AI systems;
- strengthen the management of data quality, suppliers and third-party AI components;
- gain a competitive advantage in tenders and new business opportunities where responsible AI is required.
What does the ISO/IEC 42001 standard require?
ISO/IEC 42001 follows the same high-level structure as other ISO management system standards, such as ISO 9001 and ISO 27001. Its requirements fall into two parts:
- Management system requirements (clauses 4–10): context of the organisation, leadership and AI policy, planning (including AI risk assessment, risk treatment and AI system impact assessment), support, operation, performance evaluation and improvement.
- Annex A controls: 38 AI-specific controls grouped under 9 control objectives, covering areas such as AI policies, internal organisation, resources, impact assessment, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships.
Not every Annex A control has to be implemented. The organisation selects the controls that apply based on its risk and impact assessments and documents its decisions in a Statement of Applicability.
Already certified to ISO 27001?
ISO/IEC 42001 shares its management system structure with ISO 27001 and ISO 27701. Policies, internal audits, management review and document control can be extended to cover AI, rather than built from scratch.
Organisations holding several certificates can combine the audits into an integrated audit, saving time and reducing disruption to daily work.
