ISO/IEC 42001 in plain language

ISO/IEC 42001 is the international standard for managing AI responsibly inside an organisation. It was published in December 2023, and it’s quickly becoming the thing customers ask about when they send a security questionnaire that mentions AI.

If you’ve worked with ISO/IEC 27001 for information security, 42001 will feel familiar. If you haven’t, this is a plain-language guide to what it asks for and where to start.

What it is

ISO/IEC 42001 describes an AI management system: the policies, roles, processes and records an organisation uses to develop, provide or use AI in a controlled way. It doesn’t tell you which models to use or set technical thresholds for accuracy. It asks you to decide how you’ll manage AI risk, write it down, do it, and show that you did.

It applies whether you build AI products, add AI features to software, or simply use AI tools in your business. Organisations can be certified against it by an accredited certification body, much like ISO 27001.

What it asks for

The main body of the standard follows the same structure as other ISO management system standards. In practice, it comes down to these areas:

• Context and scope. Which AI systems you have, what role you play for each (developer, provider or user), and which parts of the business the management system covers.
• Leadership and policy. An AI policy approved by senior management, and clear owners for AI decisions.
• Risk assessment. A repeatable way to identify and assess the risks of each AI system, and to decide how to treat them.
• AI impact assessment. An assessment of how each system could affect people and society, not just the organisation. This is the part that feels most different from ISO 27001.
• Operations. Controls over how AI systems are designed, built, tested, deployed and monitored, including data quality and third-party suppliers.
• Monitoring and improvement. Measuring whether the controls work, internal audits, management reviews, and fixing what you find.

Annex A of the standard lists reference controls, covering topics such as AI policies, internal organisation, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems, and third-party relationships. Annex B gives guidance on implementing them. As with ISO 27001, you choose the controls that apply to you and record why in a Statement of Applicability.

What it doesn’t ask for

It’s worth being clear about this, because the standard is often oversold. ISO/IEC 42001 doesn’t certify that a particular AI system is safe, fair or accurate. It certifies that the organisation has a working system for managing those questions. It also doesn’t replace laws such as the EU AI Act or India’s Digital Personal Data Protection Act, though a good management system makes complying with them much easier.

Where to begin

You don’t need to start with a certification project. These first steps are useful on their own, and they’re the foundation for certification if you go that way later.

1. Make an inventory of your AI systems. List every AI system you build, sell or use, including AI features inside tools you buy. Most organisations find more than they expected.
2. Assign an owner to each one. Someone accountable for its risks and for decisions about it.
3. Write a short AI policy. What the organisation will and won’t use AI for, who approves new uses, and what checks happen before launch.
4. Run a risk and impact assessment on your highest-risk system. Use it to design a simple template you can repeat for the rest.
5. Start keeping evidence. Approval records, test results, monitoring and incidents. Auditors work from evidence, and it’s much harder to reconstruct afterwards.

If you already hold ISO 27001, build on it. Your document control, internal audit and management review processes can usually be extended to cover AI rather than duplicated.

How we help

Our Compliance & ISO/IEC 42001 service covers the setup and audit preparation. The AI Risk & Governance Kit gives you templates and a workflow for reviewing and approving AI projects, and our GRC Platform keeps your controls, evidence and findings in one register.