Home  /  ISO 42001
ISO/IEC 42001 · AI governance

Prove your AI is governed, not just clever.

Customers, regulators and procurement teams are asking how you manage AI risk. ISO/IEC 42001 gives you a certifiable answer. We stand up the AI Management System and get you certification-ready.

CertifiableInternational AI standard
Internal auditIncluded in implementation
Builds on 27001Reuse your existing ISMS
In short: ISO/IEC 42001 is the certifiable international standard for managing AI responsibly. Cyber Veda implements it and integrates it with ISO 27001 where you already have it.

Why ISO 42001 now

AI is showing up in every procurement questionnaire. Buyers want to know where your models and data come from, how you assess impact and bias, and who is accountable. ISO 42001 turns those answers into a management system an auditor can verify, so you can answer once with a certificate.

What ISO 42001 covers

Like ISO 27001, the standard has two parts: management system requirements in Clauses 4 to 10, which you must meet, and an Annex A of controls you select based on your AI risks and impact assessments.

ISO/IEC 42001:2023 Annex A controls by objective38 controls in total
  • Policies related to AIA.2 3
  • Internal organisationA.3 2
  • Resources for AI systemsA.4 5
  • Assessing impacts of AI systemsA.5 4
  • AI system life cycleA.6 9
  • Data for AI systemsA.7 5
  • Information for interested partiesA.8 4
  • Use of AI systemsA.9 3
  • Third-party and customer relationshipsA.10 3

Selected controls are recorded in a Statement of Applicability, as with ISO 27001.

Built alongside ISO 27001

ISO 42001 shares ISO 27001’s structure, so leadership, risk management, documentation, internal audit and management review can run as one integrated system. If you already hold ISO 27001, the AI-specific work is the inventory, the AI risk and impact assessments and the Annex A controls.

Certification

Certification follows the same three-year cycle as other ISO management system standards, with the external audits run by an accredited certification body you engage directly.

The ISO 42001 certification cycle Internal audit and preparation (Cyber Veda)External audit (your certification body)
  1. Before Build and internal audit Implementation, then a full internal audit and management review
  2. Year 0 Stage 1 audit Certification body reviews your documented system and readiness
  3. Year 0 Stage 2 audit Certification body tests that the system operates; certificate issued
  4. Year 1 Surveillance audit A sample of the system re-checked, after your annual internal audit
  5. Year 2 Surveillance audit Another sample re-checked, after your annual internal audit
  6. Year 3 Recertification A full audit renews the certificate for another three years

What's included

  • AI inventory and scoping: the AI systems you build, buy and deploy
  • AI risk assessment and AI system impact assessment
  • AI policy, objectives and roles, sized to your organisation
  • Controls mapped to ISO/IEC 42001 Annex A, integrated with ISO 27001 where you have it
  • Independent internal audit and corrective action register

When you'd use this

  • You sell an AI-powered product and enterprise buyers ask about AI governance
  • You are adopting AI internally and want a defensible framework
  • You hold ISO 27001 and want to extend it efficiently to AI
FAQ

Common questions

What is ISO 42001?

ISO/IEC 42001 is the international standard for an Artificial Intelligence Management System (AIMS). It sets requirements for governing how an organisation develops, provides or uses AI responsibly, and it can be independently certified.

Do we need ISO 27001 first?

No, but if you have it, ISO 42001 follows the same management system structure, so much of the work can be reused. We design them to run as one integrated system.

Who needs ISO 42001?

Any organisation that develops, provides or uses AI systems can adopt it. It is most valuable for companies selling AI-powered products to enterprise or government buyers, and for organisations using AI in decisions that affect customers or staff.

What controls are in ISO 42001?

Annex A of ISO/IEC 42001:2023 contains 38 controls across nine objectives: AI policies, internal organisation, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems, and third-party and customer relationships. As with ISO 27001, you select the controls your risks call for.

What is an AI system impact assessment?

It is a documented assessment of how an AI system could affect individuals, groups and society, for example through bias, errors or misuse. ISO 42001 requires it alongside your AI risk assessment, and it is often what customers most want to see.

Does ISO 42001 make us compliant with the EU AI Act?

Not on its own. ISO 42001 gives you a governance system that supports many of the AI Act’s expectations, such as risk management, documentation and human oversight, but the Act has its own legal requirements depending on your role and how risky your AI is. We show you where the two line up.

Who issues the ISO 42001 certificate?

An accredited certification body, which you engage directly for the external audit. We build your AI management system, run the internal audit and support you through their Stage 1 and Stage 2 audits.

How long does ISO 42001 take?

It depends on how many AI systems are in scope and whether you already run ISO 27001. If you do, much of the management system is reused and the path is considerably shorter. We give you a realistic timeline in the free consultation.

Talk to someone who has taken companies like yours to audit.

Book a free 30-minute consultation. Tell us what is driving the need, and leave with a realistic timeline and the first three things to do.

Book a 30-min consultation Explore services