ISO 42001 is the first international standard specifically for an artificial intelligence management system, published in December 2023 and built on the same high-level structure as ISO 27001, so organizations already certified to ISO 27001 will find the process of establishing policies, risk assessments, and continuous improvement cycles familiar. It requires organizations to formally identify and manage AI-specific risks across the system lifecycle, covering areas such as data quality, third-party model and dataset provenance, and the potential impact of AI decisions on individuals, and it results in an externally audited certification rather than a self-declared checklist. Whether a company should pursue certification depends mainly on its customers: enterprise and government buyers increasingly ask AI vendors for ISO 42001 as a procurement requirement, and it can also support, though not replace, the internal quality management system that EU AI Act providers of high-risk systems must maintain. A small company selling a narrow internal tool with no external AI customers gets less direct value from certification than a vendor selling AI products or services to regulated industries. The certification typically takes several months of gap analysis and control implementation before an audit. Nanobase AI has guided clients through ISO 42001 gap assessments and certification preparation as part of broader AI governance work.
What ISO 42001 actually is
Published in December 2023, ISO/IEC 42001 is the first international standard defining requirements for an artificial intelligence management system, the AI-specific counterpart to how ISO 27001 standardized information security management. It follows the same Annex SL high-level structure used across modern ISO management system standards, covering context, leadership, planning, support, operation, performance evaluation, and improvement, applied specifically to how an organization develops, deploys, or uses AI systems. A company already certified to ISO 27001 will recognize the skeleton immediately; the substance that changes is the AI-specific risk content layered onto that skeleton.
What the standard actually requires
| Area | What ISO 42001 asks for |
|---|---|
| AI risk assessment | Systematic identification of AI-specific risks across the system lifecycle, not just security risks |
| Data governance | Controls over data quality, provenance, and suitability for the AI system's intended purpose |
| Third-party and supply chain management | Oversight of AI components, models, or data sourced from external providers |
| Impact assessment | Assessment of the AI system's impact on individuals and society, not just on the organization |
| Transparency and communication | Documented information about the AI system's capabilities and limitations for relevant stakeholders |
| Continuous monitoring | Ongoing performance and risk monitoring after deployment, not a one-time pre-launch check |
The scope deliberately extends past cybersecurity into AI-specific concerns like model drift, training data quality, and the societal impact of automated decisions. ISO 42001 asks for AI-specific governance content that a general information security management system, including ISO 27001 on its own, does not cover.
Who should actually pursue certification
Certification is not the default recommendation for every organization using AI. It makes the most sense for companies that build or sell AI systems to enterprise or regulated customers who increasingly ask for it as a procurement requirement, companies operating in industries where a demonstrable AI governance framework materially reduces regulatory risk, and companies that already hold ISO 27001 and can extend their existing management system infrastructure at a lower incremental cost. For a company using AI only through a few off-the-shelf tools with no AI product of its own, the internal governance ISO 42001 asks for is usually worth adopting informally without pursuing the formal certification audit.
The path to certification
- Gap analysis against the standard's clauses, typically the fastest way to see how much of an existing ISO 27001 or general quality management system already covers the requirement.
- Build or extend the AI management system documentation: policies, risk assessments, and the AI system inventory the standard expects.
- Run the system operationally for a period, generating the records an auditor will expect to see, such as risk assessment logs and monitoring reports.
- Undergo a two-stage external audit by an accredited certification body, similar in structure to an ISO 27001 audit.
- Maintain the system through annual surveillance audits and a recertification cycle, typically every three years.
Companies extending an existing ISO 27001 program can usually reach certification readiness far faster than those building an AI management system from a blank page. This is general information, not legal advice, and organizations evaluating certification should weigh it against their specific customer and regulatory requirements.
Frequently asked questions
Does ISO 42001 certification satisfy EU AI Act requirements?
Not directly. ISO 42001 is a voluntary management system standard, while the EU AI Act is binding law with its own conformity assessment process. A strong ISO 42001 implementation can support AI Act compliance by providing much of the underlying risk management and documentation infrastructure, but it is not a substitute for the Act's specific classification and conformity steps.
How long does ISO 42001 certification typically take?
For an organization with an existing ISO 27001 management system, extending to cover ISO 42001 is often achievable within a few months of focused work. Building an AI management system from scratch takes considerably longer, generally six months to a year depending on organizational size and AI system complexity.
Is ISO 42001 relevant for companies that only use AI, rather than build it?
Yes, though the emphasis shifts toward the deployer-side clauses: data governance for inputs sent to third-party AI systems, impact assessment of AI-assisted decisions, and monitoring of AI system performance in the specific context of use.
Does ISO 42001 replace SOC 2 for an AI product company?
No, they cover different things and are often pursued together. SOC 2 attests to security and availability controls that customers commonly require in due diligence, covered separately in our guide to SOC 2 for AI products, while ISO 42001 attests specifically to AI governance maturity.
How Nanobase AI helps
Nanobase AI helps enterprise clients run the gap analysis, build the AI system inventory and risk assessments, and prepare the documentation an ISO 42001 audit expects, particularly for organizations extending an existing ISO 27001 program. This is part of our AI security and compliance services, alongside the model deployment and monitoring work covered in our approach to private LLM deployment.
Ready to discuss your project? Contact Nanobase AI or email hello@bumu.tech.