ISO/IEC 42001 is the international standard for an AI management system: the policies, roles, risk assessments, controls and records that let an organisation show it develops and uses AI responsibly. It is to AI what ISO 27001 is to information security, and it is built on the same structure, so a business that already holds 27001 will recognise most of it. Few businesses need to certify. Most benefit from using its shape.
What it asks for
Stripped of the standard’s vocabulary, 42001 asks an organisation to be able to answer, with evidence, a short list of questions:
- Policy. What is our position on AI use, and who owns it?
- Roles. Who is accountable for each AI system, and who oversees it?
- Inventory. Which AI systems do we develop or use, and what do they do?
- Risk and impact. For each system, what could go wrong for the business and for the people it affects, and what have we done about it?
- Controls. How do we handle data, transparency, human oversight, testing, monitoring, incidents and third-party AI?
- Lifecycle. How are systems specified, built or bought, deployed, monitored and retired?
- Competence. Are the people involved trained for their roles?
- Review. Do we audit ourselves, learn from incidents and improve?
That list should look familiar. It is the governed-access model, the four governance fields on every use case, the evaluation and monitoring discipline of a production AI system, and AI-literacy training, written as a management system.
Who needs certification
Businesses whose customers or tenders ask for it, which today means some public-sector procurement, some large enterprise supply chains, and regulated sectors where AI touches customers directly. For everyone else, certification is a cost without a buyer. The useful move is to adopt the structure so that if a customer asks, the answer is “we operate to it” and the evidence exists, and so that certification, if it is ever needed, is a formalisation rather than a project.
How it relates to the EU AI Act
The Act is law and tells you what you must do for each risk category. 42001 is a standard and tells you how to run an organisation that reliably does it. The two fit together: the Act’s risk classification becomes the inventory’s risk field; the Act’s transparency and oversight duties become controls; the Act’s literacy duty becomes the competence clause. A business operating to 42001 will find the Act’s obligations largely covered, and a business meeting the Act will find 42001 mostly a matter of writing down what it already does.
How it relates to ISO 27001
Same structure, the Annex SL management-system skeleton, so policy, roles, risk, controls, audit and review map one to one. A business with 27001 extends its existing system rather than building a second one, and the data-protection and security controls it already runs cover a good part of 42001’s control set. Our group holds 27001, which is one reason the governed-access model slots into existing governance rather than competing with it.
What a UK business should do
- Write the AI usage policy and name an owner.
- Inventory the AI systems in use, including the unofficial ones, with a risk category for each.
- Add the four governance fields, risk category, data protection, human oversight, transparency, to every AI business case.
- Run AI-literacy training proportionate to roles, and record it.
- For any system in production, keep the evaluation set, the monitoring and the incident record.
- Review annually.
That is most of 42001, and all of what a customer, auditor or regulator will actually ask to see.
The governance service that delivers it is under AI governance and the EU AI Act; the Act itself is covered in Does the EU AI Act apply to UK businesses?.