ISO/IEC 42001

ISO/IEC 42001 is the standard to reach for when "we follow good practice" isn't a strong enough answer — when an enterprise customer's security questionnaire, a regulator, or your own board wants third-party proof, not a self-assessment. Published in December 2023, it's the first international standard specifically for AI management systems, structured the same way ISO 27001 works for information security: a management system you build, document, and can have an accredited certification body formally audit.

What "AI management system" actually means here

Like other ISO management system standards, 42001 isn't primarily about the AI models themselves — it's about the organizational system that governs how you develop, deploy, and monitor AI responsibly: policies, roles and responsibilities, risk assessment processes, resource allocation, and continual improvement, all documented in a way an external auditor can verify actually happens, not just exists on paper.

Who actually pursues certification

Certification makes the most practical sense for organizations that build or heavily customize AI systems for enterprise customers, where "are you 42001 certified" is becoming a real procurement question — particularly in regulated industries and in relationships with EU-based customers, where 42001 certification is increasingly treated as meaningful evidence toward EU AI Act conformity, even though it isn't itself a legal requirement.

The certification process, in outline

Certification follows the standard ISO management-system pattern: a gap assessment against the standard's requirements, building or adapting the management system to close identified gaps, an internal audit, a two-stage external audit by an accredited certification body, and — if successful — a certificate valid for three years with annual surveillance audits in between.

How it relates to the NIST AI RMF

The two aren't competitors so much as different formats for similar substance. The NIST AI RMF is free, US-oriented, and non-certifiable; ISO/IEC 42001 is a paid, certifiable, internationally recognized standard. An organization with a mature NIST AI RMF-aligned program has done most of the substantive work 42001 certification requires — the remaining work is largely about documentation rigor and readiness for external audit, not building new governance functions from scratch. See our NIST AI RMF coverage for the function-by-function comparison.

How it relates to EU AI Act compliance

42001 certification is not a legal substitute for EU AI Act conformity — the Act has its own specific technical requirements for high-risk systems that 42001 doesn't fully replicate. But because 42001's governance and risk-management structure overlaps heavily with what the Act expects organizationally, certified organizations typically have a meaningfully shorter path to full EU AI Act conformity than uncertified ones starting from nothing.