ISO/IEC 42001 Explained: The AI Management System Standard

ISO/IEC 42001 is the standard people mention when an organisation wants a recognised, auditable way to govern its use of AI. If your leadership team has asked whether you need an "ISO 42001 AI management system", this guide explains what the standard is, what it asks of an organisation, how certification works and where it does and does not connect to Irish and EU rules. It is aimed at managers, compliance leads and finance and HR teams in Dublin and across Ireland who are being asked about AI governance.

ISO standards are sold, not published free, so we describe only what ISO, the National Standards Authority of Ireland (NSAI) and other public pages say about it. We have not reproduced or paraphrased the standard's paid text. If you plan to implement it, you will need to buy and read the standard itself. Written governance of everyday AI use is a good place to start whatever you decide about ISO, and our guide to AI governance for managers covers that ground.

What ISO/IEC 42001 is

The ISO catalogue page for ISO/IEC 42001:2023, "Information technology - Artificial intelligence - Management system", says it specifies requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS) within organisations. It describes the standard as the world's first AI management system standard. The page gives the status as published, the publication date as December 2023, the edition as the first, the length as 51 pages and the responsible body as the joint ISO/IEC technical committee on artificial intelligence (JTC 1/SC 42).

It applies, the page says, to organisations of any size that develop, provide or use AI-based products or services, across industries, including public agencies, companies and non-profits. The page lists methodology as a management system standard following the Plan-Do-Check-Act approach, and mentions related standards including ISO/IEC 22989, 23053 and 23894.

An ISO help-centre article dated 31 July 2025 repeats the purpose: helping organisations use AI responsibly, ethically, transparently and securely. It lists what the standard covers, including integrating AI governance with organisational goals and other management systems, identifying and mitigating AI risks and impacts across the lifecycle, ethical principles such as fairness and avoiding bias, transparency and accountability, data protection and security, and ongoing monitoring and improvement. It says the approach is risk-based and process-oriented, built on the high-level structure common to management system standards, and gives ISO 9001 and ISO 27001 as examples of systems it can integrate with.

A management system, not a technical specification

This is the point most often missed. NSAI's article "The Rise of AI Governance: Unpacking ISO/IEC 42001" (26 August 2024) calls it a management system standard that defines requirements for policies, procedures and processes. It is not a technical standard for specific AI applications. In other words, it does not tell you how accurate a particular model must be. It asks whether your organisation has a managed, documented way of deciding how AI is used, who is accountable, what the risks are and how you check and improve.

NSAI says the standard has ten clauses, with clauses 4 to 10 forming the core requirements:

• Context (clause 4): understanding the organisation, stakeholder needs and the scope.
• Leadership (clause 5): top management commitment, an AI policy and a culture of responsible use.
• Planning (clause 6): risks and opportunities, AI objectives and managing change.
• Support (clause 7): resources, competence, awareness, communication and documentation.
• Operation (clause 8): including impact assessments and change management.
• Performance evaluation (clause 9): monitoring, internal audits and management review.
• Improvement (clause 10): corrective action for nonconformities.

NSAI also describes four annexes: Annex A with 39 controls, Annex B with implementation guidance, Annex C on AI risk sources and objectives, and Annex D on industry-specific scenarios. If you have worked with ISO 27001 or ISO 9001, the structure will feel familiar.

Certification: what it involves, and who does it

ISO's own certification page is clear that ISO does not perform certification or issue certificates, and that a company cannot be certified by ISO. Certification is carried out by external certification bodies, and accreditation bodies recognise that those bodies operate to international standards. The page, whose metadata date is 2023, adds that for some industries certification is a legal or contractual requirement. It does not say that certification is needed in order to use a standard.

NSAI, which offers an ISO/IEC 42001 certification service, describes the route on its certification page (no date shown):

• review the standard, carry out a gap analysis and update the management system;
• request a quotation and agree audit dates;
• a Stage 1 readiness review of documentation, scope, management commitment and the design of the Annex A controls;
• a Stage 2 audit of implementation, effectiveness and conformity;
• an independent certification decision, then surveillance audits that NSAI says are typically annual, with recertification every three years.

NSAI says audit time depends on the number of staff involved in the AI lifecycle, adjusted for factors such as regulated sectors, system complexity, sensitive uses and third-party arrangements. The page shows no prices and says a quotation is required, so we do not quote any figures.

How it relates to the EU AI Act and data protection

Be careful here. The ISO help article says the standard helps organisations meet regulatory requirements, and NSAI's certification page lists, among its benefits, aligning AI practices with evolving global regulatory requirements and a "ready-made framework to demonstrate compliance". Neither page says that certification satisfies the EU AI Act. NSAI's 2024 article does not mention the AI Act at all. The Commission's AI Act Service Desk pages, for example those on deployer and human-oversight duties, set out the Act's own requirements. The sources cited here do not say that ISO/IEC 42001 certification replaces them.

A practical approach, which is our suggestion and not a legal rule: treat the standard as a structure that can hold your AI Act work, your data protection work and your acceptable-use rules in one place, rather than as a substitute for any of them. If you are drafting day-to-day rules for staff, our guide to what to cover in a generative AI acceptable use policy shows the kind of policy a management system would sit on top of.

Vendors are increasingly citing the standard. For example, Microsoft's page on data, privacy and security for Copilot (last updated 18 August 2026) lists the ISO 42001 standard for AI management systems among the compliance offerings and certifications for Copilot. That is a statement about the vendor's own services, not about your organisation, so you still need your own governance.

Is it right for your organisation?

None of the sources cited here say that Irish or EU law requires you to hold ISO/IEC 42001 certification. Whether it is worth pursuing depends on your customers, your sector and your appetite for external audit. A few questions help:

• Do customers, tenders or regulators ask for evidence of AI governance?
• Do you already run ISO 27001 or ISO 9001, so that an integrated system is realistic?
• Do you develop or provide AI, or only use third-party tools?
• Who would own the system day to day, and do they have time and training?

Many organisations begin by writing a policy, listing the AI tools in use and assigning an accountable owner. You can do that without any certification and decide later whether to go further.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is ISO 42001 the same as ISO 27001?

No. ISO/IEC 27001 is the information security standard that ISO's catalogue page offers in a bundle with 42001. ISO/IEC 42001 is a management system standard for AI. ISO's help article says 42001 is designed to integrate with other management systems such as ISO 27001.

Does ISO certify us?

No. ISO's certification page says ISO does not perform certification or issue certificates. External certification bodies do that.

Does certification mean we comply with the EU AI Act?

None of the sources cited here say so. NSAI describes aligning with evolving global regulatory requirements, and a ready-made framework to demonstrate compliance, as benefits of certification, but does not name the EU AI Act on the page we read, which is not the same thing. Check the AI Act's own requirements for your role.

Can we use the standard without certification?

The ISO certification page does not say certification is required to use a standard, and it describes certification as a way to add credibility. You would still need a copy of the standard.