ISO/IEC 42001, Explained Properly
Everyone is talking about AI regulation. Far fewer can answer the follow-up: how do you actually prove you are governing AI responsibly? That is the specific job ISO/IEC 42001 was built to do.
Published in December 2023, ISO/IEC 42001 is the world's first certifiable standard for AI Management Systems. The comparison that lands best: ISO 42001 is to artificial intelligence what ISO 27001 is to information security. Not a technical specification for models, but a management system — a structured, auditable way of demonstrating that the organisation governs a category of risk on an ongoing basis.
The architecture: seven clauses and thirty-eight controls
Clauses 4–10 are the mandatory management system requirements. Annex A provides thirty-eight controls across nine domains, selected via a Statement of Applicability.
- Cl. 4 · Context — scope, inventory, interested parties
- Cl. 5 · Leadership — AI policy, roles, governance structure
- Cl. 6 · Planning — risk assessment, objectives, impact assessments
- Cl. 7 · Support — resources, competence, documentation
- Cl. 8 · Operation — AI lifecycle processes, risk treatment
- Cl. 9 · Performance — monitoring, internal audit, management review
- Cl. 10 · Improvement — nonconformity, corrective action
What makes it different from a checklist
It is risk-based — controls scale with consequence. It covers the full lifecycle including decommissioning, the most commonly neglected phase. It is genuinely certifiable by accredited third parties — an external party whose job is to disagree with you. And it integrates: built on Annex SL, it shares its skeleton with ISO 27001, ISO 9001 and ISO 22301, so if you already hold one, you are further along than you think.
For the audit process, cost drivers and timeline, read our ISO 42001 certification guide.