Skip to content
Knowledge Hub/Article
Article

What Is ISO/IEC 42001? The AI Management System (AIMS)

We explain ISO/IEC 42001's scope and audience, related standards, its links to ISO 27001, the NIST AI RMF and the EU AI Act, and how certification works.

Oğuzhan Gerçek··9 min read
What Is ISO/IEC 42001? The AI Management System (AIMS)

Short answer: ISO/IEC 42001 is the international standard that sets out requirements for establishing, implementing, maintaining and continually improving an artificial intelligence management system (AIMS) within an organization. It was published in December 2023 and is aimed at organizations of any size that develop, provide or use AI-based products or services. Its subject is not individual models but how an organization manages the risks and opportunities of AI. Certification is voluntary, and certificates are issued by independent certification bodies, not by ISO. According to the European Commission, the standard's goals and definitions are not aligned with the quality management system required under the EU AI Act.

What is ISO/IEC 42001?

According to the ISO catalog, ISO/IEC 42001:2023, titled "Information technology — Artificial intelligence — Management system," was developed by the AI subcommittee ISO/IEC JTC 1/SC 42 and published as a first edition on December 18, 2023. ISO describes it as the world's first AI management system standard and states its purpose as ensuring the responsible development and use of AI systems. According to ISO, it addresses challenges specific to AI, such as ethical considerations, transparency and continuous learning, and helps organizations balance innovation with governance. We cover the concept of AI itself in our AI article.

Who is it for?

According to ISO's page, the standard is designed for organizations of any size involved in developing, providing or using AI-based products or services. It applies across all industries and is relevant for public sector agencies as well as companies and non-profits. ISO's explainer adds one more point: organizations that manage AI systems provided by third parties are also in scope.

The management system approach: what does the standard require?

ISO publishes other AI standards too; ISO/IEC 42001, by contrast, is a management system standard (MSS). According to ISO, implementing it means putting in place policies and procedures for the sound governance of an organization in relation to AI, using the Plan-Do-Check-Act methodology. Rather than looking at the details of specific AI applications, it offers a practical way of managing AI-related risks and opportunities across the organization. The explainer summarizes the requirements as follows:

  • Leadership and organizational context
  • AI policy and objectives
  • Risk management for AI systems
  • Data governance and system lifecycle controls
  • Transparency and information provision
  • Performance evaluation and monitoring
  • Continual improvement

Clause and control details are in the paid text of the standard.

According to the ISO catalog, the main standards around 42001 are:

  • ISO/IEC 22989:2022: AI concepts and terminology (July 2022).
  • ISO/IEC 23894:2023: Guidance on AI-specific risk management for organizations that develop, produce, deploy or use products and services that use AI (February 2023).
  • ISO/IEC 42005:2025: Guidance on assessing how AI systems affect individuals, groups and society (May 2025).
  • ISO/IEC 42006:2025: Requirements for bodies that audit and certify AI management systems (July 2025).
  • ISO/IEC 27090: Security threats specific to AI systems; reached the publication stage in August 2026. We cover one of those threats in our data poisoning article.

How it relates to ISO 27001

According to ISO's page on management system standards, these standards share a common layout called the Harmonized Structure (HS), so they are structured in the same way regardless of their subject. ISO notes that this is particularly useful for organizations that choose to operate a single, integrated management system meeting the requirements of two or more standards. ISO/IEC 27001:2022 sets out the requirements for an information security management system, and 42001 those for an AI management system.

We explain how ISO 27001 certification works in our ISO 27001 certification process article, and our glossary has a short definition. For organizations planning to run an AI management system alongside an existing ISO 27001 management system, we handle the ISO 27001 side in our ISO standards service.

How it relates to the NIST AI RMF

NIST's AI RMF 1.0 was released on January 26, 2023, and is intended for voluntary use; according to NIST, as of October 2026 the framework is being revised as part of the White House AI Action Plan. ISO/IEC 42001, on the other hand, is a management system standard that can be certified through an independent audit. NIST's list of crosswalks includes a table prepared by Microsoft that maps AI RMF subcategories to the requirements of the final draft of ISO/IEC 42001 (FDIS). The same list includes INCITS/AI crosswalks for ISO/IEC 23894 and ISO/IEC 42005, dated August 14, 2025. NIST notes that including a crosswalk does not imply endorsement, nor that either resource comprehensively covers the other.

How it relates to the EU AI Act

The EU AI Act is, as recorded on EUR-Lex, Regulation (EU) 2024/1689 of June 13, 2024, published in the Official Journal of the EU on July 12, 2024. According to the European Commission, companies that apply harmonised standards are presumed to comply with the legal requirements (presumption of conformity), and applying standards remains voluntary. CEN and CENELEC are developing harmonised standards for high-risk AI systems through their Joint Technical Committee JTC 21, and international standards that are available and aligned with EU requirements can become European harmonised standards.

The Commission's standardisation FAQ is explicit about ISO/IEC 42001: the standard helps set up an AI management system, but its goals and definitions are not aligned with the quality management system required under the AI Act. That is why the Commission requested a new quality management system standard focused on regulatory compliance with the AI Act. According to the Commission, prEN 18286, the draft standard developed for this purpose, became the first harmonised standard for AI to enter public enquiry on October 30, 2025. We cover the Act's obligations and timeline in our AI governance article.

How does certification work?

According to ISO's certification page, certification is the provision by an independent body of written assurance, a certificate, that a product, service or system meets specific requirements; ISO does not perform certification or issue certificates. According to the explainer, certification for 42001 is voluntary and is carried out by independent certification bodies, which may be accredited by national accreditation bodies.

The work of the auditing bodies now has its own standard. ISO/IEC 42006, published in July 2025, sets out additional requirements for bodies that audit and certify AI management systems and supplements ISO/IEC 17021-1, the general standard for management system certification, with AI-specific requirements. Its intended users include not only certification bodies but also the accreditation bodies that assess them. When choosing a certification body, ISO advises comparing several and checking whether the body is accredited, although accreditation is not compulsory.

Getting started in your organization

The explainer lists the first steps as identifying where AI systems are used, defining roles and responsibilities for AI oversight, assessing the risks of AI systems, documenting policies for AI use and data governance, monitoring AI performance and impacts, and planning corrective actions and improvements. We cover the regulatory background in Türkiye for inventories and roles in our AI governance article, and the security side of risk assessment in our data poisoning article.

According to ISO, the standard does not replace laws or regulations; instead, it provides a management framework that helps organizations meet compliance obligations more effectively. If an AI system processes personal data, the obligations of the KVKK (Türkiye's personal data protection law) still apply; the basics are in our KVKK article. We describe tools such as the risk register and the control matrix on our governance, risk and compliance (GRC) page, and the infrastructure decisions about where models and data run on our AI stack design and engineering page.

Frequently asked questions

What is ISO 42001? It is the international standard that sets out requirements for establishing, implementing, maintaining and continually improving an organization's AI management system. It was published in December 2023.

How do you get ISO 42001 certification? Through an audit by an independent certification body; ISO does not issue certificates. ISO/IEC 42006 sets out additional requirements for the bodies that carry out these audits.

What is an AI management system (AIMS)? It is the structured set of policies, processes and controls that govern how an organization's AI systems are designed, developed, deployed and used.

Is ISO/IEC 42001 mandatory? According to ISO, certification is voluntary. The standard does not replace laws or regulations; it is a management framework that helps organizations meet compliance obligations.

What is the difference between ISO 42001 and ISO 27001? ISO 27001 sets out the requirements for an information security management system, and ISO 42001 those for an AI management system. Because ISO's management system standards share the same structure, the two can be run together in a single integrated system.

Does ISO 42001 ensure EU AI Act compliance? According to the European Commission, the standard's goals and definitions are not aligned with the quality management system the Act requires. That is why the Commission requested a separate standard focused on compliance with the Act.

Sources