ISO 42001
ISO/IEC 42001 is the world's first international standard for an AI management system — a structured way to govern how your organization develops and uses AI responsibly. If buyers, boards, or regulators are starting to ask how you manage AI risk, it's the certifiable framework that answers them. Here's the plain-language version: what it is, who needs it, how it's organized, how certification works, and how to get ready.
ISO 42001 checklist
A clause-by-clause implementation checklist.
Free readiness assessment
See your ISO 42001 gaps in minutes.
Map to other frameworks
How ISO 42001 overlaps with the EU AI Act, NIST AI RMF & ISO 27001.
Illustrative statuses. Your real assessment is generated from your answers in the app. Standpoint is a self-assessment aid, not legal advice.
What is ISO 42001?
ISO/IEC 42001 is a management-system standard — it doesn't certify an individual AI model, it certifies the system you use to manage AI across your organization. Think of it the way ISO 27001 works for information security: it sets out requirements for establishing, implementing, maintaining, and continually improving an AI management system (AIMS), so that responsible-AI practices are governed, documented, and improved over time rather than handled ad hoc. It was published in December 2023 as the first international standard of its kind.
Who needs ISO 42001?
It's designed to fit any organization, of any size, that builds, supplies, or uses AI — whether you train your own models, embed third-party models in your product, or use AI internally. Teams typically pursue it when: - customers or enterprise buyers start asking how you govern AI risk; - you want a recognized, certifiable way to demonstrate responsible AI; - you're preparing for the EU AI Act and want a management system that supports it; - your board or investors want assurance that AI is being managed, not just shipped.
How ISO 42001 is structured
Like other modern ISO management-system standards, ISO 42001 follows a common high-level structure. The certifiable requirements live in the main clauses, and a set of AI-specific controls live in Annex A. In our own words, the main clauses cover: Annex A adds a set of AI-specific controls — covering areas such as AI policies, internal organization and accountability, resources for AI systems, assessing AI system impacts, the AI system lifecycle, data for AI, information provided to users and interested parties, responsible use of AI systems, and third-party and supplier relationships. You select and justify which controls apply to your context, much like the Statement of Applicability in ISO 27001. We describe the structure in our own words. For the authoritative requirements and control text, consult your licensed copy of ISO/IEC 42001:2023.
How does ISO 42001 certification work?
Certification follows the same path as other ISO management-system standards. After you implement your AI management system, an accredited certification body audits it — typically a Stage 1 review of your documentation and readiness, then a Stage 2 audit of how the system operates in practice. If you pass, you receive a certificate, usually valid for three years with periodic surveillance audits in between. The software you use (including Standpoint) helps you get ready and organize evidence; the certificate itself is issued only by an accredited body.
ISO 42001 vs. the EU AI Act vs. NIST AI RMF
These are complementary, not competing. The EU AI Act is a law with mandatory obligations for certain AI uses. NIST AI RMF is a voluntary US framework for managing AI risk. ISO 42001 is a certifiable management-system standard you can be independently audited against. Many teams use ISO 42001 as the management backbone that helps demonstrate EU AI Act readiness and operationalize NIST AI RMF — and because the controls overlap heavily, the evidence you gather for one moves the others forward. See the ISO 42001 crosswalk for the detail.
A practical path to readiness
- Define your scope and context. Which AI systems, which parts of the business, and your role (developer, provider, user). - Run a gap assessment. Compare where you are today against the clauses and Annex A controls. - Stand up the management system. AI policy, roles, risk and impact assessments, and the core processes. - Apply and evidence the controls. Implement the applicable Annex A controls and keep dated evidence. - Internal audit & management review, then engage an accredited body for certification. The fastest start is a gap assessment. Our free ISO 42001 readiness assessment shows where you stand, and the implementation checklist turns it into a working plan.
ISO 42001 work counts elsewhere too
The crosswalk maps your ISO 42001 evidence onto the frameworks it overlaps — so you move forward on several at once.