To implement ISO/IEC 42001 yourself, define the scope of your AI management system, write an AI policy and objectives, assess AI risks and impacts, choose controls from Annex A and record them in a statement of applicability, run the system, audit it internally, then ask an accredited certification body to audit you.
What is ISO 42001?
ISO/IEC 42001:2023 is a standard for an AI management system, called an AIMS. Like ISO 27001, it is a management system standard: you build a repeating process for governing AI, not a one off project. The standard is paid, and the ISO page we tried to fetch on 18 October 2026 returned an access error. What follows is from consultancy and vendor guides that describe the standard consistently, so check each point against your licensed copy before you rely on it.
Those guides agree on the shape: requirements in clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation, improvement), a reference set of controls in Annex A, and implementation guidance in a further annex. They disagree on how Annex A objectives are numbered, which is a reason to read the real text. Certification is a two stage audit by an accredited certification body, with surveillance audits in between and recertification after a cycle that the guides put at three years.
The nine steps
Step 1: scope. List where you develop, provide or use AI. One guide notes you may exclude AI that you neither develop, provide nor use, with a recorded reason. Decide the boundary: whole company, one product or one business unit.
Step 2: leadership and roles. Name an executive sponsor and an AIMS owner. Write who approves AI use cases and who can stop one.
Step 3: AI policy and objectives. A short policy that states principles and commitments, plus measurable objectives, such as every production AI system has an owner and an impact assessment.
Step 4: inventory and context. Record each AI system, its purpose, data, users, affected people, suppliers and models. Note interested parties and their requirements, including customers, regulators and staff.
Step 5: risk and impact assessment. Set a method for assessing risks to the organisation and impacts on people, then apply it to each system. Keep it simple and repeatable. Our EU AI Act guide and NIST AI RMF monitoring guide can feed the method.
Step 6: controls and the statement of applicability. Walk the Annex A controls. For each, state whether it applies, why, and how you implement it. Excluding a control needs a reason tied to your risk work.
Step 7: run it. Operate the processes you wrote: approvals for new AI use, data quality checks, testing, human oversight, supplier reviews, incident handling and user communication. Collect records as you go, because the auditor will ask for operating evidence.
Step 8: measure, audit, review. Track your objectives. Run an internal audit by someone independent of the work. Hold a management review that looks at results, incidents, changes and audit findings, and record decisions and actions.
Step 9: certification audit. Choose an accredited certification body, agree the scope, and complete the stage one document review and the stage two assessment. Fix nonconformities and set a surveillance schedule.
How long will it take?
One guide suggests 6 to 9 months with a mature ISO 27001 or ISO 9001 program already running, and 9 to 15 months from scratch. Treat these as one vendor's estimate, not a standard. Your timeline depends on how many AI systems you have and how fast you can produce operating records.
Mistakes to avoid
- Writing a large policy set before knowing what AI you actually run.
- Using Annex A as a checklist without a risk basis.
- Skipping the internal audit and management review. Both are required parts of the cycle.
- Forgetting AI that arrives through a vendor feature.
What to do
- Buy the standard and read clauses 4 to 10 once, end to end.
- Build the AI inventory in a spreadsheet.
- Define scope, policy, objectives and the risk method.
- Assess each system and draft the statement of applicability.
- Run the processes for long enough to leave records.
- Do the internal audit and the management review, then pick a certification body.
Quick check
Is ISO 42001 the same as the EU AI Act?
No. ISO 42001 is a voluntary management system standard. The EU AI Act is a law. Work done for one can support the other, but one does not satisfy the other.
Do we need ISO 27001 first?
The guides we read say no, but they also say an existing ISO 27001 program shortens the work because the clause structure is shared.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so the recurring records an AIMS needs can be collected from connected systems and code instead of by screenshot. Technical evidence comes from your real code and dependencies, which helps your AI inventory show the model libraries and services you actually ship. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps you prepare and keep evidence ready, and the accredited certification body does the audit. Book a call.
Sources
- ISO, ISO/IEC 42001 catalogue page: returned an access error on 18 October 2026, and the standard itself is paid.
- Consultancy and vendor guides to ISO/IEC 42001 retrieved through web search on 18 October 2026, used only for the common outline. Not primary sources.
Last reviewed: 18 October 2026.
