ISO/IEC 42001 is a management system standard for AI. Clauses 4 to 10 hold the mandatory requirements: context, leadership, planning, support, operation, performance evaluation and improvement. Annex A is a reference set of controls you select from based on your risk assessment, and you record what you include or exclude.
What kind of standard it is
It specifies an AI management system, or AIMS, much like other ISO management system standards. It does not tell you how accurate a model must be. It asks you to run a disciplined process for governing AI. Published guides describe certification as achievable and say auditors check whether controls were appropriately selected and implemented. We could not fetch the standard itself, since ISO's page returned an error, so the clause summary below comes from a Cloud Security Alliance guide. Check the official text before relying on details.
Clauses 4 to 10
- Clause 4, context: internal and external factors, scope of the AIMS, AI related risks, expectations of interested parties including regulation.
- Clause 5, leadership: top management sets an AI policy, assigns accountability and ties governance to strategy.
- Clause 6, planning: objectives, risk assessment, and risk treatment. Requirement 6.1.3 says to determine all controls necessary to implement the chosen risk treatment options.
- Clause 7, support: resources, competence and training, documentation, communication.
- Clause 8, operation: developing, deploying and monitoring AI systems, with incident handling.
- Clause 9, performance evaluation: metrics, internal audit, management review and monitoring for emerging risk.
- Clause 10, improvement: nonconformities, corrective action and continual improvement.
Annex A
Secondary guides describe Annex A as 38 controls in nine objective areas, covering AI policy, internal organisation, resources, impact assessment, system lifecycle, data, information for interested parties, use of AI systems, and third party relationships. Annex B gives implementation guidance. These counts come from secondary sources, so verify against the standard.
You are not required to adopt every control. You compare your chosen treatments with Annex A to confirm nothing necessary is missing, justify exclusions and document additions.
Where to start
- Define scope: which AI systems and roles are covered.
- Draft the AI policy and name an accountable executive.
- Build the AI system inventory.
- Run a risk and impact assessment method you can repeat.
- Select controls and write the statement of applicability.
- Run an internal audit and management review before any external audit.
If you have run another ISO management system, much of the structure carries over. The framework mapping demo shows how one control can serve several frameworks.
Click through it at your own pace, or open it full screen.
Budget realistically: the heavy lifting is not writing the policy but building the inventory, the risk method and the habit of internal audit. Small teams do best with a narrow first scope, such as one product line, and expand once the cycle has run once.
Quick check
Are all Annex A controls mandatory?
No. You select controls from your risk assessment and document inclusions and exclusions.
Is ISO 42001 the same as the EU AI Act?
No. One is a voluntary management system standard and the other is law. See the post on certification versus compliance.
Sources
Last reviewed: 19 October 2026.
