In the first 90 days of ISO/IEC 42001, define the scope of your AI management system, list every AI system you build or use, assign leadership and a policy, run a risk assessment, and start recording evidence. Then do an internal review. Certification is a separate step and is not required to begin.
What is ISO 42001?
ISO/IEC 42001:2023, published on 18 December 2023, sets out requirements for establishing, implementing, maintaining and continually improving an artificial intelligence management system, called an AIMS. It is meant for organizations that provide or use products or services built on AI, and it applies to organizations of any size or type. The goal described by the standard's publishers is to help organizations handle AI responsibly while meeting their objectives, applicable regulations and stakeholder expectations.
It is a management system standard, not a technical test. It asks whether you have a process to govern AI, not whether a particular model scores well. The standard is paid, so read the official text before you commit to a plan, and talk to an accredited certification body if you want certification.
Days 1 to 30: scope and inventory
- Decide why. Customers asking for it, a regulation you must follow, or internal governance? The reason drives scope.
- Set scope. Which products, teams and AI uses are in? Write boundaries clearly.
- Make an inventory. Every model you train, every third party model or API you call, every AI feature you ship, and every AI tool staff use at work. Include coding assistants and chatbots. Shadow use is common, so ask people.
- Name an owner. One accountable executive, and a lead who runs the work.
Days 31 to 60: policy and risk
- Write an AI policy. Short, approved by leadership, covering acceptable use, data handling, human oversight and accountability.
- Choose a risk method. Decide how you will rate AI risks to people, to the business and to customers. Apply it to each item in the inventory, and record decisions, including risks you accept.
- Define roles. Who approves a new AI use case, who reviews incidents, who talks to customers about AI?
- Look at data and supply chain. Where does training and input data come from? What third party models and packages are inside your AI features? Knowing your AI components, like knowing your software components, is what lets you answer questions later. Safeguard offers tooling for software supply chain visibility, which can help with the software side, though the management system itself is yours to design.
Days 61 to 90: operate and check
- Run the processes. Approve one new AI use case through the new workflow, handle one incident drill, and keep the records.
- Train people. Short sessions on the policy and on how to raise a concern.
- Do an internal review. Check your own work against the standard's requirements and write down the gaps.
- Hold a leadership review. Present results and decisions. Management standards expect leadership to review and steer, so keep minutes.
Then plan the longer part: closing gaps, collecting several months of records, and, if you want it, engaging an accredited certification body.
How does it relate to other rules?
ISO 42001 is voluntary. It is not a legal requirement and does not by itself prove compliance with any law, including the EU AI Act. Treat it as a way to organize the work, and check with counsel about your legal duties. Do not tell customers you are "42001 compliant" or certified before an accredited body has said so.
What to do
- Write down why you are doing it and who the audience is.
- Define scope and name an accountable executive.
- Build the AI inventory, including third party models and staff tools.
- Approve a short AI policy.
- Pick a risk method and assess each inventory item.
- Run one use case through your approval workflow and keep the records.
- Complete an internal review and a leadership review.
- Decide whether to pursue certification, and talk to an accredited body.
Quick check
Is ISO 42001 required by law?
No. It is a voluntary international standard for AI management systems. It can support your legal work, but it does not replace it.
Do we need certification to start?
No. You can build and run the management system first. Certification is a separate step with an accredited body.
Sources
Last reviewed: 18 October 2026.
