ISO/IEC 42001 is a standard for running an AI management system. Customers ask about it to see that you govern AI work with defined roles, risk checks and records. It is not a rating of your model. Product managers should answer precisely, and never imply a certificate you do not hold.
Why are customers asking now?
Buyers are adding AI sections to security questionnaires. Rules such as the EU AI Act set duties by role and risk class, and procurement teams want a signal that a supplier takes governance seriously. A management system standard is an easy thing to request because an auditor can verify it.
The EU Commission's overview describes the Act's risk based approach and obligations such as risk assessment, logging for traceability and documentation for high risk systems. A governance standard does not replace those duties, but it can help you organize the work behind them. Ask your legal team how the two interact for your product.
What does the standard cover?
ISO sells the text, so we do not reproduce it here. In general terms, a management system standard expects you to define scope, assign responsibilities, assess risks, set controls, measure results and review them on a cycle. Confirm clause level detail from the purchased standard or from your certification body before you quote it to a customer.
It audits the organization's system, not a single model's accuracy, fairness or safety. A customer who wants model level evidence will still ask for evaluation results, data descriptions and documentation.
What do you decide as the product manager?
Three decisions. First, scope: which products and AI features belong in the management system. Second, the claim you will make: "we operate to the standard", "we are preparing for certification" or "we are certified" are different statements, and only the last needs a certificate. Third, the customer facing artifacts: a short AI use description, intended purpose, limits and a human override path for each feature.
A constructed example
A customer's questionnaire asks, "Do you hold ISO 42001?" The product manager checks with compliance and finds that a gap assessment is done but no audit has happened. The honest answer says that a gap assessment is complete, the audit is planned, and attaches the AI feature descriptions. The deal moves on because the answer is specific and can be verified later.
What to do
- Decide which AI features and teams are in scope and write that down.
- Ask compliance for the exact status: not started, assessed, audit booked or certified.
- Draft one page per AI feature covering purpose, data sources, limits and human override.
- Build the customer answer in three versions that match each status, and use only the true one.
- Keep evaluation reports and release approvals by feature so you can attach them.
- Align with legal on the EU AI Act role for each feature.
- Review the answer each quarter as status changes.
Safeguard offers policies and gates and compliance automation that can hold evidence for controls you adopt. It does not issue or replace an ISO certificate.
Quick check
Does ISO 42001 prove a model is unbiased?
No. It covers the management system around AI work. Model level claims need their own evidence.
Can we say we are compliant if we have done a gap assessment?
You can say a gap assessment is done. Do not say certified or compliant unless an accredited audit supports it.
Sources
Last reviewed: 18 October 2026.
