ISO/IEC 42001 can help with AI sections of customer questionnaires, because it defines an AI management system you can describe in standard terms. It does not replace security answers about access control or encryption. Use it for governance, risk and lifecycle questions, and attach real evidence.
What is ISO 42001?
ISO/IEC 42001 is an international standard for an artificial intelligence management system. It was published by ISO and IEC to give organizations a structured way to govern the development and use of AI. Like other management system standards, it is about process: policy, roles, risk assessment, controls, review and improvement (ISO).
Our own fetch of the ISO page was blocked, so confirm the title, edition and scope on the ISO site before you quote them in an answer.
Which questionnaire questions does it map to?
Customers now ask AI specific questions inside the usual security review. Typical ones:
- Do you have an AI policy, and who owns it?
- How do you assess risks of AI features before release?
- How do you handle training data, and do you use customer data to train models?
- How do you monitor model behaviour after launch?
- Which third party models or APIs do you use?
- How do you handle AI incidents?
A management system built around ISO 42001 gives you a defined place to answer each one. The answer becomes "here is the policy, here is the risk register, here is the last review" instead of a paragraph of reassurance.
What it does not cover
Be honest about the edges, because reviewers notice when a standard is stretched.
It is not a data protection law. GDPR answers still need their own evidence. It is not a substitute for application security testing or for a general security attestation. And it says nothing about whether one particular model is accurate for your customer's use.
If you do not hold a certification, do not imply one. "We have aligned our AI governance to ISO/IEC 42001" is a different statement from "we are certified," and only the second needs an accredited auditor. Say which one is true.
How does it relate to the NIST AI RMF?
NIST's AI Risk Management Framework is voluntary guidance organised around govern, map, measure and manage, released in January 2023. NIST also published a generative AI profile in July 2024 (NIST). Many teams use the RMF to think and ISO 42001 to run an auditable process. Answering a questionnaire with both is reasonable if you keep the claims distinct.
What to do
- Write a one page AI policy with a named owner and approval date.
- Keep an inventory of AI systems you build or buy, including third party models.
- Run and record a risk assessment before each AI feature ships.
- Document your data position in plain terms: what customer data is used for, and whether it trains any model.
- Define an AI incident process and test it once.
- Prepare a short answer bank for the questions above, with an evidence link for each.
- State your status precisely: aligned, in progress or certified, with the certificate scope if certified.
- Review the answers every quarter so they stay true.
Quick check
Do we need certification to answer AI questions credibly?
No. Many buyers accept documented governance with evidence. Certification adds independent assurance, but only claim it if you hold it.
Is ISO 42001 enough for a security review on its own?
No. Reviewers still ask about access control, vulnerability management, encryption and incident response. Pair it with your existing security evidence.
Sources
Last reviewed: 18 October 2026.
