ISO/IEC 42001:2023 is an international standard for running an AI management system inside an organization. It is not a law and not a technical test of a model. It is for any organization that provides or uses AI based products or services, and it matters most when customers or regulators ask you to prove governance.
What does the standard actually cover?
The standard's published scope says it sets out requirements for an artificial intelligence management system and gives guidance on establishing, implementing, maintaining and continually improving it. It applies to any organization, regardless of size, type and nature, that provides or uses products or services that use AI systems.
It follows the same high level structure as other management system standards such as ISO 9001 and ISO 27001, according to secondary summaries, so teams that already run an information security program will recognize the shape: context, leadership, planning, support, operation, performance evaluation and improvement. Planning includes AI risk assessment, risk treatment and impact assessment of AI systems. Annexes add control objectives and implementation guidance.
Because it is a management system standard, it checks that you have policies, roles, risk processes and records, and that you follow them. It does not tell you which model is accurate or fair enough for a given job.
Who needs it?
Nobody is legally required to hold it by the standard itself. It becomes relevant in three situations.
You sell AI to cautious buyers. Procurement teams use recognized standards as shorthand. If you are asked how you govern AI, a management system gives a structured answer.
You face AI regulation. The EU AI Act sets its own obligations, including a quality management system for providers of high risk AI systems. A management system standard can support that work, but it does not by itself equal compliance with the Act. Check the Act's text for your case.
You already run ISO 27001 or similar. The incremental effort is smaller because you can reuse your processes for risk, documents and audits.
If you only use a third party AI tool in a few places and handle no sensitive decisions, a full management system is probably more than you need. A light internal policy and vendor review may be enough.
What does it take to get started?
Start with scope. Decide which AI systems are in your AI management system: ones you build, ones you buy, or both. Then take inventory. You cannot govern what you have not listed. An AI bill of materials, listing models, datasets and dependencies for each system, is a practical starting point.
Next, assess risk and impact for each system, assign an owner, and write the policy that says who can approve a new AI use. Then collect records as you operate: reviews, incidents, changes and test results. Certification, if you want it, is performed by an accredited third party, and the audit examines whether the system exists and works.
Where does Safeguard fit?
Safeguard does not certify anyone. Our compliance automation can help collect the evidence a framework asks for. Treat any tool as support for your own program, not a replacement for it.
What to do
- Decide whether a customer, regulator or contract is actually asking.
- List every AI system you build or use, with an owner.
- Obtain the standard text from ISO or your national standards body; the summaries here are not a substitute.
- Map existing security and privacy controls to the standard's clauses to find real gaps.
- Write an AI use policy and an approval step for new AI.
- Decide on certification only after a gap assessment.
Quick check
Is ISO/IEC 42001 mandatory?
No. It is a voluntary standard. Customers or contracts may ask for it.
Does it replace compliance with the EU AI Act?
No. It can support the work, but the Act has its own legal requirements.
Sources
Last reviewed: 18 October 2026.
