Scope and context
We work out which AI systems, products and teams the management system covers, and what your customers and agencies expect of them.
ISO/IEC 42001 AI management system readiness
ISO/IEC 42001 is the international standard for an AI management system: how an organization that provides or uses AI governs it, manages its risks and improves over time. It is the AI standard a company can be certified against.
We set the management system up with you and get you ready for the certification body’s audits.
What the standard covers
ISO and IEC published ISO/IEC 42001 on December 18, 2023, its first edition. No amendment or revision is under way.
In ISO’s words, it “specifies the requirements and provides guidance for establishing, implementing, maintaining and continually improving an AI (artificial intelligence) management system within the context of an organization.” It applies to “any organization, regardless of size, type and nature, that provides or uses products or services that utilize AI systems.”
Its Annex A lists reference controls, and an organization chooses the ones that apply to its AI systems. The full text of the requirements and controls is in the standard itself, which ISO sells.
CEN and CENELEC adopted it in Europe in 2026 as EN ISO/IEC 42001:2026.
Titles, dates and scope from ISO Open Data (opens in a new tab), licensed under the Open Data Commons Attribution License. The standard: ISO/IEC 42001:2023 (opens in a new tab).
The AI standards around it
ISO/IEC JTC 1/SC 42, the committee behind ISO/IEC 42001, publishes the standards it leans on. Only ISO/IEC 42001 is certified against.
| Standard | Published | What it is for |
|---|---|---|
| ISO/IEC 22989:2022 | July 19, 2022 | Concepts and terminology for AI. |
| ISO/IEC 38507:2022 | April 8, 2022 | Guidance for governing bodies on governing an organization’s use of AI. |
| ISO/IEC 23894:2023 | February 6, 2023 | Guidance on managing risk specific to AI. |
| ISO/IEC 42001:2023 | December 18, 2023 | Requirements and guidance for an AI management system. The one you are certified against. |
| ISO/IEC 42005:2025 | May 28, 2025 | Guidance on assessing an AI system’s impact on individuals and societies. |
| ISO/IEC 42006:2025 | July 7, 2025 | Requirements, added to ISO/IEC 17021-1, for the bodies that audit and certify AI management systems. |
From ISO Open Data (ODC-By 1.0).
The route to a certificate
A certification body audits the management system in two stages. In the United States, ANAB’s accreditation program for ISO/IEC 42001 certification bodies launched in January 2024; in the United Kingdom, UKAS granted its first accreditation on January 15, 2026.
- You, with us
Readiness
The management system is set up, running and producing records before anyone audits it.
- Certification body
Stage 1 audit
The first of two audits, by a certification body accredited for ISO/IEC 42001.
- Certification body
Stage 2 audit
The second audit. The certificate, if it is granted, comes from the certification body.
- Certification body
Surveillance and recertification
Later audits keep the certificate current.
Sources: ANAB Accreditation Rule 59 (opens in a new tab), which has ANAB witness each body’s “two-stage audit process (stages 1 and 2)”, and UKAS (opens in a new tab). The rules for certification bodies are ISO/IEC 17021-1 and ISO/IEC 42006.
Setting up the management system with you
Policy, roles and objectives
We draft the AI policy with you, assign who owns what, and set objectives you can measure.
Risk and impact assessment
We run the AI risk assessment and an AI system impact assessment, using ISO/IEC 23894 and ISO/IEC 42005 as guidance, and record how each risk is treated.
Annex A controls
We choose the Annex A controls that fit your systems with you, write down why each is in or out, and put them in place.
Internal audit and management review
We run the internal audit and prepare the management review, so the system has the records an auditor asks for.
Audit support
We prepare your people and evidence for the certification body’s audits and work through its findings with you. We do not certify; an accredited certification body does.
Certification, federal work and the EU AI Act
- Can Automata certify us to ISO/IEC 42001?
- No. Certification is a third-party conformity assessment by a certification body. In the United States, ANAB accredits those bodies for ISO/IEC 42001. We prepare you for the certification body’s audits.
- Do federal contracts require ISO/IEC 42001?
- We found no OMB, FedRAMP, GSA or DoW requirement for it as of October 2026. NIST cites it, with ISO/IEC 23894, as an important basis for risk-based management of AI systems.
- Does ISO/IEC 42001 satisfy the EU AI Act?
- Not on its own. It is not a harmonised standard under the AI Act, and the European Commission says its goals and definitions are not aligned with the quality management system the Act requires. The first harmonised standard, EN 18286 on quality management, maps to it.
- How does it relate to the NIST AI RMF?
- The AI RMF is a voluntary framework; ISO/IEC 42001 is a standard you can be certified against. NIST’s AI Resource Center hosts a crosswalk between them, contributed by Microsoft against the draft standard. NIST notes that listing it does not imply endorsement.
Sources: NIST AI 100-5 (PDF, opens in a new tab), the European Commission’s AI Act standardisation FAQ (opens in a new tab) and Implementing Decision (EU) 2026/2274 (opens in a new tab), and NIST’s AI RMF crosswalks (opens in a new tab). See also AI governance with the NIST AI RMF.