What is ISO/IEC 42001?

ISO/IEC 42001 is the international standard for an AI management system: the policies, roles, risk assessments and controls through which an organisation develops, provides or uses AI responsibly. It follows the same management-system structure as ISO/IEC 27001, so companies that already run an ISMS will recognise the cycle of context, leadership, planning, operation, evaluation and improvement. What is specific to AI is the content: assessing the impact of AI systems on people and society, managing data used for training and testing, documenting systems over their life cycle, defining human oversight, and handling third-party AI components. An accredited certification body can audit it and issue a certificate. It is not the EU AI Act, and holding it does not by itself show that you meet the Act’s requirements, but much of the governance work it demands supports them. For a company that only uses AI tools, a full AI management system may be more than needed; an inventory, a usage policy and staff training are a sensible start. NetSenX is preparing for ISO/IEC 42001; it has not been awarded.

← All 15 questions on Security standards: ISO 27001, SOC 2All topics