--- title: "What Is ISO 42001 (AI Management System)? | Dawiso" description: "ISO/IEC 42001 is the first international standard for an AI management system (AIMS). Learn its structure, controls, certification, and link to the EU AI Act." url: "https://www.dawiso.com/glossary/iso-42001" language: "en" --- June 8, 2026 ISO 42001ISO/IEC 42001AI management systemAIMSAI governanceAI certificationresponsible AI # What Is ISO 42001 (AI Management System)? **ISO/IEC 42001:2023** is the world's first international standard for an **AI management system (AIMS)**. [Published in December 2023](https://www.iso.org/standard/42001), it specifies the requirements for establishing, implementing, maintaining, and continually improving a management system for the responsible development and use of artificial intelligence within an organization. Where the [EU AI Act](https://www.dawiso.com/glossary/eu-ai-act) is a law that tells you *what* you must achieve, ISO 42001 is a voluntary, certifiable framework that tells you *how* to run your organization so that you achieve it - and can prove you do. ISO 42001 matters because it gives "[responsible AI](https://www.dawiso.com/glossary/responsible-ai)" an operational backbone. Principles like fairness, transparency, and accountability are easy to state and hard to systematize; ISO 42001 turns them into a repeatable management discipline with defined roles, risk assessments, controls, and audits. Because it follows the same structure as widely adopted standards like ISO 27001 (information security), organizations can slot AI governance into management systems they already operate - and earn third-party certification that signals trustworthiness to customers, partners, and regulators. TL;DR **ISO/IEC 42001** is the first international standard for an **AI management system (AIMS)** - a certifiable framework for governing AI responsibly across its lifecycle. It uses ISO's **harmonized structure** for management system standards (formerly Annex SL), the same one ISO/IEC 27001 uses, with clauses on context, leadership, planning, support, operation, evaluation, and improvement that map naturally onto **Plan-Do-Check-Act**, plus **Annex A controls** specific to AI (impact assessment, data management, transparency, lifecycle). It is voluntary and certifiable, complements the binding [EU AI Act](https://www.dawiso.com/glossary/eu-ai-act), and - like the Act - depends on documented, well-governed data to satisfy its evidence requirements. ## ISO 42001 Defined ISO 42001 is a **management system standard (MSS)**. It does not certify an AI product or model as "safe"; it certifies that an *organization* has a working system for governing AI - identifying risks, setting policies, assigning responsibility, operating controls, and improving over time. The unit of certification is the management system, not the algorithm. This is the same logic as ISO 27001: you are not certifying that no breach can happen, but that you run a disciplined process to manage information-security risk. Its defining characteristics: - **Process-oriented** - It governs how decisions about AI are made and reviewed, not the technical internals of any single model. - **Risk- and impact-based** - It centers on assessing risks and, distinctively for AI, impacts on individuals and society - not just on the organization. - **Certifiable** - An accredited body can audit and certify conformity, just as with ISO 27001 or ISO 9001. - **Harmonized structure** - It uses ISO's harmonized structure for management system standards (formerly Annex SL), the same one ISO/IEC 27001 uses, so it integrates cleanly with other management systems. ## How the Standard Is Structured ISO 42001 uses ISO's harmonized structure for management system standards (formerly Annex SL), the same one ISO/IEC 27001 uses. Its clauses 4 to 10 map naturally onto the [Plan-Do-Check-Act (PDCA) cycle](https://www.iso.org/standard/42001), and they sit on top of a set of AI-specific controls in its annexes. Clauses 4 to 10 are the management-system core, shared with other ISO standards: - **Clause 4 - Context.** Understand the organization, its AI uses, interested parties, and the AIMS scope. - **Clause 5 - Leadership.** Top-management commitment, an AI policy, and assigned roles. - **Clause 6 - Planning.** Risk assessment, AI risk treatment, objectives, and - distinctively - an **AI system impact assessment** on individuals and society (6.1.4, carried out under 8.4). - **Clause 7 - Support.** Resources, competence, awareness, and documented information. - **Clause 8 - Operation.** Run the AIMS: operationalize the controls across the AI lifecycle. - **Clause 9 - Performance evaluation.** Monitoring, measurement, internal audit, and management review. - **Clause 10 - Improvement.** Handle nonconformities and improve continually. ## Key Requirements & Controls Beyond the clause structure, **Annex A** lists reference controls specific to AI, which an organization selects and applies based on its risk and impact assessments. The themes that recur - and that most distinguish ISO 42001 from generic management standards - are: - **AI impact assessment** - Assessing consequences for individuals and society, not just risk to the organization. This societal lens is the standard's signature feature. - **Data for AI systems** - Controls covering data provenance, quality, and management for AI - the standard explicitly ties good AI to governed [AI-ready data](https://www.dawiso.com/glossary/ai-ready-data). - **Resources for AI systems** - Documenting the data, tooling, computing, and human resources each AI system relies on. - **Lifecycle management** - Governance across design, development, deployment, operation, and retirement. - **Transparency & information** - Telling users and affected parties how AI is used and what it does. - **Use of AI systems** - Defining how the organization uses AI systems responsibly and for their intended purpose. - **Third-party and supplier management** - Extending governance to AI components and models you did not build yourself. Annexes B, C, and D add implementation guidance, potential objectives and risk sources, and guidance on applying the AIMS in specific domains. ## Certification & the EU AI Act ISO 42001 is **certifiable**: an accredited certification body audits the AIMS and, if it conforms, issues a certificate - typically maintained through surveillance audits and periodic recertification, exactly as with ISO 27001. Certification bodies are themselves assessed against [ISO/IEC 42006:2025](https://www.iso.org/standard/44546.html) (published July 2025), which builds on ISO/IEC 17021-1. Certification is voluntary, but it is increasingly requested in vendor due diligence. Its relationship to the [EU AI Act](https://www.dawiso.com/glossary/eu-ai-act) is complementary, not redundant: - **The Act is binding law; ISO 42001 is a voluntary framework.** Conformity with the standard is not automatic legal compliance with the Act. - **But the standard is strong evidence of due diligence.** An operating AIMS demonstrates the kind of risk management, documentation, and oversight the Act demands. ISO 42001 is not, however, a harmonized standard under the Act and gives no presumption of conformity. - **Harmonized standards are a separate track.** [CEN-CENELEC JTC 21 is drafting the harmonized standards for the AI Act](https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation), including prEN 18286, a quality management system standard for the Article 17 obligations of high-risk providers, which entered public enquiry on 30 October 2025. Only standards cited in the Official Journal give a presumption of conformity ([AI Act, Article 40](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)). A mature ISO 42001 program still leaves an organization better placed to adopt them. In short, ISO 42001 is the practical way many organizations will operationalize their journey toward AI Act readiness - and toward broader [AI governance](https://www.dawiso.com/glossary/ai-governance). ## Data Governance for an AIMS Every clause and control in ISO 42001 eventually asks the same question: *can you show it?* Auditors do not accept intentions; they require evidence. And most of that evidence is information about data - what data trained and feeds your AI systems, where it came from, how its quality was assured, who is accountable for it, and how its use is documented. This makes [data governance](https://www.dawiso.com/glossary/data-governance) the substrate of a certifiable AIMS: - A [data catalog](https://www.dawiso.com/glossary/data-catalog) and [metadata management](https://www.dawiso.com/glossary/metadata-management) support Clause 7.5 (documented information) and Annex A's resource documentation (A.4) and data controls (A.7). - [Data lineage](https://www.dawiso.com/glossary/data-lineage) evidences provenance and supports the impact and risk assessments at the heart of Clause 6. - [Data quality management](https://www.dawiso.com/glossary/data-quality-management) and [classification](https://www.dawiso.com/glossary/data-classification) demonstrate the data-for-AI controls in Annex A. - Clear [data ownership](https://www.dawiso.com/glossary/data-ownership) satisfies the accountability the standard expects from leadership down. Dawiso's [AI governance](https://www.dawiso.com/solutions/ai-governance) approach is to make this evidence a by-product of normal operations: the catalog, glossary, and lineage maintained day to day become the documented, auditable record an ISO 42001 assessment depends on. The management system is the discipline; governed data is what makes it provable. ## Conclusion ISO 42001 is how responsible AI becomes a system rather than a slogan. By wrapping AI governance in the familiar, certifiable machinery of a management standard, it lets organizations operate AI with the same rigor they already apply to quality and security - and demonstrate it to anyone who asks. It does not replace the EU AI Act, but it is one of the clearest paths toward meeting it. And like every governance framework, it ultimately rests on a single capability: knowing, documenting, and trusting the data behind your AI. ## Sources - ISO, [ISO/IEC 42001:2023 (catalogue page)](https://www.iso.org/standard/42001) (published December 2023; implemented using the Plan-Do-Check-Act methodology). - ISO, [ISO/IEC 42006:2025, Requirements for bodies providing audit and certification of AI management systems](https://www.iso.org/standard/44546.html) (published July 2025). - European Commission, [Standardisation of the AI Act](https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation) (CEN-CENELEC JTC 21 and the harmonized standards in preparation). - Publications Office of the EU (EUR-Lex), [Regulation (EU) 2024/1689, Artificial Intelligence Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) (Article 40, harmonized standards and presumption of conformity). [See it in action](https://www.dawiso.com/solutions/ai-governance) AI Governance Trust and transparency in your AI use cases. ### Table of contents ISO 42001 DefinedHow the Standard Is StructuredKey Requirements & ControlsCertification & the EU AI ActData Governance for an AIMSSources ## Related Terms ### [What Is AI Governance?](https://www.dawiso.com/glossary/ai-governance) AI governance defines the policies, frameworks, and oversight for responsible AI use. Learn about EU AI Act, NIST AI RMF, ISO 42001, and the US-China-EU regulatory divergence. Read more → ### [What Are AI Guardrails?](https://www.dawiso.com/glossary/ai-guardrails) AI guardrails are rules that validate LLM inputs and outputs to block prompt injection, PII leakage, toxicity, and hallucination. Learn the main types. Read more → ### [What Is Responsible AI?](https://www.dawiso.com/glossary/responsible-ai) Responsible AI is the practice of developing and deploying AI systems that are fair, transparent, accountable, and safe. Learn the core principles, regulatory landscape, and why data governance is the foundation of responsible AI. Read more → ### [What is context understanding in AI](https://www.dawiso.com/glossary/what-is-context-understanding-in-ai) Explore context understanding in AI, how systems comprehend situations, and why it's crucial for intelligence Read more → ### [What is RAG in AI](https://www.dawiso.com/glossary/what-is-rag-in-ai) Understand RAG (Retrieval-Augmented Generation) in AI, how it works, and why it's essential for accuracy Read more → ### [Why is C AI asking my age](https://www.dawiso.com/glossary/why-is-c-ai-asking-my-age) Learn why AI systems request age information for legal compliance, safety, and personalization Read more →