Skip to main content

ISO/IEC 42001:2023

ISO/IEC 42001 certification for AI management systems

Independent certification of how your organisation governs the development, provision and use of AI systems.

Request a quoteTransfer a certificate
Strands of fibre-optic light suggesting a secure network
Valid for
3 years
Surveillance
Years 1 and 2
Verification
Public register

Accredited and empanelled

What is ISO 42001?

ISO/IEC 42001:2023 is the first international management system standard for artificial intelligence. It applies to organisations that develop, provide or use AI systems, and asks them to set an AI policy, assess AI risks and the impacts of AI systems on individuals and society, and control AI across its life cycle.

Annex A lists 38 reference controls grouped under objectives such as AI policy, internal organisation, resources for AI systems, impact assessment, the AI system life cycle, data for AI systems, information for interested parties, responsible use and third-party relationships. As with ISO 27001, you record which controls apply and why in a Statement of Applicability.

Customers and regulators want to know how AI is governed, and laws such as the EU AI Act place obligations on providers and deployers. Certification does not confer legal conformity, but it gives a structured, audited answer to the governance question.

Who it is for

  • Companies building AI products or models
  • SaaS providers adding AI features to their services
  • Banks and insurers using AI in credit, fraud or underwriting
  • Healthcare organisations deploying clinical or operational AI
  • Public bodies procuring or using AI systems

What sets audit time and cost

Organisations with an established ISO 27001 system often reach a decision twelve to sixteen weeks after application; a first management system usually needs longer before Stage 2.

  • Number of people within the AI management system scope
  • Number and risk level of AI systems in scope
  • Your roles across the AI life cycle
  • Reliance on third-party models, data and platforms
  • Integration with ISO 27001 or ISO 27701

Why it matters

What ISO 42001 gives you

  1. 01

    Trust in AI products

    Customers see that AI risks and impacts are assessed and controlled by a system audited by a third party.

  2. 02

    Clear accountability

    Defined roles for approving, monitoring and retiring AI systems end ad hoc decisions about models in production.

  3. 03

    Impacts weighed before release

    Documented impact assessments surface fairness, transparency and safety concerns before a system reaches users.

  4. 04

    Fits existing systems

    The harmonised structure lets AI governance sit within an ISO 27001 or ISO 9001 system instead of beside it.

The audit

What our auditors examine

  1. 01

    AI roles and scope

    Whether you act as developer, provider, user or more than one, and which AI systems fall within scope.

  2. 02

    AI risk assessment

    Criteria for acceptable AI risk, the risks identified for each system and the treatment chosen.

  3. 03

    AI system impact assessment

    Assessment of potential consequences for individuals, groups and society, repeated when systems change.

  4. 04

    Life cycle controls

    Requirements, design, verification and validation, deployment, operation and monitoring, with records of changes and model versions.

  5. 05

    Data for AI systems

    Provenance, quality and preparation of data used for training, testing and operation.

  6. 06

    Third parties and responsible use

    How third-party models, data and platforms are assessed, and how intended use is communicated to customers and users.

How certification works

Every accredited certificate follows the same three-year cycle, with each step recorded and the result published in our register.

  1. 01

    Application and quote

    Tell us your scope, sites and headcount. We calculate audit time under the accreditation rules and send a fixed quote and audit plan.

  2. 02

    Stage 1 audit

    We review your documented management system, scope and readiness, and agree the Stage 2 plan. Any gaps are reported so you can close them first.

  3. 03

    Stage 2 audit

    Auditors check that the system works in practice: interviews, records and observation across the scope. Nonconformities are raised in writing.

  4. 04

    Certification decision

    Once corrective actions are accepted, a reviewer who did not take part in the audit makes the decision. Your certificate is issued and listed in the public register.

  5. 05

    Surveillance audits

    Shorter audits in the first and second years after certification confirm the system is maintained and improving. The register shows your current status throughout.

  6. 06

    Recertification

    Before the three-year certificate expires, a recertification audit reviews the whole system and renews the certificate for another cycle.

Related standards and audits

Often certified or audited alongside this one, sometimes in a single combined audit.

Industries we audit for

Guides

ISO 42001 questions

We audit; we do not consult.

To keep certification independent, we never design, build or fix the systems we audit, and decisions are made by people who did not take part in the audit. Read our impartiality policy.

Plan your ISO 42001 certification

Tell us your scope, sites and timeline. We reply with an audit plan and a fixed quote.

Request a quoteTalk to our team