Skip to main content
Currently accepting diagnostic bookings. Same-week availability. Book the Free Diagnostic →
ISO/IEC 42001 · AI MANAGEMENT SYSTEM

ISO 42001 requirements: what the AI standard asks of organisations

ISO/IEC 42001 is the international standard for an AI management system. It asks an organisation to govern the AI systems it builds or uses across their lifecycle: what they are for, what they affect, what data feeds them, who is accountable and how that is evidenced. Clauses 4 to 10 are the management system. Annex A is the AI specific control set.

Work out what you need
  • Published as ISO/IEC 42001:2023
  • Same clause structure as ISO 27001
  • Certificates issued by accredited certification bodies
Clauses 4 to 10

Shared with ISO 27001

Annex A

New: AI specific controls

The overlap is the point.

A customer put it in a questionnaire

The fastest growing reason. An enterprise buyer or a platform partner asks whether you hold ISO 42001, and the honest answer decides whether the deal moves.

You sell into the EU

The EU AI Act creates obligations that differ sharply depending on whether you are a provider or a deployer of an AI system. Most organisations get that classification wrong before they get anything else wrong.

You already run an ISMS

You have clauses 4 to 10 running and audited. Building a second, parallel management system for AI is the expensive mistake.

Do you need ISO 42001, and what would it take?

Four questions tell you whether ISO 42001 is relevant to you. Four more suggest which route fits. Nothing is stored and nothing is sent.

01

What is your relationship to the AI?

02

Has anyone actually asked you for it?

03

Do you sell into the EU?

04

Do you hold ISO 27001?

Result

Answer the questions and the result updates here as you go.

Four more questions suggest which route fits. Prices are published on the pricing page.

What the standard contains

Clauses 4 to 10, the management system

  • Context and interested parties
  • Leadership and AI policy
  • Planning, risk and objectives
  • Support, competence and awareness
  • Operation
  • Performance evaluation, internal audit and management review
  • Improvement and corrective action

If you hold ISO 27001, this half already exists. It needs extending to cover AI, not rebuilding.

Annex A, the AI specific controls

  • AI policy and governance structure
  • Roles and responsibilities for AI systems
  • Resources, including data and tooling
  • Impact assessment for AI systems
  • AI system lifecycle, from objectives through design, verification, deployment and monitoring
  • Data for AI systems, including provenance and quality
  • Information for interested parties
  • Use of AI systems by the organisation
  • Third party and customer relationships

This half is genuinely new, and it is where the work is.

Are you ready for an ISO 42001 audit? A checklist

  • A defined scope and boundary, with the AI systems in scope named.
  • An inventory of those AI systems, recording what each is for and what data it uses.
  • An AI risk assessment method, and a completed risk assessment.
  • An impact assessment for each AI system in scope.
  • A Statement of Applicability covering the Annex A controls, with a reason for each one excluded.
  • An AI policy approved by top management.
  • Records showing the system operates, not only that the documents exist.
  • A completed internal audit by someone independent of the build, and a management review.

To test this before your certification body does, see the Pre-Certification Readiness Audit.

If you already hold ISO 27001, this is not a second management system

ISO 42001 and ISO 27001 share the ISO Harmonised Structure, so clauses 4 to 10 are the management system an ISO 27001 certified organisation already runs and already audits. Context, leadership, planning, support, operation, performance evaluation and improvement extend to cover AI rather than being rebuilt alongside. What is genuinely new is Annex A.

Clause 9.2 requires an internal audit. Goldline does not carry out the internal audit on a management system it implemented: the internal audit is carried out by an independent internal auditor appointed by Goldline, never by the team that built the system.

To document the AI you already run before deciding on ISO 42001, start with the AI readiness assessment.

Who issues the certificate

Not Goldline. ISO 42001 certificates are issued by certification bodies. On 28 October 2026 the UKAS directory listed BSI Assurance UK Ltd, ISOQAR Limited, LRQA Limited, NQA Certification Ltd and TUV UK Limited under Artificial Intelligence Management Systems (AIMS). Check the directory when you approach a body, as the list changes. Goldline implements, prepares and audits. Selling you the implementation and then certifying it would defeat the purpose of the certificate, so we do not do both and we would be sceptical of anyone who offers to.

Questions

ISO/IEC 27001 sets requirements for an information security management system. ISO/IEC 42001 sets requirements for an AI management system, for organisations developing, providing or using AI-based products or services. Both put their management system requirements in clauses 4 to 10, so an organisation certified to ISO 27001 extends its existing system to cover AI rather than building a second one. The Annex A controls differ: ISO 42001's are specific to AI.

No. ISO 42001 is a voluntary standard, and certification is a choice. The EU AI Act does not name it. It becomes a requirement in practice when a customer, contract or framework you deal with asks for it.

The certification body sets its own audit fee, quotes it per engagement, and is paid by you directly. The fee does not pass through Goldline. Goldline's implementation and readiness prices are published on the pricing page.

Yes. Certification bodies certify organisations to ISO/IEC 42001, and UKAS accredits certification bodies for it in the UK. On 28 October 2026 the UKAS directory listed BSI Assurance UK Ltd, ISOQAR Limited, LRQA Limited, NQA Certification Ltd and TUV UK Limited under Artificial Intelligence Management Systems. Goldline does not certify. Read how to choose an ISO 42001 consultant or book a free 45 minute diagnostic.

Not automatically. ISO 27001 covers information security. ISO 42001 covers how AI systems are governed across their lifecycle, including impact assessment, data quality, transparency and human oversight. The two standards share the same clause structure, so clauses 4 to 10 of your existing management system extend to cover AI rather than being rebuilt. That makes the second standard a much smaller piece of work than the first.

Audit-ready in 8 to 12 weeks for a single entity with up to 50 people in scope and a named owner giving about four hours a week. Larger or multi-entity scopes typically take 12 to 24 weeks to audit-ready. The certification body then sets its own Stage 1 and Stage 2 dates.

No. The Act does not name ISO 42001, and certification to it is not a legal requirement under the Act. ISO 42001 is a way of evidencing governance obligations in a form a buyer or a regulator recognises, not a legal requirement in itself.

The answer turns on whether you place an AI system on the market under your own name or use one supplied by someone else. Under Article 3, a provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority. If you place a product containing a third party model on the market under your own name, check whether that makes you the provider. This is the first thing established on the scope call, because the obligations differ sharply either side of the line.

No. ISO 42001 certificates are issued by accredited certification bodies. Goldline implements, prepares and audits, and the certificate comes from an accredited body that is independent of us.

No. Goldline does not carry out a clause 9.2 internal audit on a management system Goldline implemented. If we built it, we introduce an independent auditor from our network instead. The same rule applies to us as to anyone else.

It is set by the certification body, paid to them direct, and varies by the size and complexity of your scope. It never passes through Goldline and carries no Goldline margin.

Where to go next

This page explains the standard. These pages set out the work.

Two short tools sit alongside this page: the AI Governance Readiness Check and the ISO 27001 to 42001 Bridge for organisations already certified.

We use cookies to measure the site and improve it.

Book the Free Diagnostic