ISO 42001 and AI governance: what the standard requires and how to implement it

ISO/IEC 42001:2023 is the first international standard for AI management systems, published in December 2023 by the International Organization for Standardization. It establishes requirements for organizations to responsibly develop, provide, or use AI systems — and provides a certification path for organizations that want to demonstrate compliance to clients, regulators, and procurement teams.

If your organization operates in the EU, works with enterprise customers who conduct vendor audits, or is building AI products subject to the EU AI Act, ISO 42001 is increasingly relevant. This article explains what the standard requires, how it compares to NIST AI RMF, and what a practical implementation path looks like.

What ISO 42001 is and who needs it

ISO 42001 applies to any organization involved in AI across the supply chain: organizations that develop AI systems, organizations that deploy AI as part of their products or services, and organizations that use AI tools in their operations. The scope is intentionally broad — unlike sector-specific frameworks (MaRisk for German banks, DORA for EU financial entities), ISO 42001 is designed for any industry, any organization size.

The standard uses a management systems framework consistent with ISO 9001 (quality management) and ISO 27001 (information security management). If your organization already has ISO 27001 certification, the structure — Plan-Do-Check-Act cycle, context of the organization, leadership commitment, risk assessment, performance evaluation, continual improvement — will be familiar. ISO 42001 can be integrated with an existing ISO 27001 implementation more efficiently than standing it up independently.

Who is implementing it:

Software and technology companies seeking to demonstrate responsible AI practices to enterprise buyers
Professional services firms (consulting, legal, accounting) that use AI in client engagements and face questionnaires about their AI governance
AI product companies seeking to differentiate on governance in regulated markets
EU-based organizations preparing for EU AI Act conformity assessments, where ISO 42001 certification may serve as partial demonstration of compliance

Who benefits from the certification signal: The ISO 42001 certification mark, once achieved, provides a recognized international signal of AI governance maturity to clients, auditors, insurers, and procurement teams. In the EU market in particular, ISO certification carries cultural credibility that a self-assessed framework alignment (like “NIST AI RMF aligned”) does not.

The structure of ISO 42001

ISO 42001 follows the High Level Structure (HLS) used by other ISO management system standards. The main clauses:

Clause 4 — Context of the organization: The organization must understand its internal and external context for AI use, identify interested parties (employees, customers, regulators, affected individuals), and determine the scope of the AI management system.

Clause 5 — Leadership: Top management must demonstrate leadership and commitment to the AI management system, establish an AI policy, and assign roles and responsibilities. The AI policy must be documented, communicated, and available to relevant parties.

Clause 6 — Planning: The organization must assess AI-related risks and opportunities, establish AI objectives, and plan how to achieve them. This includes the AI risk assessment process and, for AI systems that pose significant impact, an AI impact assessment.

Clause 7 — Support: The organization must provide the resources, competencies, awareness, communication, and documented information needed to support the AI management system. This includes training requirements for personnel involved with AI.

Clause 8 — Operation: The organization must plan, implement, and control the processes needed to meet requirements. This is where the operational controls live — including the processes for AI system development, deployment, monitoring, and decommissioning.

Clause 9 — Performance evaluation: The organization must monitor, measure, analyze, and evaluate its AI management system. This includes internal audits and management reviews.

Clause 10 — Improvement: The organization must respond to nonconformities and continually improve the AI management system.

ISO 42001 also includes two informative annexes that are practically important:

Annex A — Controls: A reference set of AI-specific controls, organized into categories: AI policies, internal organization, resources for AI systems, assessing AI systems, AI system lifecycle, responsible AI, and AI stakeholder relations. These controls are analogous to the controls in ISO 27001’s Annex A, and a “Statement of Applicability” (SoA) is required declaring which Annex A controls are applicable and how they are implemented.

Annex B — Implementation guidance: Guidance on how to implement the Annex A controls. Not part of the auditable requirements but essential for understanding what the controls mean in practice.

How ISO 42001 compares to NIST AI RMF

	ISO 42001	NIST AI RMF
Origin	International (ISO/IEC)	US (NIST)
Type	Requirements standard (certifiable)	Voluntary framework (not certifiable)
Structure	Management system (Plan-Do-Check-Act, HLS)	Four functions (Govern, Map, Measure, Manage)
Certification	Yes — third-party audit and certification available	No — self-assessment or consultant attestation only
Primary market	EU, international	US, global
Sector	Cross-sector	Cross-sector
Integration	Integrates with ISO 27001, ISO 9001	Aligns with NIST CSF, NIST Privacy Framework
Scope	AI developers, deployers, and users	AI developers, deployers, and users

The key practical distinction: ISO 42001 produces a certification that can be presented to clients, auditors, and procurement teams as a verifiable credential. NIST AI RMF produces a documented self-assessment. For organizations selling to European buyers or to enterprise customers who conduct vendor audits, the certification pathway in ISO 42001 is a significant differentiator.

The frameworks are broadly compatible — an organization implementing NIST AI RMF will find the ISO 42001 requirements familiar and vice versa. Many organizations implement both: NIST AI RMF for US-facing operations and client conversations, ISO 42001 for the certification credential and EU market credibility.

What ISO 42001 requires in practice: the key gaps

Most organizations starting an ISO 42001 implementation find the same gaps relative to their current state:

Gap 1: No formal AI policy at the leadership level

ISO 42001 Clause 5.2 requires a documented AI policy that is approved by top management, communicated within the organization, and available to interested parties. It must include commitments to: satisfying applicable requirements, and continual improvement of the AI management system.

Many organizations have an “AI acceptable use policy” (employee-facing) but not an “AI management policy” in the ISO sense — a statement of organizational commitment at the leadership level that frames the entire management system. These are different documents with different audiences.

What satisfies this: A brief (one to two page) AI management policy signed by the CEO or equivalent, stating: the organization’s commitment to responsible AI use, the scope of the AI management system, and the organizational values and commitments that govern AI activities. This should be approved by top management, not just IT or compliance.

Gap 2: No AI risk and impact assessment process

Clause 6.1 requires a process for AI risk assessment — identifying AI-related risks, analyzing them, and evaluating them against risk acceptance criteria. For AI systems that may significantly impact individuals or groups, an AI impact assessment is also required.

The AI impact assessment in ISO 42001 is similar in concept to a GDPR Data Protection Impact Assessment but broader — it covers not just privacy risks but all significant impacts: safety, fairness, transparency, accountability, and human oversight.

What satisfies this: A documented AI risk assessment process (who conducts it, on what trigger, using what criteria) and a completed assessment for each AI system in scope. For AI systems deployed in contexts that affect individuals (hiring tools, credit systems, customer service AI), a documented impact assessment addressing the identified significant impacts.

Gap 3: No AI lifecycle management process

Clause 8 requires the organization to manage AI systems through their lifecycle: design/development, deployment, monitoring, and decommissioning. This includes controls at each stage.

In practice, most organizations using third-party AI tools (rather than building their own) have a lighter version of this gap — they need a process for: evaluating and approving AI tools before use (equivalent to the development/procurement stage), monitoring AI tools in operation, and decommissioning or removing access when tools are no longer approved.

What satisfies this: A documented AI tool lifecycle policy covering: how new AI tools are evaluated before approval (the criteria, who decides, what documentation is required); how approved tools are monitored for changes in data practices, security posture, and alignment with the AI policy; and how tools are removed from the approved list and access is terminated.

Gap 4: No audit trail for AI system operation

Annex A control A.6.2.5 (Operational information) requires that records of AI system operation are maintained. For AI tools used in business processes, this means logs of how AI is being used, what data it processes, and what outputs are produced.

This is equivalent to the monitoring requirement in NIST AI RMF’s Measure function and the audit trail requirement in SOC 2 CC7. For most organizations, the gap is that they rely on provider-side logs (which are insufficient) rather than maintaining an independent organization-controlled audit trail.

What satisfies this: An independent AI activity log that captures, per interaction: user identity, tool/model used, timestamp, data classification of the content, policy decision applied, and any detected policy violations. This log must be retained for the period required by the management system and must be accessible for internal audit purposes.

Gap 5: No internal audit program for AI

Clause 9.2 requires periodic internal audits of the AI management system. The organization must: establish an audit program with defined criteria, scope, frequency, and methods; select auditors who are objective and impartial; and report audit results to relevant management.

What satisfies this: A documented internal audit schedule (typically annual), a qualified internal auditor or external consultant, and records of audit findings, corrective actions, and follow-up. This does not need to be a separate function — for organizations with ISO 27001, the AI management system audit can be integrated into the existing ISO audit cycle.

The certification path

ISO 42001 certification follows the standard ISO certification process:

Gap assessment: Identify current state against ISO 42001 requirements. Most organizations engage a consultant or conduct a self-assessment against the standard.
Implementation: Close the identified gaps. For most organizations, this takes three to six months depending on current maturity and the number of AI systems in scope.
Internal audit: Conduct at least one internal audit cycle before the certification audit to identify and address nonconformities.
Stage 1 audit (documentation review): A certification body auditor reviews the documented AI management system for completeness and adequacy. This is typically a desk review.
Stage 2 audit (implementation audit): Auditors verify that the documented system is implemented effectively. They will interview personnel, review records, and test controls.
Certification: If the Stage 2 audit finds no major nonconformities (or minor nonconformities that are corrected), the certification body issues the ISO 42001 certificate. Certificates are valid for three years with annual surveillance audits.

Practical timeline for a lean organization: Gap assessment (two to four weeks), implementation (eight to sixteen weeks), internal audit (two weeks), certification audit (one to two days), certificate issued (two to four weeks after audit). Total: four to six months from gap assessment to certificate.

ISO 42001 and the EU AI Act

The EU AI Act (effective August 2024, with staggered application dates) introduces mandatory requirements for high-risk AI systems and general-purpose AI models. ISO 42001 is relevant to the EU AI Act in two ways:

Harmonized standard: ISO 42001 is expected to be designated as a harmonized standard under the EU AI Act, meaning conformity with ISO 42001 can serve as a presumption of conformity with certain EU AI Act requirements. This is not yet confirmed as of 2026 but is a likely development given the EU’s history of referencing ISO standards in product regulations.
Management system overlap: The EU AI Act requires high-risk AI providers to implement quality management systems (Article 17) that cover many of the same elements as ISO 42001 — documentation, testing, post-market monitoring, incident reporting. An ISO 42001-compliant management system provides a strong foundation for EU AI Act conformity assessment.

For organizations developing or deploying high-risk AI systems (as defined in Annex III of the EU AI Act), implementing ISO 42001 now builds the management system infrastructure that will be required for EU AI Act conformity assessment.

Qadar AI Shield provides the operational controls that ISO 42001 Annex A requires: AI activity logging for operational information requirements (A.6.2.5), policy enforcement controls for responsible AI use requirements, and a tamper-evident audit trail that satisfies internal audit and certification audit evidence requests. Learn more.