ISO/IEC 42001: Information Technology — Artificial Intelligence — Management System

· About ISO/IEC 42001: Information Technology — Artificial Intelligence — Management System

Key Takeaways

  • ISO/IEC 42001:2023 applies to organizations that develop, provide, or use AI systems and want a management-system framework for governance, risk treatment, and continual improvement. It is a voluntary international standard, not a statute, so it does not itself create regulatory fines or legal penalties.
  • The standard was published on 18 December 2023 and remains the current core international edition; ISO’s catalogue still lists it as published, and no ISO-published replacement or amendment was identified in the sources reviewed through 2026.
  • ISO/IEC 42001 is designed to work across the AI lifecycle and complements other management systems, including information security, quality, and risk management systems.
  • The standard requires organizations to define AI governance, roles, objectives, risk controls, documentation, monitoring, internal audit, and management review, with controls tailored to their AI use cases.
  • BS EN ISO/IEC 42001:2026 in the UK incorporates a March 2026 corrigendum and renumbers the British adoption, but it does not indicate a new international edition of ISO/IEC 42001.
  • Penalties attach only indirectly when ISO/IEC 42001 is adopted by contract, procurement, certification schemes, or mapped into legal/regulatory expectations; the standard itself has no statutory fine regime.

What It Is

ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system, is the first international management system standard dedicated to AI governance. ISO states that it specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system within the context of an organization.[1][5]

The standard is published by ISO and IEC through JTC 1/SC 42, the committee responsible for AI standardization.[1][5] ISO’s catalogue lists the document as Published, first edition, publication date 18 December 2023.[1] The standard became the reference point for AI management systems across jurisdictions, and ISO’s own materials continue to describe it as the world’s first AI management system standard.[2][4]

A key national adoption example is the UK’s BS EN ISO/IEC 42001:2026, which the British Standards Institution lists as incorporating a March 2026 corrigendum and superseding BS ISO/IEC 42001:2023.[11] That is a national adoption/renumbering, not a new ISO international edition.[11]

Who Must Comply

ISO/IEC 42001 is voluntary unless made mandatory by contract, procurement, certification program, or internal policy. It is intended for organizations that provide or use products or services based on AI, including entities building, deploying, integrating, operating, or relying on AI systems.[5][12]

There is no formal size threshold in the standard itself; applicability is based on whether AI management system governance is needed in the organization’s context.[5][15] The standard is also not limited to a single sector, so it can apply to technology vendors, financial institutions, manufacturers, public-sector bodies, and service providers.[4][5]

The standard has no extraterritorial legal reach on its own. However, organizations outside a country may still be required to follow it if they seek certification, contract with customers who require it, or operate under a procurement or regulatory framework that references it.

There are no explicit statutory exemptions because the standard is not a statute. Practical scoping exclusions are set by the organization’s own AIMS boundary and by whether a particular AI system, business unit, or legal entity falls inside the management system scope.[15]

Core Requirements

  1. Establish an AI management system. The organization must define the scope, context, interested parties, governance structure, and AI policy for the AIMS.[15]
  2. Assign accountable leadership. Top management must ensure AI governance roles, responsibilities, and authorities are defined and that the AIMS is integrated into business processes.[15]
  3. Plan for AI risks and opportunities. The organization must identify AI-related risks and opportunities and set objectives, controls, and treatment actions proportionate to those risks.[15]
  4. Operate documented controls. The AIMS requires documented information, operational controls, and lifecycle processes for the relevant AI systems and their intended uses.[15]
  5. Support with competence and awareness. Personnel involved in AI governance and operation must be competent, trained, and aware of their responsibilities.[15]
  6. Monitor, measure, and audit performance. The organization must evaluate the AIMS through monitoring, internal audit, and management review, then correct nonconformities and improve continuously.[15]
  7. Address responsible AI themes. ISO’s guidance materials highlight ethics, accountability, transparency, data privacy, and risk management as central themes that the standard is designed to organize within a management system.[4][8]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | ISO/IEC 42001 published | 18 December 2023 | First international edition issued by ISO/IEC.[1][6] | | UK adoption renumbered with corrigendum | 31 March 2026 | BS EN ISO/IEC 42001:2026 incorporates a March 2026 corrigendum and supersedes the UK’s prior adoption.[11] | | Current international status in ISO catalogue | 20 October 2026 | ISO still lists ISO/IEC 42001:2023 as published, with no newer ISO edition identified in the reviewed sources.[1] |

There are no statutory maximum fines under ISO/IEC 42001 itself because it is a technical standard, not legislation. The main sanctions are commercial or certification-based: loss of certification, failed audits, contract termination, exclusion from procurement, or inability to evidence due diligence to regulators or customers. Where a law or contract incorporates ISO/IEC 42001 by reference, noncompliance can lead to legal or contractual consequences under that separate instrument.

How to Comply

  1. Define the AIMS scope and governance model. Map the legal entities, products, services, and AI use cases that fall inside scope, then assign board-level or executive accountability.
  2. Build an AI inventory. Record each model, system, vendor service, intended use, training data source, human oversight point, and deployment jurisdiction.
  3. Run a risk assessment process. Use a repeatable method aligned to ISO 27001 risk treatment where AI touches security, NIST CSF 2.0 where you need outcomes-based cyber and governance alignment, and ISO 42001’s own lifecycle lens for AI-specific risks.
  4. Set AI controls and operational procedures. Cover model approval, testing, change management, incident response, monitoring, human review, and rollback criteria.
  5. Document quality and evidence. Maintain policies, registers, risk acceptances, test results, and management review minutes so the AIMS is auditable.
  6. Integrate privacy and security by design. Align data protection, access control, logging, supplier oversight, and secure development practices with existing security controls.
  7. Perform internal audit and management review. Test whether the AIMS works as intended, close findings, and track continual improvement actions.
  8. Consider certification readiness. If market demand matters, prepare for external certification by tightening evidence, control ownership, and remediation tracking.

Related Regulations

  • EU AI Act: The AI Act is binding law, while ISO/IEC 42001 is a voluntary management framework that can help demonstrate governance maturity but does not replace legal compliance.
  • ISO/IEC 27001: This standard overlaps on governance, risk, controls, and auditability, but ISO/IEC 42001 adds AI-specific lifecycle and responsibility requirements.
  • ISO 9001: Quality management overlaps on process discipline and continual improvement, yet ISO/IEC 42001 focuses specifically on AI systems and AI risks.
  • NIST AI RMF 1.0: The NIST framework is nonbinding and outcome-oriented; ISO/IEC 42001 is more management-system structured and certifiable in practice.
  • ISO/IEC 23894: This risk management standard for AI complements ISO/IEC 42001 by giving more detailed AI risk guidance, especially for identifying and treating AI-specific risks.

FAQ

Does ISO/IEC 42001 apply to companies outside Europe?

Yes. ISO/IEC 42001 is an international standard and is not limited to the EU or any single jurisdiction.[1][4] A company outside Europe may adopt it voluntarily, or be required to comply through customer contracts, procurement terms, or certification expectations.

Is ISO/IEC 42001 mandatory?

No. ISO/IEC 42001 is a voluntary standard unless another instrument makes it mandatory by reference. Its practical force usually comes from customer requirements, internal governance commitments, or certification programs rather than from statute.

Does ISO/IEC 42001 create fines or legal penalties?

No. The standard itself does not set fines, imprisonment, or administrative penalties. Any penalty would arise from another law, a contract, or a certification scheme that references the standard.

What changed in 2025 and 2026?

The reviewed sources do not show a new ISO international edition released in 2025 or 2026; ISO still lists ISO/IEC 42001:2023 as published.[1] A UK adoption, BS EN ISO/IEC 42001:2026, incorporates a March 2026 corrigendum and renumbers the British standard, but that is a national publication change rather than a new ISO edition.[11]

Does ISO/IEC 42001 replace privacy or security laws?

No. It is a management standard and does not override GDPR, the EU AI Act, cybersecurity laws, or sector-specific rules. Instead, it helps organizations organize controls, evidence, and governance so those legal obligations are easier to meet.

Is certification required to say an organization follows ISO/IEC 42001?

No. An organization can implement the standard without seeking certification, although some customers and procurement regimes may prefer or require certification as proof of conformance. Certification is a market signal, not a universal legal requirement.

Sources

Put it into practice

More compliance guides