ISO/IEC 42001:2023 is a management-system standard. It tells a board how to govern AI the way ISO/IEC 27001 tells a board how to govern information security: policy, roles, risk, controls, audit, improvement. It does not certify that a model is safe. It does not replace the EU AI Act, NIST’s AI Risk Management Framework, or your sector regulator.
A certificate can be useful. A certificate without an inventory, an owner, and a residual-risk decision is theatre. The board’s job is the second list, not the badge.
What is ISO/IEC 42001, in one page?
ISO published ISO/IEC 42001 in December 2023 as the first international standard that specifies requirements for an Artificial Intelligence Management System (AIMS). Official ISO copy: it is for organisations that develop, provide, or use AI systems. It uses the Plan-Do-Check-Act structure common to management-system standards. It is 51 pages. It is not free to read in full — ISO sells the text — but ISO’s own explainer is public and is the source for what follows.
An AIMS, in ISO’s words, is a set of interrelated elements intended to establish policies and objectives, and processes to achieve those objectives, for the responsible development, provision, or use of AI systems. In board language: who is allowed to turn AI on, against which risk appetite, with which evidence, reviewed how often.
The standard asks for, at a glance:
- organisational context and interested parties
- leadership and an AI policy
- risk and opportunity management specific to AI
- data and lifecycle controls
- transparency and information for users
- performance evaluation, internal audit, and management review
- continual improvement
It is written to sit next to ISO/IEC 27001 (information security), ISO/IEC 27701 (privacy), and ISO/IEC 23894 (AI risk-management guidance). 42001 is the management system. 23894 is guidance on risk. 22989 is vocabulary. Do not buy all four and call that a programme.
Certification is voluntary. ISO does not certify anyone. Independent certification bodies do. Some of those bodies are accredited; some are not. “We are 42001 certified” is only as strong as the accredited scope on the certificate — which sites, which processes, which AI systems. Ask to see the scope. If the scope is “the innovation lab” and the production agent sits in operations, the certificate does not cover the thing that can hurt you.
What does it require the board to decide?
Three decisions. None of them can be delegated to a vendor.
Appetite. Which AI uses are acceptable, which need extra gates, and which are refused. ISO will not set the appetite. The EU AI Act will refuse some uses outright (Article 5). Your insurers and customers will refuse others. The board writes the remainder.
Ownership. Who is accountable for the AIMS — usually a named executive, not a committee. Who owns each production system. Who may accept residual risk. 42001’s leadership clause exists because AI programmes stall when “everyone owns AI.”
Evidence. What the board will look at each cycle: inventory completeness, incidents, material model or vendor changes, audit findings, and any gap against law. A slide titled “Responsible AI” is not evidence.
If those three are not in the minutes, you do not have an AIMS. You have a project.
How does 42001 relate to the EU AI Act and to NIST?
They answer different questions.
The EU AI Act is law in the Union. It assigns roles (provider, deployer), bans some practices, and stages duties through Article 113. After the 2026 Digital Omnibus, most high-risk system duties apply from 2 December 2027 (Annex III) or 2 August 2028 (Annex I). Prohibitions, GPAI duties, governance, penalties, and Article 50 transparency are already live. 42001 does not postpone or satisfy any of those articles. It can organise the work that produces the files those articles will ask for.
NIST AI RMF 1.0 (26 January 2023) is voluntary. It is organised as Govern, Map, Measure, Manage. The Generative AI Profile, NIST-AI-600-1 (26 July 2024), adds generative-specific risks and suggested actions tagged to those functions (GV, MP, MS, MG). NIST is revising the RMF under the White House AI Action Plan; 1.0 remains the published framework. 42001 and the RMF are compatible. They are not twins. RMF is a risk method. 42001 is a certifiable management system.
A practical mapping, not a legal one:
Board question 42001 AI Act NIST RMF / GenAI Profile Who is accountable? Leadership, policy, roles Provider vs deployer (Art. 3, 25) Govern What systems exist? Inventory as context Needed for Art. 5, 6, 50 Map What could go wrong? AI risk assessment Risk management system (Art. 9) when high-risk applies Map / Measure What do we do about it? Controls, so far as scoped Art. 50 now; Art. 26 later for high-risk deployers Manage How do we know? Internal audit, management review Technical documentation, logs, FRIA where required MeasureIf counsel tells you “we will do 42001 instead of the Act,” replace counsel.
What does a good 42001 programme look like from the board table?
It looks boring. That is the point.
You should see a current inventory: every AI system in production or in a pilot that can affect a person, a payment, or a regulated decision. Owner, provider/deployer role, data classes, tools the system may call, and residual risk.
You should see a policy that a business head can apply without a lawyer in the room: what must be logged, what needs a human gate, what may not be trained on, who is told when the model changes.
You should see risk assessments that name a harm, a likelihood, a control, and an owner — not a heatmap with no sentence under it. Generative and agentic uses should call out prompt injection, excessive agency, data leakage, and supply-chain provenance, because those are the failures that already have public names (OWASP LLM01, LLM06, LLM03; ASI01–ASI04).
You should see an internal audit that sampled real systems, not the policy binder. Management review minutes that change a control or accept a risk in so many words.
You should not see a 40-page “AI ethics charter” and nothing else.
What is 42001 not?
It is not a model evaluation. A certified AIMS can still run a model that hallucinates, leaks, or has been tampered with. The standard requires you to manage that risk. It does not grade the weights.
It is not a substitute for sector law. A bank still has model-risk and conduct rules. A hospital still has device and privacy rules. India’s DPDP Act still makes the Data Fiduciary responsible for processors. 42001 does not displace them.
It is not proof of sovereignty. You can certify an AIMS that runs entirely on a third-party API. The certificate says you manage that dependency. It does not say you own the weights, the logs, or the upgrade clock.
It is not a reason to wait. High-risk AI Act duties were postponed. Management-system work was not.
When is certification worth the money?
When a customer, a public buyer, or an insurer has asked for it by name, and you can write a scope that matches the systems they care about.
When you already have 27001 and can extend the same internal-audit and management-review machine, rather than standing up a second bureaucracy.
When the alternative is twelve customer questionnaires with no single set of answers.
It is not worth the money as a press release, as a substitute for Article 50 work that is already due, or as cover for an inventory you have not done.
If you certify, read the scope statement in the meeting. Ask what was out of scope. Ask the date of the last nonconformity and what changed. Ask whether the production agents that can send mail, write tickets, or touch customer data are in the certified scope. If the answer is slow, the certificate is decorating the wrong building.
What should the board ask at the next meeting?
- What is in the AI inventory, and what did we add or kill last quarter?
- For the five systems with the most authority (tools, data, customers), who is the executive owner and are we provider or deployer?
- Which of those five would be high-risk under Annex III, and what file will exist by December 2027?
- Is Article 50 implemented in production — disclosure, synthetic marking, emotion/biometric notices where used?
- Are we seeking 42001 certification, for which scope, by which accredited body, and why that scope?
- What residual AI risk did management accept since the last meeting, in a sentence?
Those questions work whether or not you ever buy the standard.
What to do next
Commission the inventory and the role table first. Write the AI policy second. Map 42001 clauses to the Act articles and to NIST functions third, so you do not run three programmes. Decide on certification only after the scope is honest.
If the estate is mixed — vendor models, internal agents, and systems that will be high-risk — an Architecture Review is the working session that puts the map on one page. ISO/IEC 42001 can then govern that map. It cannot draw it for you.