ISO 42001 in Practice
ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system. It is certifiable. Enterprise buyers in regulated sectors increasingly request ISO 42001 certification or equivalent evidence from AI vendors.
- Standard
- ISO/IEC 42001:2023
- Kind
- AI management system standard
- Certifiable
- Yes, by external audit
- In the check
- Cited by 4 of the 16 questions
How the standard is built
ISO 42001 follows the same management-system structure as ISO 27001 (information security) and ISO 9001 (quality): context, leadership, planning, support, operation, performance evaluation, improvement. Annex A contains controls specific to AI management.
Control area 1
AI policy
Control area 2
Internal organization (roles, responsibilities)
Control area 3
AI lifecycle (impact assessment, system management)
Control area 4
Data for AI systems
Control area 5
Information for users
Control area 6
Use of AI systems
Control area 7
Third-party and customer relationships
The certification path
Typical timeline 6 to 12 months for organizations with mature ISO 27001 already in place.
| Step | Stage |
|---|---|
| 1 | Pre-assessment |
| 2 | Gap analysis |
| 3 | Control implementation |
| 4 | Internal audit |
| 5 | External certification audit |
Where the check cites it
A mature stage on the AI Posture Check is a starting point for ISO 42001 readiness, not a substitute for the certification path.
| Question the check may ask | Dimension | Citation |
|---|---|---|
| Do you have a data classification policy you could extend to AI inputs? | Data | ISO 42001 Annex A.7 |
| Do you know what data people are putting into AI tools? | Data | OWASP LLM02, ISO 42001 Annex A.7 |
| Is there a named executive accountable for AI risk, even without a policy yet? | Governance | ISO 42001 clause 5.3 |
| Do you review vendor attestations on a cadence and monitor vendors for incidents and model changes? | Vendor | ISO 42001, SOC 2 Type II |
Other frameworks the check cites
Score yourself against this framework.
Five questions, each citing its source. You get your stage, your place on the chart and the one move that matters next.
- A few minutes for most people
- Free, from CWS
- Your stage, the chart and the next move, by email or live with an engineer