It's the first international standard specifying requirements for an AI Management System, helping organisations govern AI responsibly.

How does ISO 42001 relate to the EU AI Act?

ISO 42001 provides a management-system framework that can support and evidence many EU AI Act governance obligations, though it isn't a substitute for legal compliance.

Any organisation that develops, provides, or uses AI-based products or services and wants to demonstrate responsible AI governance.

Global

ISO/IEC 42001 Certification

Govern AI responsibly with the world's first AI management standard

ISO/IEC 42001 is the world's first international standard for an Artificial Intelligence Management System (AIMS). Published in December 2023, it helps organisations govern AI responsibly through risk management, transparency, and continuous improvement, and complements EU AI Act compliance.

Cláraigh saor in aisce Official source

Global

Standard scope

Annex A controls

3-12m

Typical cert. timeline

Any

Sector or size

2023

Current edition

What is ISO/IEC 42001?

Published in December 2023, ISO/IEC 42001 is the world's first
international standard for an Artificial Intelligence Management
System (AIMS). It follows the same harmonised structure as ISO
27001, covering context, leadership, planning, support, operation,
performance evaluation, and improvement - with an AI-specific
Annex A of 38 controls.

Who needs to comply with ISO/IEC 42001?

Any organisation that provides, develops, or uses products or
services built on AI systems, regardless of size or sector.

What are the key requirements
of ISO/IEC 42001?

An AI policy approved by top management

AI risk and impact assessments across the system lifecycle

Implementation of relevant Annex A controls (data quality, transparency, third-party AI, incident response, etc.)

A Statement of Applicability documenting included and excluded controls

Ongoing monitoring, internal audit, and continual improvement of the AIMS

What are the penalties for ISO/
IEC 42001 non-compliance?

As a voluntary standard there's no statutory fine, but the absence of certification is
increasingly a red flag in enterprise procurement and can weaken your position
when demonstrating EU AI Act readiness.

Teagmháil Linn

Lost AI deals

Enterprise buyers increasingly require AIMS proof

Failed vendor assessments

AI governance questionnaires you can't pass

Slower sales cycles

AI risk reviews stall procurement

Weaker AI Act positioning

Certification gaps undermine compliance evidence

How does GDPRLocal help with ISO/IEC 42001?

GDPRLocal supports you with everything ISO/IEC 42001 requires: building an AIMS from scratch or extending your existing ISO 27001 programme, mapping controls to your EU AI Act obligations, documentation, and full certification-readiness support.

Tosaigh saor in aisce