The Plain English Version

ISO 42001 is the first certifiable international standard for managing artificial intelligence responsibly. It defines an AI management system, an AIMS, the same way ISO 27001 defines an information security management system.

Think of it as the answer to a question your clients are starting to ask: "You use AI in your product or operations. Show us you govern it properly."

Who Does ISO 42001 Apply To?

Any organisation that develops, provides, or uses AI systems: software vendors embedding AI features, firms deploying AI in decision-making, and service providers whose clients demand evidence of responsible AI governance. Certification is voluntary but increasingly requested in enterprise procurement.

What ISO 42001 Requires

  • AI governance - Leadership commitment, an AI policy, and clear roles for AI risk
  • Impact assessments - Evaluating how AI systems affect individuals, groups, and society
  • Lifecycle controls - Managing AI from design and data sourcing through deployment, monitoring, and retirement
  • Third-party AI - Governing AI you buy or build on, not just AI you build
  • Continual improvement - Nonconformances, corrective actions, and internal audits, the classic management system loop

Why This Matters for SMEs

Regulation is arriving regardless of size. The EU AI Act phases in obligations for providers and deployers of AI systems, and an ISO 42001 AIMS is the most direct way to demonstrate the governance those obligations assume. Even outside the EU, enterprise buyers use it as a due diligence shortcut: one certificate answers a page of questionnaire.

Getting Prepared

Start with an inventory: which AI systems do you develop, embed, or use, including AI features inside tools you buy. Assess the impact and risk of each, write an AI policy your board actually approves, and stand up the management loop. If you already run ISO 27001, the structure is deliberately parallel and much of your existing machinery extends to cover AI.