ISO/IEC 42001
In short
ISO/IEC 42001 is the international standard for running an AI management system: the policies, roles and processes an organisation uses to develop or use AI responsibly. Companies can be independently audited and certified against it.
- Also called
- ISO 42001, ISO/IEC 42001:2023, AI management system standard, AIMS
- Topic
- Law, policy and the UK
- Level
- Some background helps
- First described
- Published by ISO and IEC as ISO/IEC 42001:2023 in December 2023, developed by committee ISO/IEC JTC 1/SC 421.
ISO/IEC 42001:2023 was published in December 2023 by ISO and the IEC, through their joint AI committee, JTC 1/SC 421. ISO calls it the world's first AI management system standard1.
It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organisation. ISO defines that system as the set of interrelated elements an organisation uses to set policies, objectives and processes for the responsible development, provision or use of AI1. It applies to organisations of any size that develop, provide or use AI-based products or services, including public bodies and non-profits1.
It is a management system standard. It uses the Plan-Do-Check-Act cycle and looks at how AI is governed across an organisation, rather than testing any single AI model1. That is what makes it different from a technical benchmark: certification shows the processes are in place, not that a product is safe.
Certification is done by independent auditors. In the UK, the national accreditation body UKAS accredited BSI as the first certification body for ISO/IEC 42001, checking its competence under ISO/IEC 17021-13. Microsoft lists GitHub Copilot, Microsoft Copilot, Copilot Studio and Microsoft Foundry among services in scope for its ISO/IEC 42001 certification, with regular third-party audits2.
It sits alongside related ISO standards: ISO/IEC 22989 sets out AI terminology and ISO/IEC 23894 gives guidance on AI risk management1. The standard itself is paid-for1.
Example
A UK insurer using AI to triage claims could seek ISO/IEC 42001 certification to show customers and regulators that it has defined who is accountable for its AI, how risks are assessed, and how the system is reviewed over time1.
Why it matters
It gives buyers a recognisable badge to look for when choosing AI suppliers. It does not prove an AI product is accurate or fair, only that the organisation behind it runs a managed process.
Questions people ask
Is ISO 42001 certification mandatory?
ISO develops voluntary international standards, and organisations choose whether to adopt this one and be audited against it2. Accredited certification bodies then carry out the audits3.
Who can certify against ISO/IEC 42001?
Independent certification bodies. In the UK, UKAS accredited BSI as the first certification body for the standard, after checking its competence and impartiality3.
Is ISO 42001 the same as the NIST AI RMF?
No. ISO/IEC 42001 sets requirements for an AI management system that can be audited and certified1. The NIST AI Risk Management Framework is separate, voluntary guidance from the US standards body NIST.
Which companies are ISO 42001 certified?
Microsoft, for one, lists services including GitHub Copilot, Microsoft Copilot and Microsoft Foundry as in scope for its ISO/IEC 42001 certification2.