What is ISO 42001? Requirements and certification audits

Key takeaways

• What it is: ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. It applies to organizations that develop, provide or use AI.
• Voluntary: ISO says certification is voluntary. ISO does not certify organizations; independent certification bodies do (ISO).
• Organization, not person: an ISO 42001 certificate covers an organization's management system. Lead auditor and implementer courses lead to personal credentials for individuals and are a separate route.
• Two audit stages: Stage 1 reviews the documented AIMS; Stage 2 tests whether it works in practice on the AI systems in scope.
• New rules for certifiers: ISO/IEC 42006:2025, published in July 2025, adds AI-specific requirements for certification bodies on top of ISO/IEC 17021-1 (ISO).

What is ISO 42001?

ISO/IEC 42001:2023 is the first edition of the management system standard for artificial intelligence. It was developed by the joint ISO and IEC committee on AI (ISO/IEC JTC 1/SC 42) and runs to 51 pages (ISO). It is written for organizations that provide or use AI-based products or services.

AI management system (AIMS) means the set of policies, objectives, processes and controls an organization uses to direct and oversee its AI systems. ISO/IEC 42001 does not tell you which AI to build or buy. It sets out how decisions about AI are made, documented, checked and improved.

According to ISO, the standard covers seven areas (ISO). They are leadership and organizational context, AI policy and objectives, AI risk management, data governance and life cycle controls, transparency and information for users, performance evaluation and monitoring, and continual improvement. It uses ISO's harmonized structure for management system standards. The clause layout is the same as in ISO 9001 and ISO/IEC 27001, so organizations that already run one of those systems will recognize it.

What does ISO 42001 require in practice?

ISO/IEC 42001 requires a working management system around your AI, not a single document. The core building blocks an auditor expects to see are:

1. Context and scope. Which AI systems are in scope, and what role you play for each: developer, provider, user, or a combination.
2. Leadership and AI policy. Top management commitment, an AI policy, and defined roles and responsibilities for AI.
3. AI risk assessment and treatment. A repeatable method to identify and evaluate AI risks, and decisions on how to treat them.
4. AI system impact assessment. An assessment of the potential consequences of AI systems for the people and groups they affect.
5. Controls and Statement of Applicability. The standard includes an annex of reference controls. You decide which apply, and justify the choice in a Statement of Applicability, as in ISO/IEC 27001.
6. Life cycle, data and third parties. Controls over how AI systems are designed, tested, deployed, monitored and retired, over the data they use, and over AI supplied by others.
7. Monitoring and improvement. Internal audit, management review, and corrective action when something goes wrong.

ISO/IEC 42001 does not use the term "AI inventory", but a list of every AI system in scope (its owner, purpose, data, whether it is built in-house or supplied, and its risk rating) is a practical starting point. Scope, audit sampling and audit time all depend on which AI systems are included.

Organization certification or individual credential?

Search results for "ISO 42001 certification" mix two different things: certifying an organization's AI management system, and earning a personal credential. The table below separates them.

If a customer has asked whether your company is ISO 42001 certified, they mean the left-hand column. A lead auditor course for one employee does not answer that question. See how ISO 42001 certification of an organization works.

How does ISO 42001 certification work?

Accredited certification bodies are assessed against ISO/IEC 17021-1, the general standard for management system certification, and, for ISO 42001, the AI-specific requirements of ISO/IEC 42006. The audit sequence below is common to management system certification.

1. Scope and AI inventory. You and the certification body agree the AI systems and roles in scope. Audit time depends on them.
2. Stage 1 audit. The auditor reviews your documented AIMS and your readiness for Stage 2.
3. Stage 2 audit. The auditor tests whether the AIMS works, by following selected AI systems through their life cycle with live evidence.
4. Certification decision. People in the certification body who were not on the audit team review the audit and decide.
5. Surveillance and recertification. Surveillance audits during the certificate's validity, and a recertification audit before it expires.

What does the auditor check at Stage 1 and Stage 2?

Stage 1 asks whether the system is designed and documented; Stage 2 asks whether it is working. The matrix below shows the evidence that typically answers each question. It is a practical preparation aid based on the standard's structure, not an official checklist or a list of ISO/IEC 42001 requirements; auditors sample evidence according to your scope.

Illustrative example (hypothetical company): a software company has three AI systems in scope: a support chatbot built on a third-party model, an internal code assistant, and an in-house fraud-scoring model. At Stage 2 the auditor might pick the fraud model and ask how it was approved, what data trained it, how bias was tested, who monitors drift, and what happened the last time its output was challenged. For the chatbot, the questions shift to supplier assessment, contractual commitments and what users are told about the AI.

What is ISO/IEC 42006, and why should a buyer care?

ISO/IEC 42006:2025 sets out additional requirements for bodies that audit and certify AI management systems against ISO/IEC 42001. It supplements ISO/IEC 17021-1, the general standard for management system certification bodies. ISO lists its users as certification bodies and the accreditation bodies that assess them (ISO).

The Standards Council of Canada, a national accreditation body, lists what changed between the draft (DIS) and the published standard. The changes cover liability (5.3.2), audit time calculation (9.1.4.2 and Annex A), competence of certification personnel (7.1, 7.2), AIMS certification documents (8.2.2), and access to the organization's documentation (8.4.2) (SCC).

For a company choosing a certifier, three practical questions follow:

• Competence: does the audit team have knowledge of AI technologies and of the activities in your scope, not only of management systems?
• Audit time: how was the number of audit days calculated for your AI systems?
• Recognition: who accredits the certification body for ISO/IEC 42001, and does that match what your customer or regulator expects? Ask before you sign, and check the answer against the accreditation body's own public register.

Is ISO 42001 mandatory, and does it prove legal compliance?

ISO/IEC 42001 is voluntary. ISO says certification is carried out by independent certification bodies, not by ISO (ISO). A certificate shows that a management system meets ISO/IEC 42001 for its scope. It is not, on its own, proof of compliance with any law, such as the EU AI Act. The standard does require you to determine the relevant requirements of interested parties, which can include legal and contractual requirements for your AI systems, and to decide which of them the AIMS will address.

How much does ISO 42001 certification cost?

The cost of ISO 42001 certification depends mainly on audit time. Audit time depends on the scope: which AI systems are included, your role for each (developer, provider or user), the people and sites involved, and whether the audit is integrated with ISO/IEC 27001. ISO/IEC 42006 sets rules for how certification bodies calculate it. The ISO 42001 certification service page shows EUROTECH's audit steps and starting price. Whichever certifier you ask, request a written quote that lists the audit days and every fee. Our general guide to ISO certification costs explains how audit days are set across standards.

Next step

If a customer has asked about ISO 42001, start with your AI inventory and scope. Then request an ISO 42001 certification quote with the number of AI systems, your role for each, and your sites. For the overall route from first contact to certificate, read how to get ISO certified.

Sources

• ISO, ISO/IEC 42001:2023, AI management systems, accessed 17 October 2026.
• ISO, ISO/IEC 42001 explained, accessed 17 October 2026.
• ISO, ISO/IEC 42006:2025, Requirements for bodies providing audit and certification of AI management systems, accessed 17 October 2026.
• Standards Council of Canada, Transition to ISO/IEC 42006:2025, accessed 17 October 2026.

About the author

Ersin Çetin is a lead auditor with more than 25 years of experience in management system audits, including ISO 9001, ISO 14001 and ISO/IEC 27001. This article explains the published standards as of 17 October 2026; it does not reproduce ISO text and is not legal advice. Photographs in this article are illustrative and AI-generated. EUROTECH Certification, the publisher of this article, offers ISO 42001 certification. Contact EUROTECH.