What is ISO/IEC 42001 and how is it different from ISO/IEC 27001?

ISO/IEC 42001:2023 is the world's first international AI management system (AIMS) standard. It uses the same harmonised high-level structure as ISO/IEC 27001 - Clauses 4 to 10 plus an Annex A control catalogue - but the controls in Annex A target AI-specific risks (bias, explainability, training-data lineage, automated decision-making, AI lifecycle phases) rather than general information-security risks.

Does ISO/IEC 42001 certification satisfy the EU AI Act?

ISO/IEC 42001 is not formally listed as a harmonised standard under the EU AI Act today - the harmonised standards portfolio is still being finalised by CEN-CENELEC under JTC 21. However, an ISO 42001 certificate provides strong evidence that the management-system requirements of EU AI Act Articles 9 (risk management), 17 (quality management) and 61 (post-market monitoring) are met, because the structural overlap is substantial.

How does ISO/IEC 42001 relate to NIST AI RMF?

ISO/IEC 42001 is certifiable and prescriptive; NIST AI RMF is descriptive and voluntary. The four NIST functions map cleanly to ISO 42001 clauses: Govern aligns with ISO clauses 4-5, Map with 6 and 8, Measure with 9, and Manage with 6-8-10. Most organisations use NIST for internal practice and ISO 42001 for external audit.

What are the core ISO/IEC 42001 clauses?

Clauses 4 (context), 5 (leadership), 6 (planning - including the AI impact assessment under 6.1.4), 7 (support), 8 (operation - including the AI system lifecycle and third-party-relationship controls), 9 (performance evaluation), and 10 (improvement). Annex A provides the AI control catalogue that the clauses reference.

What is the typical timeline for ISO/IEC 42001 certification?

Nine to eighteen months from kick-off to certification, depending on the maturity of any existing ISO management system. Organisations already certified to ISO/IEC 27001 typically complete in nine to twelve months because the high-level structure, documentation discipline and internal audit programme already exist.

ISO/IEC 42001 AI Management System: The 2026 Implementation…

The first international AI management system standard. How ISO/IEC 42001:2023 maps to the EU AI Act and NIST AI RMF, and the certification path a board can defend to a regulator.

Scope of ISO/IEC 42001

ISO/IEC 42001:2023, titled "Information technology - Artificial intelligence - Management system", was published in December 2023 by ISO and IEC jointly. It is the first international standard that defines the requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS) within an organisation. It is not a technical standard for individual AI systems and it does not prescribe how a model should be trained, fine-tuned, evaluated or deployed. Instead, it sits one level up: it defines the management framework within which any number of AI systems are governed.

Relationship to ISO/IEC 27001

An organisation implementing ISO/IEC 27001:2022 for information security will recognise the structure immediately. Both standards use the harmonised high-level structure (HLS) of ISO management system standards: Clauses 4 to 10, a leadership-driven Plan-Do-Check-Act cycle, an Annex A list of controls, and a requirement to determine the context and stakeholders of the organisation. The key difference is that the controls in Annex A target AI-specific risks - model bias, explainability, training-data lineage, automated decision-making, AI lifecycle phases - rather than the general information-security risks Annex A of ISO 27001 addresses.

The Seven Operative Clauses

Clause 4: Context of the Organisation

The organisation must determine internal and external issues relevant to its AI activities, identify interested parties (regulators, customers, the public, AI workforce), define the scope of the AIMS, and document the AIMS itself.

Clause 5: Leadership

Top management must demonstrate leadership and commitment, establish an AI policy aligned with the organisation's purpose, assign roles, responsibilities and authorities, and ensure that AI risks and opportunities are managed in line with the organisation's strategic direction. This is where the management-body sign-off lives.

Clause 6: Planning

The organisation must address AI risks and opportunities, conduct an AI risk assessment, develop an AI impact assessment for systems, set objectives, plan changes to the AIMS, and define the criteria for accepting AI risk. Clause 6.1.4 introduces the AI impact assessment, which is the AIMS equivalent of the EU AI Act's fundamental rights impact assessment.

Clause 7: Support

Resources (Clause 7.1), competence (7.2), awareness (7.3), communication (7.4) and documented information (7.5). The AI workforce must have demonstrable competence; documentation must be controlled.

Clause 8: Operation

Operational planning and control, the AI risk-assessment process, AI impact-assessment process for systems, AI system lifecycle controls and AI third-party-relationship controls.

Clause 9: Performance Evaluation

Monitoring, measurement, analysis and evaluation; internal audit; management review. The AIMS includes its own performance evaluation cycle.

Clause 10: Improvement

Continual improvement, nonconformity and corrective action. Findings from audits, incidents, and external feedback feed back into the management cycle.

Annex A: The AI Control Catalogue

Annex A is the AI control catalogue referenced by the operative clauses. Its control categories cover policies for AI, internal organisation of AI, AI resources, AI system lifecycle, AI third-party relationships, customers of AI systems, and AI workforce. Each control maps to an ISO/IEC 42001 clause and is supported by ISO/IEC 42005 (for AI impact assessment) and ISO/IEC 23894 (for AI risk management), which are the companion ISO/IEC standards that go deeper on specific practices.

How ISO/IEC 42001 Maps to the EU AI Act

Although ISO/IEC 42001 is not formally listed as a harmonised standard under the EU AI Act (the harmonised standards portfolio is still being finalised by CEN-CENELEC under JTC 21), it satisfies many of the management-system requirements that Articles 9 (risk management system), 17 (quality management system), 61 (post-market monitoring), and 26 (obligations of deployers) impose on high-risk AI providers and deployers. An organisation certified to ISO/IEC 42001 carries strong evidence that it has the management-system substrate the AI Act presumes.

How ISO/IEC 42001 Maps to NIST AI RMF

The NIST AI Risk Management Framework 1.0 has four functions - Govern, Map, Measure, Manage. ISO/IEC 42001 Clauses 4 and 5 map directly to NIST Govern; Clauses 6 and 8 to Map and parts of Manage; Clause 9 to Measure; Clause 10 to Manage. Either framework can be used to satisfy the structural expectations of the other, although NIST is descriptive (voluntary, advisory) while ISO 42001 is conformity-assessable (certifiable).

The Certification Path

Certification follows the standard ISO management-system pattern. The organisation implements the AIMS, runs internal audits and management reviews to demonstrate operating maturity, then engages an accredited certification body (ISO 17021-compliant) for a two-stage external audit: Stage 1 (documentation review) and Stage 2 (implementation audit). On successful conclusion, the organisation receives an ISO/IEC 42001 certificate, valid for three years subject to annual surveillance audits. The typical timeline from kick-off to certification is 9 to 18 months depending on existing ISO management-system maturity.

How Bidda Maps ISO/IEC 42001

The Bidda registry represents each operative ISO/IEC 42001 clause and each Annex A control category as a discrete compliance node, with crosswalks to the EU AI Act Articles 9, 14, 15, 17, 26 and 61; to NIST AI RMF Govern, Map, Measure, Manage functions; to ISO/IEC 27001:2022 Annex A controls where overlap exists; and to relevant sectoral standards. Compliance officers use the registry to evidence each clause against their internal AIMS; AI agents query the same nodes via the discovery API or MCP server to verify that proposed system changes remain within AIMS scope.

ISO/IEC 42001 AI Management System: The 2026 Implementation Guide for Production AI