The ISO 42001 standard (formally ISO/IEC 42001:2023) details requirements for artificial intelligence management systems and is the first international management system standard for AI. The aim of this standard is to help organisations use, develop or provide AI systems in a responsible and controlled way, addressing risks such as unreliable or biased outputs, misuse of personal or confidential data and loss of human oversight, while still allowing the organisation to take advantage of what AI has to offer.
This standard is not just for companies that build AI. Any organisation that uses AI tools in its day to day work, from generative AI assistants and chatbots through to AI features built into business software, can implement and certify against ISO 42001. The standard requires the involvement and commitment of top management, a clearly defined AI policy, and a register of the AI systems in use along with the risks associated with them and the controls applied. There is a specific requirement to carry out AI system impact assessments, considering the effect AI systems could have on individuals and groups, and to decide which activities should remain human-led. The standard also includes a set of reference controls (Annex A) covering areas such as the AI system life cycle, data management, information for users of AI systems, and the use of third-party AI products and suppliers. As with other modern ISO management system standards the focus is on a risk-based approach, so the depth of documentation and control should be proportionate to how the organisation actually uses AI.
Meeting the requirements of this standard
There are various clauses in this standard where there is a requirement to have and retain documented information, so even an organisation making light use of AI will still need to review the requirements and make sure they have documented evidence for things like an AI Policy, an AI risk register, AI system impact assessments and a Statement of Applicability covering the Annex A controls.
isoassured can assist with preparation of management systems to meet the requirements of this standard - check our ISO Consultancy page for details of how we can help with onsite consultancy, remote consultancy or by using our alpha-Z documents package to meet the requirements of this standard. ISO 42001 also follows the same common structure as other ISO management system standards, so for organisations already certified to standards such as ISO 9001 or ISO 27001 it can be added to an existing management system without duplication.
ISO 42001 Certification process
We offer a simple, smart, certification process to provide independent confirmation that your organisation meets the requirements of the ISO 42001 standard and once an audit has been completed with a satisfactory outcome we issue an ISO 42001 registration certificate and authorise the organisation to display our 'ISO 42001 Registered' logo.
Further details on our certification service are available on the ISO Certification page.
Get an ISO 42001 certification quote
ISO 42001 certification with isoassured starts at £750 plus VAT for a single standard. Cost is based on the number of audit days required, not on your turnover or how many people you employ, and there is no long-term contract. Full prices are on our certification costs page.
No obligation. We normally reply within one working day, or call us on 0333 355 0860.
