ISO/IEC 42001 AI Management Systems: A Reference for Boards and Compliance Teams

Overview

ISO/IEC 42001:2023 — "Information technology — Artificial intelligence — Management system" — was published on December 18, 2023, jointly by the International Organization for Standardization and the International Electrotechnical Commission. It is the international management-systems standard for artificial intelligence, and the first such standard published under the Annex SL harmonized high-level structure (HLS) that governs every modern ISO management-systems standard, including ISO/IEC 27001 (information security), ISO 9001 (quality), ISO 14001 (environmental), and ISO 22301 (business continuity).

The harmonized structure is the reason ISO/IEC 42001 has moved so quickly from a technical-standards artifact into a practical board reference. Organizations that already hold ISO/IEC 27001 or ISO 9001 certification have an existing management-system substrate — documented context, leadership, planning, support, operation, performance evaluation, and improvement processes — that ISO/IEC 42001 extends rather than displaces. For those organizations, an AI management system (AIMS) is an additional scope on an existing program rather than a parallel program. For organizations without prior ISO certification, ISO/IEC 42001 is typically the first ISO management system they adopt, and the substrate it establishes is reusable for the ISO/IEC 27001 work that almost always follows.

This reference is for audit committee chairs, GCs, CCOs, and D&O underwriters at US public and large private companies. It treats the standard clause by clause, walks the Annex A control library, describes the third-party certification pathway, maps ISO/IEC 42001 to the NIST AI Risk Management Framework and to ISO/IEC 23894, and explains why the standard has become a procurement gating criterion and a favorable D&O underwriting signal in 2026.

The clause structure

ISO/IEC 42001 contains ten clauses. Clauses 1 through 3 (scope, normative references, terms and definitions) are informational. Clauses 4 through 10 are normative — they state the requirements an organization must satisfy to claim conformance with the standard. The clause numbering, structure, and much of the language is shared verbatim with ISO/IEC 27001 and ISO 9001, which is what enables integrated management-system implementations.

Clause 4 — Context of the organization

Clause 4 requires the organization to define the boundaries within which the AI management system operates. Clause 4.1 obligates the organization to identify external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcomes of its AIMS — including AI-specific issues such as the maturity of the regulatory environment, the state of the technology, and the organization's position in the AI value chain (as a developer, deployer, or both). Clause 4.2 requires identification of interested parties (regulators, customers, affected individuals, suppliers, employees) and their relevant requirements. Clause 4.3 requires the organization to determine and document the scope of its AIMS — which business units, products, AI systems, and geographies are inside the system, and which are deliberately excluded. Clause 4.4 requires the AIMS itself to be established, implemented, maintained, and continually improved.

For US boards, Clause 4.3 is the most consequential. The scope statement defines what the certificate certifies. A scope that excludes the company's customer-facing generative AI features, or that omits a recently-acquired subsidiary, produces a certificate that procurement counterparties and D&O underwriters will read carefully — and discount accordingly.

Clause 5 — Leadership

Clause 5.1 obligates top management to demonstrate leadership and commitment with respect to the AIMS by, among other things, ensuring the AI policy and AI objectives are established and are compatible with the strategic direction of the organization, ensuring integration of AIMS requirements into the organization's business processes, ensuring the resources needed for the AIMS are available, and supporting other relevant management roles. This clause is where board-level accountability for AI governance is documented; the certification audit will look for evidence that the board and senior management have actually exercised the oversight the policy claims.

Clause 5.2 requires a documented AI policy that is appropriate to the purpose of the organization, provides a framework for setting AI objectives, includes commitments to satisfy applicable requirements, and commits to continual improvement of the AIMS. Clause 5.3 requires the assignment of organizational roles, responsibilities, and authorities for the AIMS — typically including a designated AI governance lead, a delegating executive, and a board-level committee with oversight responsibility.

Clause 6 — Planning

Clause 6 is the substantive risk clause and the heaviest lift in most implementations. Clause 6.1 requires the organization to determine the risks and opportunities relevant to its AIMS, perform an AI risk assessment (Clause 6.1.2) that identifies AI risks, analyzes their likelihood and consequence, and evaluates them against established criteria, and implement an AI risk treatment process (Clause 6.1.3) that selects appropriate risk treatment options, determines necessary controls (with reference to Annex A), and produces a Statement of Applicability documenting which controls are implemented, which are excluded, and the justification for each decision.

The Statement of Applicability is the central artifact of an ISO/IEC 42001 program. It is the document procurement counterparties will request, the document a certification auditor will return to repeatedly, and the document that maps most directly to the technical documentation obligations under the EU AI Act and other regulatory regimes. Clause 6.1.4 adds an AI-specific obligation absent from ISO/IEC 27001: the requirement to consider impacts on individuals, groups of individuals, and societies — bringing the impact-assessment discipline into the risk-treatment process at the planning stage rather than as an afterthought.

Clause 6.2 requires the establishment of measurable AI objectives, with planning that documents what will be done, what resources will be required, who will be responsible, when it will be completed, and how the results will be evaluated. Clause 6.3 governs planning of changes to the AIMS — including how the organization will manage changes driven by new AI capabilities, new regulations, or changes in the AI risk landscape.

Clause 7 — Support

Clause 7 specifies the resources the AIMS requires to function. Clause 7.1 covers resource determination and provision. Clause 7.2 obligates the organization to determine the competence required for persons doing work that affects AI performance and to ensure those persons are competent, with documented evidence. Clause 7.3 requires AI awareness across the organization — employees must understand the AI policy, their contribution to AIMS effectiveness, and the implications of not conforming with AIMS requirements. Clause 7.4 governs internal and external communication about AI. Clause 7.5 specifies the documented information the AIMS must maintain — both the documents required by the standard and the documents the organization itself determines necessary for AIMS effectiveness.

Clause 7.2 is the clause that produces the AI literacy and AI training infrastructure that the EU AI Act independently requires under Article 4. Companies building toward both ISO/IEC 42001 and EU AI Act compliance can build the underlying competence and training program once.

Clause 8 — Operation

Clause 8 brings the planning of Clause 6 into operational practice. Clause 8.1 obligates the organization to plan, implement, and control the processes needed to meet AIMS requirements and to implement the actions determined under Clause 6. Clauses 8.2 and 8.3 require AI risk assessment and AI risk treatment to be performed at planned intervals or when significant changes occur — these are the operational analogs to the planning-stage obligations under Clause 6. Clause 8.4 introduces the AI system impact assessment: a structured assessment of the consequences for individuals, groups, and societies that the AI system may produce, performed before deployment and revisited when the system changes materially.

Clause 8.4 is the standard's substantive interface with the EU AI Act's fundamental rights impact assessment (Article 27), the Colorado AI Act's algorithmic impact assessment obligations, and NYC Local Law 144's bias audit obligation. Organizations that build a robust Clause 8.4 process produce the impact-assessment documentation those regimes demand, with conforming controls and retention periods.

Clause 9 — Performance evaluation

Clause 9.1 requires the organization to monitor, measure, analyze, and evaluate the AIMS — including determining what needs to be monitored and measured, the methods for monitoring, the intervals, and the assignment of responsibility for analysis and evaluation. Clause 9.2 requires internal audits of the AIMS at planned intervals, conducted by competent auditors with appropriate independence from the audited activity. Clause 9.3 requires management review of the AIMS at planned intervals — the documented review by top management that produces decisions on opportunities for improvement, changes to the AIMS, and resource needs.

For the audit committee chair, Clause 9.3 is where the management-review cadence — the briefing the committee actually receives — is documented. Certification auditors will examine the minutes of the management review the same way they examine any other evidence of operational implementation.

Clause 10 — Improvement

Clause 10.1 requires continual improvement of the AIMS. Clause 10.2 requires the organization to react to nonconformities, evaluate the need to eliminate their causes, implement corrective action, review effectiveness, and update the AIMS as necessary — with documented information retained as evidence of the nature of the nonconformities and the actions taken. Clause 10 is the clause that operationalizes incident response and corrective action; certification auditors look here for evidence that the organization actually closes the loop on the issues its monitoring and audit processes surface.

Annex A controls

Where the clauses define the management system, Annex A provides the library of AI-specific controls the organization draws on to treat the risks identified under Clause 6.1.2. Annex A in ISO/IEC 42001:2023 lists 38 controls organized under nine control objectives, numbered A.2 through A.10. (There is no A.1 — the numbering aligns with the corresponding implementation guidance categories in Annex B.) The organization is not required to implement every Annex A control. It is required to determine which controls are necessary, to implement those, and to justify any exclusions in the Statement of Applicability.

The nine Annex A categories are:

• A.2 — Policies related to AI. Establishes management direction for AI through a documented AI policy and related topic-specific policies, with periodic review and alignment with the broader organizational policy set.
• A.3 — Internal organization. Establishes accountability for AI within the organization — including documented roles, responsibilities, segregation of duties, and reporting of concerns.
• A.4 — Resources for AI systems. Requires the organization to identify and document the resources its AI systems depend on — data, tooling, computing infrastructure, human resources — and to manage those resources through the AI system lifecycle.
• A.5 — Assessing impacts of AI systems. Provides the controls that implement Clause 8.4 — the impact assessment process, the documentation of impacts on individuals and groups, and the integration of impact findings into risk treatment.
• A.6 — AI system life cycle. The largest control objective by control count. Covers AI system requirements, design, development, verification and validation, deployment, operation and monitoring, and technical documentation across the lifecycle. The controls here map most directly to the technical documentation obligations under EU AI Act Article 11 and Annex IV.
• A.7 — Data for AI systems. Covers data management — provenance, quality, preparation, governance, retention — across training, validation, and operational data. The controls here map to EU AI Act Article 10 (data and data governance), Colorado AI Act data-quality obligations, and the NIST AI RMF "Manage" function.
• A.8 — Information for interested parties of AI systems. The transparency control objective. Covers documentation provided to users of AI systems, communication of intended use and limitations, communication of incidents, and the information made available to affected individuals. Maps directly to EU AI Act Article 13 (transparency to deployers), Article 50 (transparency to affected persons), and California ADMT notice obligations.
• A.9 — Use of AI systems. The responsible-use control objective. Covers the controls governing how AI systems are used inside the organization — documented use cases, intended use, monitoring of operational use, and the controls that govern the use of third-party AI systems.
• A.10 — Third-party and customer relationships. Covers the controls governing relationships with AI suppliers, AI customers, and other third parties — including allocation of responsibilities across the AI value chain, contractual provisions, and supplier risk management.

Annex B provides implementation guidance for each Annex A control. Annex C provides further context on AI-specific objectives and risk sources that an organization should consider during risk assessment (Clause 6.1.2). Annex D treats the use of AIMS across sectors. Only Annex A is normative; B, C, and D are informative.

Certification

Third-party certification against ISO/IEC 42001 follows the same structure as certification against ISO/IEC 27001 or ISO 9001. Certification is performed by an accredited certification body, not by ISO or IEC themselves. Accreditation is performed by national accreditation bodies — ANAB in the United States, UKAS in the United Kingdom, RvA in the Netherlands, and similar bodies in other jurisdictions — under international agreements that produce mutual recognition of certifications across borders.

The certification audit is conducted in two stages. Stage 1 is a readiness review: the audit team examines the AIMS documentation, the Statement of Applicability, the scope, and the management-review records, and identifies any gaps that must be closed before Stage 2. Stage 1 typically takes one to two days. Stage 2 is the operational audit: the audit team examines evidence of operational implementation — records of risk assessments performed, controls executed, audits conducted, management reviews held, and corrective actions closed. Stage 2 typically takes three to nine or more days depending on the scope of the AIMS and the size of the organization. The certification body's final report identifies any nonconformities; major nonconformities must be closed before the certificate issues.

A certificate is valid for three years. Annual surveillance audits are performed in years 2 and 3 — typically focused on Clauses 8 through 10 and a sample of Annex A controls — at approximately one-third the effort of the initial certification. Recertification is required at the end of the three-year cycle and proceeds through a process structurally similar to the initial certification, though typically less burdensome where the AIMS has remained stable.

As of May 2026, the population of ANAB-accredited ISO/IEC 42001 certification bodies in the United States is small but growing. Schellman was the first ANAB-accredited body for ISO/IEC 42001 and remains the most active US issuer. Coalfire Certification, A-LIGN, and BSI (under its US accreditation as well as its UKAS and RvA accreditations) are active in the US market. DNV, Bureau Veritas, SGS, TÜV SÜD, NQA, and Intertek also offer ISO/IEC 42001 certification under various national accreditations. Companies selecting a certification body should verify the body's accreditation specifically against ISO/IEC 42001 — accreditation for ISO/IEC 27001 does not automatically extend — and should verify that the body is recognized by the procurement counterparties or D&O underwriters whose expectations the certification is intended to satisfy.

ISO/IEC 42001 with NIST AI RMF and ISO/IEC 23894

ISO/IEC 42001 does not stand alone. Most mature AI governance programs treat it as the management-system substrate and pair it with one or both of two adjacent frameworks: the NIST AI Risk Management Framework and ISO/IEC 23894.

The NIST AI RMF (NIST AI 100-1, January 2023) is the United States voluntary risk-management framework for AI, organized around four functions: Govern, Map, Measure, and Manage. The NIST framework is not a management-system standard — it does not specify a Plan-Do-Check-Act cycle, does not produce a certifiable artifact, and does not impose Clause-7-style documented information requirements. It is, instead, a flexible risk-management methodology that an organization can apply at whatever depth its risk profile justifies. NIST has published a formal crosswalk mapping the AI RMF subcategories to ISO/IEC 42001 clauses and Annex A controls, and that crosswalk is the practical starting point for organizations building toward both frameworks.

ISO/IEC 23894:2023 — "Information technology — Artificial intelligence — Guidance on risk management" — is the ISO companion to ISO/IEC 42001 that supplies AI-specific risk-management methodology. Where ISO 31000 provides generic enterprise risk-management guidance, ISO/IEC 23894 applies that methodology specifically to AI systems — treating AI-specific risk sources, AI-specific likelihood and consequence analysis, and AI-specific risk treatment options. ISO/IEC 23894 is informative guidance rather than a normative requirement; an organization does not certify against ISO/IEC 23894. But organizations implementing Clause 6.1 of ISO/IEC 42001 typically reach for ISO/IEC 23894 as the methodological reference for how to actually perform the AI risk assessment the management system requires.

The pragmatic stack: NIST AI RMF as the high-level risk taxonomy and US-regulator-facing language; ISO/IEC 23894 as the methodological reference for AI risk assessment; ISO/IEC 42001 as the management-system substrate that ties it together and produces the certifiable artifact.

Regulatory mapping

ISO/IEC 42001 documentation is not, by itself, regulatory compliance. No regulator has declared ISO/IEC 42001 certification a safe harbor against any of the major AI regulatory regimes. But the documentation an ISO/IEC 42001 program produces overlaps substantially with the documentation the regimes themselves require, and that overlap is the practical reason ISO/IEC 42001 has become the architecture of choice for multi-jurisdictional AI compliance programs.

EU AI Act. The Act's high-risk system obligations — risk management system (Article 9), data and data governance (Article 10), technical documentation (Article 11), record-keeping (Article 12), transparency to deployers (Article 13), human oversight (Article 14), accuracy and robustness (Article 15), quality management system (Article 17) — map directly to ISO/IEC 42001 clauses and Annex A controls. The Act's quality-management-system obligation under Article 17 is, in substance, an AIMS. The European Commission has signaled that the harmonized standards under development for the AI Act will likely incorporate or reference ISO/IEC 42001; the formal harmonization process is one of the sources of standards-development delay that prompted the Digital Omnibus deferral discussed in the companion EU AI Act reference.

New York RAISE Act. The RAISE Act's safety and security protocol obligation, annual third-party audit obligation, and incident-reporting obligations map onto ISO/IEC 42001's documented AI policy (Clause 5.2 and Annex A.2), internal audit (Clause 9.2), and nonconformity and corrective action (Clause 10.2) requirements respectively. An ISO/IEC 42001 program does not satisfy the RAISE Act, but a covered developer that already operates an AIMS will find the incremental work substantially reduced.

Colorado AI Act. The Colorado Act's developer and deployer obligations — risk-management policy and program, algorithmic discrimination impact assessment, annual review, consumer disclosures — map to ISO/IEC 42001 Clauses 5, 6, 8.4, 9.3, and Annex A.5 and A.8.

NYC Local Law 144. The bias audit obligation for automated employment decision tools maps to ISO/IEC 42001 Annex A.5 (impact assessment) and Clause 9.2 (internal audit), with the published bias-audit summary serving as transparency documentation under Annex A.8.

Illinois HB 3773. The Illinois AI employment amendments — notice to applicants and employees, prohibition on protected-class discrimination via AI — map to ISO/IEC 42001 Annex A.5 (impact assessment), A.8 (information for interested parties), and A.9 (use of AI systems). Companies operating under both the Illinois amendments and NYC Local Law 144 typically satisfy both within a single ISO/IEC 42001-aligned program.

In each case, certification against ISO/IEC 42001 is not a substitute for the regime-specific filings, notices, or registrations. It is the documented governance substrate against which those filings, notices, and registrations are produced, and the artifact that an enforcement authority, procurement counterparty, or insurance underwriter can read as a credible third-party signal of AI governance maturity.

Procurement and D&O underwriting

Two market dynamics have moved ISO/IEC 42001 in 2026 from a governance preference into a practical business requirement.

The first is procurement. Enterprise procurement organizations in financial services, healthcare, government contracting, and critical infrastructure are increasingly listing ISO/IEC 42001 certification as either a gating criterion or a scored factor in AI vendor selection. The pattern is identical to the evolution of ISO/IEC 27001 in enterprise security procurement between 2010 and 2020 — initially a competitive differentiator, then a scored factor, eventually a gating requirement. The acceleration with ISO/IEC 42001 has been faster, driven by the EU AI Act timeline pressure, the publication of the NIST AI RMF crosswalk, and the willingness of major procurement organizations to incorporate AI governance certifications into existing third-party risk management programs that already reference ISO/IEC 27001. AI vendors selling into regulated industries who are not yet certified are increasingly being asked to commit to certification on a defined timeline as a condition of contract.

The second is D&O underwriting. Carriers writing directors and officers liability coverage for technology companies and for any company with material AI exposure are asking pointed questions at renewal about AI governance maturity. The underwriting questionnaires that emerged across the 2025-2026 renewal cycle ask, in nearly every variant: does the company hold ISO/IEC 42001 certification? If not, has it adopted the NIST AI RMF? Does the board receive regular reporting on AI risk? Is there a documented AI policy? Has the company conducted an AI impact assessment? Companies that can answer the first question affirmatively are credited favorably in pricing and capacity. Companies that cannot — and that also cannot demonstrate substantial alignment with the NIST AI RMF or active progress toward ISO/IEC 42001 certification — are seeing harder markets, higher retentions, and in some cases exclusions or carve-outs for AI-related claims. The companion briefing on AI governance and D&O liability treats this dynamic in greater depth.

Practical implementation steps for 2026

A company beginning an ISO/IEC 42001 implementation in 2026 should expect a twelve-to-eighteen-month path from kickoff to Stage 2 audit, depending on the maturity of its existing AI governance practice and its existing ISO certifications.

Step 1 — Decide scope

The scope decision (Clause 4.3) is the most consequential decision in the program and should be made by the board committee that owns AI oversight, not by the implementation team. A narrow first-cycle scope — for example, one product line or one geography — is legitimate and often advisable; it produces a credible certificate within a defensible timeline and creates the substrate for scope expansion in subsequent cycles. A scope that excludes the company's most consequential AI exposure, however, produces a certificate that procurement counterparties and D&O underwriters will read carefully.

Step 2 — Integrate with existing management systems

Companies that already hold ISO/IEC 27001 should plan an integrated AIMS-ISMS implementation. The Clause 4 through 10 structure is shared; the management review, internal audit, documented-information, and corrective-action processes can be run jointly. The Statement of Applicability for ISO/IEC 42001 is a new artifact, but the surrounding management-system infrastructure is reused.

Step 3 — Build the AI inventory and risk assessment

Catalog every AI system inside the scope. For each, document function, data inputs, model inputs, intended use, deployment context, and the parties affected. Perform the Clause 6.1.2 AI risk assessment against the inventory, and produce the initial Statement of Applicability against Annex A.

Step 4 — Build the controls

Implement the Annex A controls selected in the Statement of Applicability. For organizations with an existing NIST AI RMF program, the crosswalk identifies which of the controls are already substantively implemented and require only documentation alignment, and which require new implementation work.

Step 5 — Operate the system, then audit

ISO/IEC 42001 certification cannot be obtained against a paper AIMS. The certification body looks for operational evidence — records of risk assessments performed, controls executed, audits conducted, management reviews held. Most organizations need three to six months of operational records before Stage 2. Plan accordingly.

Step 6 — Select the certification body and schedule Stage 1

Engage the certification body early. The population of accredited bodies is small enough that scheduling can constrain the program timeline more than implementation itself. Verify accreditation specifically for ISO/IEC 42001 and verify acceptance by relevant procurement counterparties.

Step 7 — Brief the board

The audit committee or the committee that owns AI oversight should be briefed at scope selection, at the start of operational implementation, before Stage 1, before Stage 2, and at issuance of the certificate. The management-review record (Clause 9.3) is the documented artifact of that oversight and will be examined by the certification auditor.

How to cite this article

Techné AI, ISO/IEC 42001 AI Management Systems: A Reference for Boards and Compliance Teams (May 13, 2026), https://techne.ai/insights/iso-iec-42001-reference.

Related references

• The NIST AI Risk Management Framework Reference — the US voluntary framework most often paired with ISO/IEC 42001 to build a complete AI governance posture.
• ISO/IEC 23894 AI Risk Management Guidance Reference — the ISO companion that supplies AI-specific risk-management methodology alongside ISO/IEC 42001's management-system structure.
• The EU AI Act for US Boards — the regulatory regime whose substantive obligations ISO/IEC 42001 most directly maps.
• The New York RAISE Act Reference — the US state law whose framework requirements ISO/IEC 42001 substantially supports.
• Multi-Jurisdictional AI Compliance: Building a Unified Framework — the unified-program approach in which ISO/IEC 42001 provides the management-system substrate.