ISO/IEC 42001:2023 · AI management system · Certifiable standard
What is ISO 42001?
ISO/IEC 42001 is the international standard for an AI management system, or AIMS: the policies, roles, risk and impact assessments and controls an organisation runs to develop or use AI responsibly. Published in December 2023, it is certifiable like ISO 27001, with a three-year certificate and annual surveillance audits. Its Annex A lists 38 reference controls.
Sources: ISO/IEC 42001:2023, Information technology: Artificial intelligence: Management system, ISO; Schellman becomes first ISO 42001 ANAB-accredited certification body; UKAS grants first accreditation for artificial intelligence management systems; NABCB News Updates, May 2026: Artificial Intelligence Management System (AIMS), ISO/IEC 42001 scheme; AWS achieves ISO/IEC 42001:2023 Artificial Intelligence Management System accredited certification; Anthropic achieves ISO 42001 certification for responsible AI
Key facts
| Owner | ISO and IEC, joint technical committee JTC 1/SC 42 (artificial intelligence) |
|---|---|
| Published | December 2023 (first edition) |
| Structure | Clauses 4 to 10 on the harmonised management-system structure; Annex A (normative) with 38 reference controls in nine groups, A.2 to A.10, from AI policies and internal organisation through data, transparency, use of AI systems and third-party relationships; Annex B (normative) with implementation guidance for each control; Annex C (informative) on AI-related objectives and risk sources; Annex D (informative) on use across domains and sectors |
| What is mandatory | An AI policy (clause 5.2), defined roles and authorities (clause 5.3), an AI risk assessment (clauses 6.1.2 and 8.2), AI risk treatment with a Statement of Applicability against Annex A (clauses 6.1.3 and 8.3), an AI system impact assessment for the people and groups each system affects (clauses 6.1.4 and 8.4), internal audit (clause 9.2) and management review (clause 9.3) |
| Certificate | Three years, with a surveillance audit each year, after a Stage 1 and Stage 2 audit. Certification bodies are assessed against ISO/IEC 17021-1 and ISO/IEC 42006:2025, the requirements for bodies that audit and certify AI management systems |
| Accreditation | ANAB accredited its first ISO 42001 certification body, Schellman, announced 24 Sep 2024. UKAS announced its first AIMS accreditation, to BSI, on 15 Jan 2026 (BSI's own release is dated 17 Nov 2025). NABCB lists an AIMS scheme under ISO/IEC 17021-1:2015 and ISO/IEC 42006:2025 and invited applications from certification bodies in May 2026. |
| Who certifies in India | Not published yet. Infofacility will add this once it is sourced and checked. |
| Cost in India | Not published yet. Infofacility will post an Indian price range, with what it covers, once it has three comparable quotes. |
| Time to certify | Not published yet. Infofacility will add this once it is sourced and checked. |
| Pairs with | ISO 27001 (same clause structure, one integrated audit), ISO 27701 for personal data in training and inference, the EU AI Act and NIST AI RMF for the law and the risk framework |
Who needs it
- Nobody is required by law to hold ISO 42001. Companies pursue it because a buyer asks for it in procurement, because they build or sell AI products and want an audited answer to "how do you govern this", or because they export to the EU and want a management system that lines up with the EU AI Act's obligations. For Indian IT services and SaaS companies, it is becoming the AI counterpart of the ISO 27001 certificate customers already expect.
- The standard does not care how big you are or what your AI does; it asks you to show you understand the risks and impacts of each AI system you develop or use, and that someone is accountable for them. The AI system impact assessment is the part that is new to most organisations: it looks outward, at the people and groups a system affects, as well as at the company's own risk.
- In India the accreditation infrastructure is new. NABCB opened an AIMS scheme in 2026 and invited certification bodies to apply; until Indian bodies are accredited, Indian certificates come from bodies accredited by ANAB, UKAS and others, which is how AWS, Anthropic and the early adopters were certified. Check the accreditation mark on any certificate, including your own.
How certification works
Step 1
Scope the AIMS
Which AI systems, teams, products and sites are in. Most companies start with the AI they build or embed in a product, not every spreadsheet macro.
Step 2
Write the AI policy and name the roles
Who owns AI risk, who approves a new AI system, who signs the impact assessment.
Step 3
Assess risks and impacts
An AI risk assessment for the organisation and an AI system impact assessment for each system, looking at the people and groups it affects.
Step 4
Choose controls and record them
Pick from Annex A's 38 controls, add your own where needed, and write the Statement of Applicability saying what applies and why.
Step 5
Run it, then audit it yourself
Operate for long enough to have evidence, hold an internal audit and a management review.
Step 6
Stage 1 and Stage 2 with the certification body
Stage 1 checks the documentation; Stage 2 checks that it is really operating. Pick a body whose accreditation covers ISO 42001 and ask which accreditation body granted it.
Step 7
Keep it alive
A surveillance audit each year and recertification in year three. New AI systems get an impact assessment before launch.
Who holds it
Announced ISO 42001 certifications, from the organisations' own statements
| Organisation | Announced | Certification body | Scope, in brief |
|---|---|---|---|
| AWS | 25 Nov 2024 | Schellman (ANAB-accredited) | Amazon Bedrock, Amazon Q Business, Amazon Textract and Amazon Transcribe |
| Anthropic | 13 Jan 2025 | Schellman (ANAB-accredited) | Anthropic's AI management system, covering governance, testing and monitoring, transparency and oversight of its AI development and deployment |
Dates are the announcement dates, not the dates on the certificates. The table lists only certifications Infofacility has checked against the organisation's own announcement. Indian companies with announced ISO 42001 certificates will be added as each announcement is checked.
Get there with Infofacility
GRC · Infofacility service
ISO 42001 AI management system
Policies, impact assessments and the Annex A controls that apply to the AI you build or use. 3 to 6 months.
Request a callbackQuestions
Is ISO 42001 mandatory anywhere?
No. It is a voluntary standard. Some buyers write it into contracts, and regulators refer to management-system standards, but no law in India or the EU requires the certificate as of this review.
Does ISO 42001 make us compliant with the EU AI Act?
It helps you organise the work, but a certificate is not a presumption of conformity under the Act. The harmonised standards the Act relies on are being written by CEN and CENELEC; check their status before relying on either.
Can we do it together with ISO 27001?
Yes, and most companies should. The clause structure is the same, so the policy, risk method, internal audit and management review can be shared, and a certification body can run one integrated audit.
How is it different from NIST AI RMF?
NIST AI RMF is a risk framework you follow; ISO 42001 is a management system you can be certified against. Many companies map one to the other; Infofacility's crosswalk will show the mapping clause by clause.
Change log
4 Nov 2026 First version.
This page explains the law in plain English. It is not legal advice.
Weekly · Watching 6 regulators