ISO/IEC 42001: build the management system first, certify second

In short: ISO/IEC 42001 is the certifiable international standard for an AI management system. Certification is done by an accredited body in a two-stage audit, then yearly surveillance audits over a three-year cycle. The organizations that pass well build the system first, run it through two or three management reviews, and only then book the audit.^1,2

ISO/IEC 42001:2023, published in December 2023, is the first international, certifiable standard for an artificial intelligence management system (AIMS).¹ If your organization holds ISO/IEC 27001 for information security or ISO 9001 for quality, the shape is familiar: a documented, auditable set of policies, roles, processes and records through which leadership directs and improves an activity, here the responsible development and use of AI.

Because it is certifiable, it gives customers, auditors and regulators one recognizable reference for how an organization manages AI. That raises a practical question for every AI leader: whether to pursue certification, and when. (42001 certifies organizations, not people; for individual credentials, see how AIMP compares with AIGP, AAISM, AAIA and CPMAI.)

How the standard is built

42001 follows the common ISO high-level structure, so clauses 4 to 10 cover context of the organization, leadership, planning, support, operation, performance evaluation and improvement, and it integrates with existing certifications rather than duplicating them.¹ Annex A provides 38 reference controls under nine control objectives (A.2 to A.10): AI policies, internal organization and roles, resources for AI systems, impact assessment, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships.¹ Annex B gives implementation guidance. As in 27001, you select controls through a Statement of Applicability driven by your risk and impact assessments, and you justify what you leave out.¹

The working parts

Stripped to essentials, an AIMS needs: a scope statement; an AI policy signed by leadership; defined roles and accountabilities; an AI risk assessment and an AI system impact assessment that considers effects on individuals, groups and society, not only on the organization;¹ life-cycle controls from design to retirement; data management for AI; communication to interested parties; supplier and customer management; monitoring, internal audit and management review; and corrective action. An organization with an AI inventory, a policy stack, risk assessments, vendor due diligence and a metrics program is most of the way there whether or not it ever seeks the certificate.

A gap table for the nine control objectives

The fastest way to see how far you are from an audit is to put Annex A’s nine control objectives in a table and, against each, write what you already do and what is missing.¹ The examples below are typical of an organization with an AI inventory and a use policy but no formal management system.

Filled in honestly, the table becomes the first draft of an implementation plan, and the second column often shows that more already exists than people assume.

Whether and when to certify

Certification is performed by accredited certification bodies under ISO/IEC 17021-1 and the AI-specific requirements of ISO/IEC 42006, through a staged audit followed by surveillance audits.^2,3

The three-year cycle with yearly surveillance is the general rule for accredited management-system certification under ISO/IEC 17021-1; ISO/IEC 42006 adds requirements on the competence of the auditors and on how AI-specific evidence is audited.^2,3

The reasons to pursue it are concrete: buyers ask for it; it structures your evidence for regulators (although certification alone does not satisfy the EU AI Act); and it gives the board an independent view. The reasons to wait are equally concrete: it costs months of effort and real money, and an immature program will either fail or pass with a system nobody uses.

The order of operations

The sequence that works is practice, evidence, audit. Build the management system, run it for two or three cycles of management review, and only then engage a certification body. Organizations that start with the audit tend to write documents; organizations that start with the practice tend to find that the documents mostly describe what they already do.

How it fits with what you already run

Because 42001 shares the high-level structure of ISO/IEC 27001 and ISO 9001, an organization certified to either can extend its existing management review, internal audit, document control and corrective-action processes rather than build new ones.¹ The AI-specific additions are the impact assessment, the life-cycle and data controls, and the information given to people affected by AI systems. Frameworks such as the NIST AI Risk Management Framework map onto the same activities, so one program can serve both.

The gap table above is the right first page. Fill it in with the people who run your AI systems, not only with compliance staff, and it will tell you honestly how far you are from the audit, and whether the audit is the right next step at all. Building the management system is taught in Module 5 of the AIMP program, alongside the documents to request from model providers that feed the supplier controls.