What ISO 27001 is to information security, ISO/IEC 42001 is to artificial intelligence. Published in December 2023, the standard provides a management system framework for developing and using AI responsibly, safely and traceably. In Türkiye, the national accreditation body TÜRKAK has granted its first accreditation under the standard, so certification is now available locally too.
What does ISO/IEC 42001 cover?
The standard doesn't regulate a particular technology; it governs how AI is managed within the organisation:
- AI policy and objectives
- Roles, responsibilities and competencies
- Identifying and managing AI risks
- Assessing the impact of AI systems on people and society
- Controls across the AI system lifecycle
- Continual improvement
Because it follows the same structure (Plan–Do–Check–Act) as other management system standards such as ISO 27001 and ISO 9001, integration is relatively straightforward for organisations that already hold them.
Annex A: 9 objectives, 38 controls
Annex A of the standard contains 38 controls grouped under nine control objectives:
| Control area | Topics covered |
|---|---|
| AI policies | Policy, alignment with other policies, review |
| Internal organisation | Roles, responsibilities, reporting concerns |
| Resources | Data, tooling, systems and human resources |
| Impact assessment | Impact on individuals, groups and society |
| Lifecycle | Design, development, verification, deployment, monitoring |
| Data | Data quality, provenance and preparation |
| Information for interested parties | Transparency towards users and affected people |
| Use | Responsible use and preventing misuse |
| Third parties | Relationships with suppliers and customers |
Based on its risk assessment, the organisation records which controls apply, and why, in a statement of applicability.
How does it relate to the EU AI Act?
ISO/IEC 42001 alone is not enough for EU AI Act compliance, and certification doesn't by itself prove conformity under the Act. But it provides a strong management framework for much of what the Act requires: risk management, documentation, data governance and human oversight. That's why many organisations use 42001 as the backbone of their preparation for the Act and similar regulations.
Who needs it?
ISO/IEC 42001 isn't a legal requirement. But it offers strong value for:
- Companies offering AI products or services: proof of trustworthiness for customers, especially enterprise and public-sector buyers
- Regulated industries such as banking, insurance and healthcare: showing auditors and regulators a structured governance approach
- Companies operating in the EU market: a ready framework for AI Act compliance
- Large organisations using AI widely: bringing scattered use under a single management system
Steps to prepare for certification
- Define the scope: will the standard cover the whole organisation or specific AI systems?
- Build an AI inventory: list the systems in scope, their purpose and their data.
- Run a gap analysis: compare current processes with the standard's requirements and Annex A controls.
- Create policies and processes: AI policy, risk and impact assessment processes, role definitions.
- Operate and keep records: run the processes and collect evidence.
- Internal audit and management review: confirm the system works.
- Certification audit: carried out by an accredited certification body.
Depending on the organisation's size and AI maturity, this typically takes a few months.
Conclusion
ISO/IEC 42001 is the best-known route from managing AI project by project to systematic governance. Even without certification as a goal, its framework is a solid starting point for managing AI risk.
Through our AI Governance & Compliance service we prepare your organisation for ISO/IEC 42001 across the inventory, gap analysis, policy and process design stages. Certification audits themselves are carried out by accredited certification bodies.
Sources