What Is ISO 42001? The AI Management System Standard

Once companies begin using AI one tool at a time, the question their boards of directors ask changes: "Which AI systems are we using, who is monitoring the risks, and how do we prove it?" ISO 42001 is the international standard that answers this question with a management system framework. This article explains what ISO 42001 is, who it is intended for, how certification works and how the standard relates to the EU AI Act.

What is ISO 42001?

Officially named ISO/IEC 42001:2023, it is the international standard that defines the requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS; YZYS in Turkish) within an organization. ISO describes it as the world's first AI management system standard.

The standard is designed for organizations that provide or use AI-based products or services. Its aim is to ensure the responsible development and use of AI systems.

The publication details on ISO's standard page are as follows:

As with ISO 27001, the standard is prepared jointly by ISO and the International Electrotechnical Commission (IEC), which is why its official abbreviation is ISO/IEC 42001.

What does "AI management system" mean?

ISO defines this concept as a set of interrelated elements within an organization that establishes policies and objectives for the responsible development, provision or use of its AI systems, together with the processes to achieve those objectives.

The critical point here is this: ISO 42001 does not look at the technical details of any single AI application. According to ISO, the standard offers a practical way to manage AI-related risks and opportunities across the entire organization. Implementation runs through the Plan-Do-Check-Act (PDCA; PUKÖ in Turkish) cycle.

The benefits ISO highlights on the standard's page:

• A framework for managing risks and opportunities
• Being able to demonstrate that AI is used responsibly
• Traceability, transparency and reliability
• Support for compliance with legal and regulatory expectations

ISO notes that the standard also addresses issues specific to AI, such as ethical considerations, transparency and the continuous learning of systems.

Who is it for?

ISO's answer is broad: organizations of any size that develop, provide or use AI-based products or services. The standard can be applied in all sectors and is relevant to public institutions and non-profit organizations as well as companies. ISO adds that the standard is designed to be applicable across different AI applications and contexts of use.

This means that the standard's scope may cover not only technology companies that develop AI models but also a manufacturing, finance or services company that uses ready-made AI tools in its business processes. The question of which tools employees use, and with which data, is one of the first topics of a management system. This topic is covered separately in the article on employees' AI use and governance.

Other AI standards related to ISO 42001

ISO has several standards in the AI field that complement one another. The ones decision-makers are most likely to encounter are:

ISO/IEC 23894 is guidance; it sets no requirements. According to ISO, it describes how organizations that develop, produce, deploy or use products, systems and services that utilize AI can manage AI-specific risks, and it aims to integrate risk management into AI-related activities. In practice, 42001 answers the "what should be done" question, while 23894 answers the "how can it be done" question on the risk side.

How does it differ from ISO 27001?

The two standards share the same management system logic, but what they try to protect is different. ISO 27001 focuses on protecting the confidentiality, integrity and availability of information. ISO 42001, on the other hand, focuses on the responsible development and use of AI systems; that is, on ethics, transparency and AI-specific risks.

Neither replaces the other. The fact that ISO offers the two standards together as a package points the same way: because AI systems often work with sensitive data, information security and AI management end up being needed side by side in the same company. A company that already has an ISO 27001 management system can carry practices such as scoping, risk assessment, internal audit and management review over to ISO 42001.

Who issues the certificate?

As with ISO 27001, the basic rule is the same here: ISO does not perform certification or issue certificates. Certification is done by independent certification bodies.

There is a new development in this area for ISO 42001. ISO/IEC 42006, published in July 2025, sets additional requirements for bodies that audit and certify AI management systems against ISO 42001. According to ISO, the standard builds on ISO/IEC 17021-1, the general standard for management system certification, and aims to ensure that auditors are competent to assess AI-specific topics.

When choosing a certification body, ISO's general recommendations apply: compare several bodies, check whether the body is accredited, and to do so consult the national accreditation body in your country or the International Accreditation Forum's IAF CertSearch database. ISO also notes that accreditation is not mandatory but shows that competence has been independently verified. When reviewing a 42001 certificate presented by a supplier, you need to look at which body issued it, with what scope, and whether it was issued under accreditation.

Relationship to the EU AI Act

A frequently asked question among Turkish companies that offer products or services to the EU is whether an ISO 42001 certificate amounts to compliance with the EU AI Act (Regulation (EU) 2024/1689).

The Act requires providers of high-risk AI systems to have a quality management system (Article 17) and a risk management system (Article 9) maintained throughout the system's lifecycle. These requirements are based on the logic of a management system documented through written policies, procedures and instructions; because ISO 42001 also builds the same kind of structure, it can provide common ground for preparation.

However, under Article 40 of the Act, the presumption of conformity is granted to systems that comply with harmonized standards whose references have been published in the Official Journal of the EU. It should therefore not be concluded that an ISO 42001 certificate, on its own, means compliance with the Act. The Act's phased implementation timeline is summarized in the article on the new timeline of the EU AI Act.

First steps to get started

The sequence below does not follow the clauses of the standard; it is a general framework for planning preparation:

1. Build an inventory. Which AI systems are being developed, purchased or used by employees in the company?
2. Determine your role. For each system, are you the developer, the provider or the user?
3. Clarify the scope. Will the management system cover the entire company, or specific products and processes?
4. Write down policies and responsibilities. Who decides, who approves and who monitors AI use?
5. Assess the risks. The approach in ISO/IEC 23894 can serve as a guide for AI-specific risks.
6. Measure and review. Set up the cycle of internal audit and management review; if certification is desired, then apply to an accredited body.

Conclusion

ISO 42001 is a framework that takes AI use out of individual projects and makes it a traceable part of company management. Even if certification is not the goal, the questions the standard asks (which systems, which risks, who is responsible) are a useful starting point for companies of any scale. Organizations considering setting up an AI management system can begin with a preliminary assessment to see where their existing processes align with this framework and where gaps remain.

#interimmanagement #forwarddeployedengineering