ISO/IEC 42 001, published in late 2023, is the first certifiable international standard dedicated to artificial intelligence management systems (AIMS). Its structure follows the now-familiar architecture of ISO governance standards (the same as that of ISO/IEC 27001 for information security or ISO 9001 for quality), with ten clauses covering context, leadership, planning, resources, operation, performance evaluation, and continuous improvement. It constitutes one of the pillars of the broader corporate AI security framework that CISOs and CIOs must now establish.
What truly sets it apart from these existing standards is not its structure, but a novel assessment criterion: it asks not only what risk an AI system poses to the company, but also what impact it has on the people it affects and on society as a whole.
SMIA Structure and Annex A Controls: The ISO 42 001 Certification Framework
Clauses 4 through 10 define the management system itself, based on the PDCA (Plan-Do-Check-Act) continuous improvement cycle, which is already familiar to ISO 27001-certified organizations. Clause 8, which addresses operational implementation, is the most specific to AI: it covers the impact assessment of systems, the management of their entire lifecycle— including the logging of decisions and outputs generated by models—, the governance of training data, and the management of model or AI platform providers.
Appendix A supplements this architecture with a reference catalog of 38 controls, organized into nine domains numbered from A.2 to A.10: bias and fairness, transparency, explainability, human oversight, lifecycle management, data governance, vendor management, incident response, among others. As with ISO 27001, these controls are not a mandatory list that must be applied in their entirety: the organization selects them following its risk analysis and AI impact assessment, then documents its choices in a statement of applicability justifying the inclusion or exclusion of each control.
Privacy and Ethics Impact Assessment of AI: The Methodological Break with ISO 42 001
This is the most innovative aspect of the standard, and the one that most companies discover during implementation. The AI system impact assessment requires a questionnaire that is unprecedented in the context of an ISO-certifiable system:
- Are the model’s results biased?
- Can the people affected understand the reasons behind these decisions?
- Can a human operator override or revise an automated decision?
- What concrete impact does this system have on the individuals it classifies, evaluates, or guides?
This requirement to formally assess societal and ethical impacts makes this aspect the most time-consuming part of the initial certification process, often taking precedence over the implementation of technical controls. It also complements—though does not replace—the DPIA requirement imposed by the GDPR whenever data processing relies on AI: both exercises are based on the principle of proportionality, but their scopes and evaluation criteria remain distinct.
ISO 42001 and ISO 27001 Integration Framework: Synergy and Complementarity of Security Audits
Both standards share the same harmonized structure, divided into ten chapters, and the same PDCA cycle, which greatly facilitates their integration for a company that is already ISO 27001-certified. Clause 8.8 of ISO 42001, which is specifically dedicated to AI security, draws directly on the security controls already defined in Annex A of ISO 27001 rather than redefining them. Many processes can be shared between the two standards—such as incident management, risk management, and the internal audit program—which makes it possible to pursue combined certifications while significantly reducing audit costs.
The difference in scope between the two standards clearly illustrates how they complement rather than duplicate one another: ISO 27001 includes 93 controls divided into four themes focused on information security in the broadest sense, while ISO 42001 includes 38 controls focused on governance and the specific impacts of AI.
For a detailed analysis of the specific differences between the two approaches in terms of scope, audits, and certification costs, we have published a comprehensive comparison of ISO 42001 vs. ISO 27001.
A company that is already ISO 27001-certified therefore has a largely reusable AI governance framework, but must address a truly new challenge regarding impact assessments and AI-specific controls that ISO 27001 does not cover.
EU AI Act Compliance: How ISO 42 001 Prepares Organizations for European Regulatory Requirements
ISO 42001 covers a large part of the governance framework required bythe EU AI Act: system mapping, risk analysis, technical documentation, human oversight, and continuous improvement. A certified management system therefore provides the best possible starting point for regulatory compliance, but it remains a starting point, not an endpoint: certification—which is purely voluntary and carries no penalties for non-compliance—does not exempt organizations from the specific legal obligations that the EU AI Act imposes on high-risk systems, particularly regarding CE marking and registration in the dedicated European database.
Frequently Asked Questions (FAQ): Everything You Need to Know About the ISO 42 001 Certification Process
What is the 42 001 standard?
As the first international standard dedicated to AI management systems (AIMS), ISO/IEC 42001 provides a structured framework (policies, processes, controls) for responsibly governing the design, deployment, and use of AI systems. It is based on 38 controls (Annex A) that the organization selects through a “Statement of Applicability.”
Is ISO 42001 certification mandatory?
No, it is a voluntary initiative, with no penalties for non-compliance, unlike the EU AI Act. Its value lies in its international recognition as evidence of structured AI governance, which is often a decisive factor in a request for proposals or a partnership.
Do you need to already be ISO 27001 certified to pursue ISO 42001 certification?
No, it is not a formal prerequisite, but a company that is already ISO 27001-certified can reuse a significant portion of its existing governance framework and approach ISO 42001 certification with a reduced workload.
How long does it take to obtain an initial ISO 42001 certification?
A typical roadmap generally spans about a dozen months, with the mapping of AI systems in production and the gap analysis against the 38 controls in Appendix A constituting the very first steps of the project.
How much does ISO 42001 certification cost?
2026 Ranges (total cost in Year 1):
- Small organization (<, 50 employees): 15,000 to 55,000 USD (~15,000–80,000 EUR).
- Medium-sized (50–500 employees): $40,000 to $150,000.
- Large (500+ employees): $90,000 to $650,000.
Recurring costs (years 2–3): annual surveillance audits ranging from 3,000 to 20,000+ USD/EUR, depending on size.
ISO 42001 Support, Consulting, and Auditing: Structuring Your Enterprise AI Governance
Our experts assist with mapping your AI systems and conducting a gap analysis prior to ISO 42001 certification, in alignment with your overall AI governance framework.
Would you like to discuss your project or assess your needs? Contact our experts.