ISO/IEC 42001:2023 is the international standard for an artificial intelligence management system (AIMS). It does for AI governance what ISO/IEC 27001 does for information security: it sets out a management system you can operate, improve and have independently certified. For UK organisations that build AI products, embed AI in services, or simply use AI heavily, it is fast becoming the answer to a question customers keep asking in due diligence: "how do you govern your AI?"
This guide explains what the standard actually requires, how much of your ISO 27001 work you can reuse, and a realistic sequence for getting ready for a certification audit.
What ISO/IEC 42001 covers
The standard applies to any organisation that provides or uses AI systems, regardless of size or sector. It follows the same harmonised structure as other ISO management system standards, so clauses 4 to 10 will look familiar:
- Context (clause 4): your role in relation to AI (developer, provider, user, or several of these), interested parties and the scope of the AIMS.
- Leadership (clause 5): an AI policy, roles and responsibilities, and visible top management commitment.
- Planning (clause 6): AI risk assessment, AI risk treatment, a statement of applicability for the Annex A controls, and an AI system impact assessment covering effects on individuals, groups and society.
- Support and operation (clauses 7 and 8): resources, competence, awareness, documentation and the operational controls themselves.
- Performance evaluation and improvement (clauses 9 and 10): monitoring, internal audit, management review and corrective action.
Annex A lists reference controls covering areas such as AI policies, internal organisation, resources for AI systems, impact assessment, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems and third-party relationships. Annex B gives implementation guidance. As with ISO 27001, you justify which controls apply in your statement of applicability.
The parts that are genuinely new
If you already run an ISO 27001 ISMS, much of the management system machinery transfers. The work that is genuinely new tends to sit in four places.
1. The AI system impact assessment
ISO 27001 risk assessment asks what could happen to the organisation's information. ISO 42001 also asks what an AI system could do to people: unfair outcomes, loss of autonomy, safety effects, privacy intrusion. ISO/IEC 42005 gives detailed guidance on carrying out these assessments. Expect to involve people outside IT, including legal, HR, product and customer-facing teams.
2. Data for AI systems
The standard expects you to know where training, fine-tuning and grounding data comes from, its quality, how it was prepared and whether you have the right to use it. For organisations using retrieval-augmented generation over internal documents, that includes the permissions on the source content.
3. The AI life cycle
Requirements, design, verification and validation, deployment, operation and monitoring, and retirement each need defined responsibilities and records. Security testing of AI systems belongs here. An LLM and agent red team assessment produces exactly the kind of verification evidence auditors look for.
4. Third parties and suppliers
Most organisations rely on external models and platforms. The standard expects you to allocate responsibilities across that supply chain and to understand what your providers do and do not guarantee.
Reuse from ISO 27001 (and what you cannot reuse)
- Usually reusable: document control, internal audit programme, management review, corrective action, competence records, supplier management process.
- Needs extending: risk methodology (add AI-specific risk sources), asset inventory (add models, datasets, prompts and agents), incident management (add AI misbehaviour).
- New: AI policy, AI system impact assessments, AI life cycle controls, data provenance records.
A staged route to audit readiness
Stage 1: Scope and inventory
Decide which AI systems, teams and locations are in scope. Start narrower than you think. One customer-facing AI product plus the internal assistants that support it is a perfectly credible first scope. Build an inventory of AI systems including third-party tools; our article on discovering shadow AI covers how to find the ones nobody registered.
Stage 2: Policy, roles and risk method
Write an AI policy that top management will actually sign, define who owns each AI system, and extend your risk methodology. ISO/IEC 23894 provides guidance on AI risk management, and the NIST AI Risk Management Framework is a useful, freely available companion for identifying risk sources.
Stage 3: Impact assessments and risk treatment
Complete impact and risk assessments for each in-scope system, choose controls, and produce the statement of applicability. This is where most of the effort goes, and where the quality of the evidence matters most.
Stage 4: Operate and gather evidence
Run the system for long enough to produce real records: monitoring outputs, change approvals, test results, supplier reviews, training records. Auditors want to see the AIMS working, not just designed. Automated collection helps; PyraLink Prove gathers cloud configuration evidence through read-only access and maps shared controls across ISO 27001 and other frameworks, which reduces duplicate effort when the two management systems overlap.
Stage 5: Internal audit and management review
Audit the AIMS against the standard, close the findings and hold a management review before booking the external audit. Choose a certification body that is accredited to certify ISO/IEC 42001; ISO/IEC 42006 sets the requirements such bodies must meet.
How ISO 42001 relates to the EU AI Act
ISO 42001 is voluntary. The EU AI Act is law in the EU, with high-risk obligations now applying from December 2027 for most standalone systems following the 2026 Digital Omnibus amendments. Implementing an AIMS does not automatically make you compliant with the Act, but it builds much of the governance, documentation and risk management machinery the Act expects. Our EU AI Act guide for UK businesses explains when the Act applies to UK firms.
Common mistakes
- Treating it as a documentation exercise. Policies with no operating evidence will not survive a stage 2 audit.
- Scoping too widely. An AIMS that tries to cover every AI feature in every SaaS tool on day one rarely gets finished.
- Leaving security out. AI-specific threats such as prompt injection and data leakage through model outputs need real controls and real testing, not a line in the risk register.
- Running it separately from the ISMS. Two parallel management systems double the overhead. Integrate where the standards allow.
How Pyralink helps
Pyralink builds products that support the evidence side of an AI management system. PyraLink™ Prove collects read-only configuration evidence from the cloud environments your AI systems run on. Certification itself is carried out by independent, accredited certification bodies. If you are also maintaining ISO 27001, read our ISO 27001 readiness guide for how the two align.
Frequently asked questions
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is the international standard specifying requirements for an artificial intelligence management system (AIMS). Organisations can implement it and be independently certified, much like ISO/IEC 27001 for information security.
Do we need ISO 27001 before ISO 42001?
No, ISO 42001 can be implemented on its own. But organisations that already run an ISO 27001 ISMS can reuse much of the management system structure, which usually shortens the work.
Does ISO 42001 certification mean we comply with the EU AI Act?
Not automatically. ISO 42001 is voluntary and the EU AI Act sets its own legal requirements. An AIMS does build much of the governance, risk management and documentation the Act expects, so it is a strong foundation.
What is an AI system impact assessment?
It is an assessment of the potential consequences of an AI system for individuals, groups and society, such as unfair outcomes or privacy effects. ISO 42001 requires it, and ISO/IEC 42005 provides detailed guidance.
How long does ISO 42001 readiness take?
It depends on scope and maturity. Organisations with a working ISO 27001 ISMS and a small initial AI scope progress much faster than those starting from scratch. The operating period needed to generate evidence is often the longest step.
Secure AI Adoption Products
Read more about PyraLink™ Prove, or request a demo to see it on your own environment.
Request a Demo ↗Sources: ISO: ISO/IEC 42001:2023 Artificial intelligence management system; ISO: ISO/IEC 42005 AI system impact assessment; ISO: ISO/IEC 23894 Guidance on AI risk management; NIST: AI Risk Management Framework; EUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI).