Compliance guide · Global standard

ISO/IEC 42001, the AI standard.

ISO/IEC 42001 is the first international standard you can be certified against for running AI responsibly, and enterprise buyers are starting to ask for it. Here is what it covers, how certification works, and how to get there without drowning in paperwork.

Get an ISO 42001 readiness quote See the 38 controls
Gap check against all 38 controlsRed team results as evidenceCertified by an accredited body, not us
In plain words

ISO/IEC 42001:2023 describes an AI management system (AIMS): the policies, roles, risk and impact assessments and controls an organisation uses to build, provide or use AI responsibly. It follows the same structure as ISO 27001, lists 38 controls in Annex A, and can be certified by an accredited certification body. We get you ready and provide testing evidence; the certification body audits you and issues the certificate.

Checked against official sources on . General information, not legal advice.

Published
December 2023
Controls
38 in Annex A, 9 areas
Certificate
3 years, yearly audits
Typical readiness
8–16 weeks
Annex A at a glance

38 controls, nine areas.

Annex A is the menu of AI controls. Most of the work sits in the AI system life cycle and in assessing the impact of your AI on people.

The 38 controls of ISO/IEC 42001 Annex A, in nine areas: A.2 policies for AI (3 controls), A.3 internal organisation (2), A.4 resources for AI systems (5), A.5 assessing impacts of AI (4), A.6 AI system life cycle (9), A.7 data for AI systems (5), A.8 information for interested parties (4), A.9 use of AI systems (3) and A.10 third parties and customers (3). Highlighted: impact on individuals and groups, verification and validation, and operation and monitoring, where AI red team testing gives direct evidence. A.2Policies for AIA.2: AI policyA.2: Alignment with other policiesA.2: Review of the AI policy3A.3Internal organisationA.3: AI roles and responsibilitiesA.3: Reporting of concerns2A.4Resources for AI systemsA.4: Resource documentationA.4: Data resourcesA.4: Tooling resourcesA.4: System and computing resourcesA.4: Human resources5A.5Assessing impacts of AIA.5: Impact assessment processA.5: Documenting impact assessmentsA.5: Impact on individuals and groups (red team testing gives direct evidence)A.5: Impact on society4A.6AI system life cycleA.6: Objectives for responsible developmentA.6: Responsible design and developmentA.6: Requirements and specificationA.6: Design and development recordsA.6: Verification and validation (red team testing gives direct evidence)A.6: DeploymentA.6: Operation and monitoring (red team testing gives direct evidence)A.6: Technical documentationA.6: Event logs9A.7Data for AI systemsA.7: Data for development and enhancementA.7: Acquisition of dataA.7: Quality of dataA.7: Data provenanceA.7: Data preparation5A.8Information for interested partiesA.8: Documentation for usersA.8: External reportingA.8: Communication of incidentsA.8: Information for interested parties4A.9Use of AI systemsA.9: Processes for responsible useA.9: Objectives for responsible useA.9: Intended use3A.10Third parties and customersA.10: Allocating responsibilitiesA.10: SuppliersA.10: Customers3Controls where our AI red team testing gives direct evidence38CONTROLS IN 9 AREAS
Annex A of ISO/IEC 42001:2023, one square per control. You choose which controls apply and explain why in your Statement of Applicability. Hover a square to see the control.
If you already have ISO 27001

Half the frame is already built.

ISO 42001 uses the same management system clauses as ISO 27001. What it adds is everything specific to AI.

What ISO/IEC 27001 and ISO/IEC 42001 share. Both use the same management system clauses 4 to 10, a risk process, internal audit, management review and document control. ISO 27001 adds 93 information security controls such as access and encryption, secure operations, supplier security and incident handling. ISO 42001 adds 38 AI controls such as AI impact assessment, the AI system life cycle, data for AI and responsible use. ISO/IEC 27001Information security 93 security controlsAccess and encryptionSecure operationsSupplier securityIncident handling ISO/IEC 42001AI management 38 AI controlsAI impact assessmentAI system life cycleData for AIResponsible use SHARED Clauses 4 to 10Risk processInternal auditManagement reviewDocument control
Both standards follow ISO’s common management system structure, so an organisation with ISO 27001 already has much of the frame that ISO 42001 needs.
The road to certification

From AI inventory to certificate.

  1. Weeks 1–2

    AI inventory

    Every AI system you build, sell or use, including shadow AI, and an agreed scope for the management system.

  2. Weeks 2–5

    Risk and impact

    AI risk assessment and impact assessment on people and society, as clause 6.1 and Annex A.5 ask.

  3. Weeks 3–8

    Policy and controls

    AI policy, roles, a Statement of Applicability and the Annex A controls you choose to apply.

  4. Weeks 6–10

    Testing evidence

    Red team and verification tests that show your controls work on your real AI systems.

  5. Weeks 10–12

    Internal audit

    A dress-rehearsal audit and a management review signed off by your leaders.

  6. Certification body

    Certification audit

    Stage 1 checks your documents, Stage 2 checks the system works. Then yearly surveillance audits.

Who asks for it

You probably need it if any of these sound familiar.

  • You sell AI products or AI features to enterprises or governments
  • Customers send AI security questionnaires before they sign
  • You use AI on personal data and must show you are in control
  • You plan to sell AI into the EU and want a head start on the AI Act
  • Investors or your board want proof that AI risk is managed

We practise what we preach. Our own ISO/IEC 42001 certification is in progress, using the same playbook we use with clients.

We never issue certificates ourselves. Keeping preparation and certification separate is what makes a certificate worth having.

Questions

ISO 42001 questions, answered.

Q01What is ISO 42001, in simple terms?
A rulebook for running AI responsibly as an organisation. It asks you to set an AI policy, give people clear roles, assess the risks and the impact of your AI on people, control how AI is built, bought and used, and keep improving. An independent auditor can certify that you do it.
Q02Who can certify us?
A certification body accredited for ISO/IEC 42001 by a recognised accreditation body. A separate standard, ISO/IEC 42006, sets the rules for those certification bodies. Ask any certifier for proof of accreditation for 42001 specifically.
Q03Do we need ISO 27001 first?
No. But if you have it, readiness is faster: both standards share clauses 4 to 10, the risk process, internal audit and management review. Many organisations run the two as one combined management system.
Q04Does ISO 42001 make us compliant with the EU AI Act or the DPDP Act?
Not by itself. It gives you the management system, risk process and records that make legal compliance much easier to prove, but laws have their own specific duties. We map one set of evidence to each rule you answer to.
Q05How long does it take?
Most small and mid-sized organisations are ready for the certification audit in 8 to 16 weeks. The certificate is valid for three years, with surveillance audits every year.
Q06What does it cost?
A fixed fee after a free scoping call. It depends on how many AI systems are in scope, whether you already hold ISO 27001, how much testing evidence you need, and how many sites and teams are involved.
Q07Are you ISO 42001 certified?
Our own certification is in progress, and we will say so plainly until the certificate is issued. We also do not issue certificates: an accredited certification body does.
Sources

Checked against the official text.

This guide is general information, not legal advice. Rules and dates change, so check the official text and ask your lawyer before making decisions for your company. We update this page when the rules change.

Next hops

Related guides and services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings