ISO/IEC 42001:2023 is the world's first certifiable international standard for AI Management Systems (AIMS), published in December 2023. It tells organizations — not individuals — how to structure governance around how they develop, provide, or use AI responsibly. Companies get audited and certified against it; people get certified against credentials like AIGP. They're solving related but different problems.
If you've read through more than two or three posts on this site, you've already run into ISO 42001 — it shows up in the AIGP BoK, in the "Triangle of Power" certification stack, in job postings for AI Auditor roles, and in nearly every comparison of governance frameworks. What it's never gotten here is its own explanation. That ends now.
What Problem Does ISO 42001 Actually Solve?
Before December 2023, there was no common international answer to "how should a company structure its AI governance?" Organizations were improvising — borrowing pieces from data protection programs, security frameworks, internal ethics committees, whatever was closest at hand. ISO/IEC 42001 gave the world its first purpose-built, auditable standard for this specific problem, the same way ISO 27001 did for information security two decades earlier.
That lineage matters. ISO 42001 follows ISO's High-Level Structure (HLS) — the same shape as ISO 27001, ISO 9001, and the rest of the ISO management-system family. If your organization has ever implemented any of those, ISO 42001 will feel structurally familiar: define your context, secure leadership commitment, plan (including risk treatment), provide support, operate, evaluate performance, improve. It's the Plan-Do-Check-Act cycle, applied specifically to AI.
The Structure: Clauses 4 Through 10
The actual management system requirements live in clauses 4 through 10. Here's what each one asks an organization to do:
Context of the Organization
Identify internal and external factors relevant to your AI activities, and define the scope of your AI Management System.
Leadership
Top management must demonstrate commitment, set AI policy, and assign roles and responsibilities for AI governance.
Planning
Identify and assess AI-specific risks and opportunities, and plan how to treat them — this is where formal AI risk assessments live.
Support
Resources, competence, awareness, communication, and documented information needed to run the system.
Operation
Day-to-day execution — including AI System Impact Assessments, where applicable, that map closely to the kind of DPIA work privacy professionals already know.
Performance Evaluation
Ongoing monitoring, measurement, internal audits, and management review of how the AIMS is actually performing.
Improvement
Identifying nonconformities, correcting them, and continually adapting the system as AI use and risk evolve.
Annex A: The 38 Controls That Actually Do the Work
If clauses 4–10 are the skeleton, Annex A is where the real operational substance lives. It contains 38 controls organized across nine domains, covering the full AI lifecycle — from data sourcing and model development through deployment, monitoring, and eventual retirement. A few examples of what these controls actually require:
- Policy alignment. Determining how AI policy fits with existing organizational policies, rather than operating as an isolated silo.
- Risk assessment for AI systems. Structured evaluation of risks specific to a given AI system before and during deployment.
- Data governance. Provenance, quality, and suitability of data used to train and operate AI systems.
- Third-party and supplier management. Oversight of AI components or systems sourced from outside vendors.
- Transparency and communication. Ensuring stakeholders understand what an AI system does and how it makes decisions.
Organizations don't have to implement every single control — not every control applies to every business. Instead, you document a Statement of Applicability (SoA), formally justifying which controls you've included and which you've excluded, and why. This SoA becomes one of the central artifacts an auditor reviews during certification.
Who Actually Gets Certified Here?
This is the detail that trips up the most people coming from a background in personal certifications like AIGP or CIPP: ISO 42001 certifies organizations, not individuals. You don't sit an exam and walk away "ISO 42001 certified" the way you would with AIGP. Instead, your company builds an AI Management System, and an accredited certification body audits that system against the standard.
What individuals can get certified in is auditing or implementing against this standard — credentials like the ISO/IEC 42001 Lead Auditor or Lead Implementer designations (typically administered through bodies like PECB). Those prove a person's competence to do the auditing or implementation work. They are not the same thing as the organization itself holding ISO 42001 certification.
If a job posting says "ISO 42001 experience required," it almost always means experience implementing or auditing against the standard — not a personal "certification" that doesn't formally exist in the way AIGP does. Get this distinction right on your resume and in interviews.
The Certification Process, Step by Step
For an organization actually pursuing certification, the path typically looks like this:
Build the AIMS
Implement the requirements of clauses 4–10, and select the applicable Annex A controls for your context.
Document the Statement of Applicability
Formally record which controls apply, which don't, and the reasoning behind each decision.
Engage an accredited certification body
An independent, accredited auditor — not a consultant who helped you build the system — must conduct the certification audit.
Pass the Stage 1 audit
A documentation review confirming your AIMS is designed correctly on paper before anyone checks whether it works in practice.
Pass the Stage 2 audit
An operational audit confirming the system is actually being followed, with real evidence, not just documented intentions.
For an organization with an already-mature AI governance function, this typically takes three to six months. Starting from scratch, six to twelve months is more realistic.
ISO 42001 and the EU AI Act: Related, Not Identical
ISO 42001 is a global, voluntary standard. The EU AI Act is binding law in the European Union with mandatory obligations and real penalties. They are not the same thing, and certification against ISO 42001 does not automatically mean an organization is compliant with the EU AI Act. That said, the overlap is substantial in practice: many of the structural requirements — risk assessment, documentation, monitoring, human oversight — point in the same direction. A growing number of organizations are using ISO 42001 implementation as the practical foundation for their broader EU AI Act readiness work, even though the two remain legally distinct.
ISO 42001 vs. NIST AI RMF: What's the Difference?
These two get confused constantly because they cover similar ground. The core distinction: NIST AI RMF is a voluntary framework organized around four functions — Govern, Map, Measure, Manage — with no certification attached. You can adopt it, but no external body audits you against it. ISO 42001 is a certifiable management system standard with an actual audit and certificate at the end. Many organizations use both: NIST AI RMF to shape their thinking about AI risk, ISO 42001 to formalize and certify the system that results from it.
Why This Matters If You're Studying for AIGP
ISO 42001 sits inside the AIGP Body of Knowledge as one of the major governance frameworks candidates need to recognize and apply conceptually. You won't be asked to design a Statement of Applicability on exam day, but you will be expected to know what an AI Management System is, how it relates to risk-based regulation like the EU AI Act, and how it's structurally different from a purely legal or regulatory framework. Understanding the organization-versus-individual certification distinction covered above is exactly the kind of conceptual clarity AIGP exam questions tend to probe.
ISO 42001 is the closest thing the AI governance world has to a universal operating system for how companies should structure responsible AI practice — auditable, certifiable, and increasingly expected by regulators, enterprise customers, and risk committees alike. It doesn't replace the EU AI Act, and it doesn't certify individuals the way AIGP does. But understanding what it actually requires, structurally, is foundational knowledge for anyone working in AI governance today.