The world's first international standard for AI management. ISO 42001 lets organisations that build or deploy AI prove they do so responsibly — increasingly relevant as the EU AI Act and similar regimes take effect.
ISO/IEC 42001:2023 is the first certifiable standard for an Artificial Intelligence Management System (AIMS). It applies the familiar ISO management-system structure — governance, risk assessment, lifecycle controls, continual improvement — to the specific risks of developing and using AI.
It addresses concerns that general security standards don't: model governance, data quality, transparency, human oversight, and the impact of AI decisions on individuals.
For organisations already certified to ISO 27001, the shared management-system backbone makes ISO 42001 a natural and efficient extension.
Companies developing or fine-tuning AI systems that need to demonstrate responsible governance.
Organisations preparing for the EU AI Act and similar emerging regulation.
Businesses embedding AI into operations that need assurance over its risks.
Delivered through our specialist network. As a newer standard, ISO 42001 benefits from an experienced implementer — we scope the AIMS to your actual AI footprint and build only the governance you need, not a generic template.
We define the boundary of your programme — systems, locations, and teams in scope — and agree the timeline and responsibilities up front, so there are no surprises later.
A structured assessment of your current posture against every requirement, producing a prioritised remediation plan with realistic effort estimates.
We write the policies, procedures, and controls, and work alongside your engineering team on a weekly cadence to implement them — not a stack of templates left for you to figure out.
The management system runs and generates evidence. We drive the internal audit and management review so the programme is demonstrably working before any external scrutiny.
We prepare the evidence package and sit alongside you through assessment, answering the assessor's questions directly rather than leaving you to defend the work alone.
Customers, regulators and procurement teams are starting to ask the same question about AI that they ask about security: how do you govern it? ISO 42001 gives you a certifiable answer. It suits companies that build AI products and companies that buy and deploy AI inside their own operations.
ISO 42001 and the EU AI Act. The EU AI Act is a law with specific legal obligations, while ISO 42001 is a voluntary management-system standard. Certification does not by itself make you compliant with the Act, but the governance, risk assessment, documentation and oversight it requires line up with much of what the Act expects. Whether the Act applies to you depends on your role and your AI systems, which is a point for legal counsel.
For UK and US companies. UK and US AI providers selling to EU customers, or to enterprises with their own AI governance rules, increasingly face questionnaires about AI policy, data quality, transparency and human oversight. An AI management system gives you consistent, auditable answers.
Build on ISO 27001. The two standards share a management-system structure, so companies already certified to ISO 27001 can extend rather than start again. See our ISO 27001 page.
Remote-first delivery. ISONEX works remotely with clients across the GCC, UK, EU and US. We build the AI inventory, run risk and impact assessments, write the AIMS policies and prepare you for the certification audit. This page is general information, not legal advice. Book a free advisory session.
Not strictly, but it helps. The two share the same management-system structure, so if you already hold ISO 27001 a large part of the foundation is reusable, which shortens the ISO 42001 engagement considerably.
No — they're distinct. ISO 42001 is a voluntary management-system certification; the EU AI Act is binding law. But a well-built AIMS gives you much of the governance the Act expects, which is why the two are increasingly pursued together.
No. The EU AI Act is a law with its own legal obligations, and ISO 42001 is a voluntary standard. Certification supports many of the governance practices the Act expects, but it is not a substitute for a legal assessment of your obligations.
Companies that develop AI systems and companies that deploy them in important business processes, especially when customers or regulators ask how AI risk is managed. It is increasingly requested in enterprise procurement.
Yes, they are separate standards. In practice many companies hold ISO 27001 first, because the shared management-system structure makes ISO 42001 faster to add.
Yes. ISONEX is a remote-first consultancy and we deliver ISO 42001 programmes for clients in the UK, the EU, the US and the GCC. Everything is done online, scheduled around your working hours.
Book a free advisory session and we'll map your fastest credible route to compliance.
Book a free advisory session