ISO/IEC 42001

ISO/IEC 42001 follows the harmonized structure shared by ISO management system standards such as ISO/IEC 27001, so clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement. What makes it specific to AI is the requirement to run AI risk assessments, AI risk treatment and AI system impact assessments, together with Annex A, a set of reference controls covering AI policies, internal organization, resources, impact assessment, the AI system lifecycle, data, information for interested parties, responsible use and third-party relationships. Organizations justify which controls they apply in a statement of applicability.

The standard applies to any organization that develops, provides or uses AI, regardless of size. It can be certified by an accredited certification body, which makes it a common way to show customers and regulators that AI governance is systematic. Certification does not by itself demonstrate compliance with the EU AI Act, although the evidence it produces often supports it. Building the system is covered in RAIL; auditing it is covered in AUDAI.