ISO/IEC 42001: AI management systems

What it is

ISO/IEC 42001:2023 is the international standard that specifies requirements for an artificial intelligence management system, usually shortened to AIMS. It was published in December 2023 by ISO and IEC. Like ISO/IEC 27001 for information security, it does not tell you how to build a model. It tells an organisation how to run AI responsibly as a managed, audited process: policies, roles, risk and impact assessment, controls, monitoring and continual improvement.

How it is organised

It follows the same high-level structure as other ISO management system standards, so people who know ISO/IEC 27001 or ISO 9001 will recognise it:

• Clauses 4 to 10: context of the organisation, leadership, planning (including AI risk assessment, risk treatment and AI system impact assessment), support, operation, performance evaluation and improvement.
• Annex A: reference controls, such as AI policies, internal organisation, resources, impact assessment, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems and third-party relationships.
• Annex B: implementation guidance for those controls.

Related standards include ISO/IEC 42005 (AI system impact assessment, 2025) and ISO/IEC 42006 (requirements for the bodies that audit and certify against 42001).

Why it matters for your career

Companies selling AI products to enterprises increasingly get certified to ISO/IEC 42001, and customers ask about it in security and procurement questionnaires. That creates work for implementers, internal auditors and external auditors. Knowing its structure lets you map a company's practices to a recognised standard, which is a core governance skill.

Is it worth buying?

Not as a student. The text is paid. Learn the structure from free summaries and from ISO's own pages first, and use the NIST AI Risk Management Framework (free) to learn the ideas. Buy or borrow the standard when you are implementing or auditing it for real, or when an employer or training course provides it.

Common questions

Is it a law? No. It is voluntary, but certification is a recognised way to show customers and regulators you govern AI systematically.

Does certification mean EU AI Act compliance? No. They overlap a lot (risk management, data, documentation, oversight), but the Act has its own legal obligations. Map them separately.