ISO/IEC 42001

ISO/IEC 42001:2023, titled Information technology — Artificial intelligence — Management system, is the first international standard that defines requirements for an artificial intelligence management system (AIMS). Published in December 2023, it provides organisations with a framework for governing how AI systems are developed, provided and used, and it is certifiable by independent bodies.^[1][2]

Background

As AI adoption spread through the 2010s and 2020s, organisations faced a gap: existing management standards covered information security (ISO/IEC 27001) and quality, but not the specific risks of AI systems — including bias, opacity, safety, data provenance and rapid technological change. ISO/IEC JTC 1/SC 42, the joint ISO and IEC committee for AI standards, developed ISO/IEC 42001 to fill that gap, and the standard was published on 18 December 2023.^[1][2]

Unlike technology specifications, ISO/IEC 42001 is a management-system standard: it defines processes, responsibilities and controls rather than mandating particular algorithms or tools, so it can apply to developers, providers and users of AI, including organisations that only procure third-party AI systems.^[2]

Key Concepts

ISO/IEC 42001 follows the harmonised structure shared by other ISO management-system standards, with requirements on organisational context, leadership, planning, support, operation, performance evaluation and improvement. That structure allows organisations to integrate it with existing systems such as ISO/IEC 27001.^[2]

Its AI-specific requirements are set out in Annex A, a set of 38 reference controls organised under nine objectives: policies related to AI; internal organisation; resources for AI systems; impact assessment; the AI system life cycle; data governance; information for interested parties; responsible use; and third-party relationships. Organisations select the controls that apply to them through a Statement of Applicability and justify any exclusions, and Annex B provides implementation guidance for each control.^[7]

Certification is voluntary and is performed by independent certification bodies, often accredited by national accreditation bodies; ISO itself does not certify organisations. ISO notes that the standard complements rather than replaces laws and regulations, helping organisations meet obligations on documentation, risk management, monitoring and transparency more effectively.^[2]

Applications and Impact

The standard is used across sectors — technology, finance, healthcare, manufacturing and the public sector — and by organisations of all sizes. Cloud providers have pursued certification for their AI services: Microsoft obtained ISO/IEC 42001 certification covering a range of AI services, and AWS documents its certification for AI services on AWS.^[3][4]

Certification is increasingly treated as a way for suppliers to demonstrate AI governance to regulators, enterprise customers and auditors, and a supporting industry of training, auditing and practitioner certification has grown around the standard since 2024. ISO notes that the standard sits within a growing family of AI standards covering concepts, terminology, risk management and governance, developed by the same joint committee.^[2]

>See Also

• Malaysia AI Governance Framework
• EU AI Act
• Responsible AI
• PDPA and AI Compliance
• BNM AI Guidelines

References