Frequently asked questions about ISO/IEC 42001

Each FAQ refers you to the page section with the full rule.

Disclaimer

This page gives general information. It is not legal advice.

What is ISO/IEC 42001?

ISO/IEC 42001:2023 gives organizations requirements and guidance for an AI management system (AIMS). This voluntary standard of ISO and IEC applies to large and small organizations of all types that supply or use products or services with AI systems (Clause 1). Clauses 4 to 10 contain requirements, Annexes A and B are normative, and certification by a third party is optional. See Structure of the standard.

Is ISO 42001 the same as ISO/IEC 42001?

Yes. ISO 42001 is a short name for ISO/IEC 42001:2023, which ISO and IEC released together in December 2023. See the standard and its first edition.

Is ISO 42001 mandatory?

No. ISO/IEC 42001 is a voluntary standard. The EU AI Act and the NIS2 Directive do not make its use necessary. An organization that wants to show conformity or get certification must conform to each requirement of Clauses 4 to 10, with the statement of applicability (6.1.3 f)). Conformity with the standard is not conformity with the EU AI Act and gives no presumption of conformity in Article 40(1). See ISO/IEC 42001, the EU AI Act, and NIS2.

Is ISO 42001 Annex A mandatory?

Annex A of ISO/IEC 42001 is normative, but the organization does not have to use all controls. Its AI risk treatment must determine necessary controls, compare them with Annex A, and consider the "relevant" Annex A controls (6.1.3 b) and c)). The statement of applicability must justify each inclusion and exclusion (6.1.3 f)), and the organization can design other controls (A.1, 3.26 Note 1). It must consider normative Annex B guidance for the controls of b) and c), but can change the guidance or use a different method (6.1.3 e), B.1). See Annex A and Annex B.

Is a statement of applicability required for ISO 42001?

Yes. ISO/IEC 42001 requires the organization to make a statement of applicability in its AI risk treatment process (6.1.3 f)). It must document necessary controls and justify each inclusion and exclusion, and show all identified risks with their controls (3.26 Note 2).

The other rules are:

• Compare necessary controls with Annex A and consider “relevant” Annex A controls. Identify necessary controls from other sources (6.1.3 b) to d)).
• An exclusion can follow the risk assessment or external requirements that do not make the control necessary or give an exception (6.1.3 f)).
• An exclusion of a control objective can apply to all or some AI systems (6.1.3 NOTE 3).
• Annex B guidance requires no documentation or justification in the statement of applicability (B.1).
• Implementation status is an ISO/IEC 27001 item, not an ISO/IEC 42001 item.

See The statement of applicability. The related AI risk treatment process requires the organization to consider Annex B guidance. The organization must get designated management approval for the AI risk treatment plan and to accept residual AI risks (6.1.3).

How do you get ISO 42001 certified?

A certification body with accreditation for ISO/IEC 42001 audits the organization's AIMS and can then certify it. Certification is optional, and ISO/IEC 42001 sets no certification procedure. ISO/IEC 42006:2025 gives requirements for certification bodies that audit and certify an AIMS. See Certification bodies and accreditation.

In management system certification in general, the three-year cycle has an initial audit in Stage 1 and Stage 2, surveillance audits each year, and recertification (IAF MD 5:2023). Speak to the certification body for its audit plan. See The certification audit cycle.

How is ISO 42001 different from ISO 27001?

ISO/IEC 42001 gives requirements for an AI management system, while ISO/IEC 27001 gives requirements for an information security management system. They have the same structure of Clauses 4 to 10, normative Annex A, and a required statement of applicability. Only the AI system impact assessment clauses, 6.1.4 and 8.4, have no ISO/IEC 27001 equivalent.

ISO/IEC 42001 does not require ISO/IEC 27001. A process used for the two standards must also conform to ISO/IEC 42001, for example internal audits (9.2.1). See Use with ISO/IEC 27001 and ISO/IEC 27701. The ISO/IEC 27001 statement of applicability also gives implementation status. ISO/IEC 42001 does not require this item: see The statement of applicability.

Does ISO 42001 certification mean EU AI Act compliance?

No. An ISO/IEC 42001 certificate is not conformity with the EU AI Act and gives no presumption of conformity in Article 40(1). That Article applies to high-risk AI systems or general-purpose AI models “which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union”. The presumption of conformity applies only to the requirements or obligations that are in those standards.

Articles 9 and 17 apply to providers of high-risk AI systems, and Article 27 applies to some deployers. AIMS records can be inputs to some obligations, but ISO/IEC 42001 role names do not determine EU AI Act roles. See ISO/IEC 42001, the EU AI Act, and NIS2 for the duties, their scope, and their dates.

How does Modulos support ISO 42001?

Modulos gives ISO/IEC 42001 as two Frameworks with the name ISO 42001: OFF-10 for the Organization and MFF-10 for each AI system in the AIMS scope. Add OFF-10 to the organization AI System, or contact Modulos support if your organization has none. OFF-10 holds Clauses 4.1 to 10.2 without 8.2 to 8.4 and some Annex A controls. MFF-10 holds 8.2 to 8.4 and all other Annex A controls: see The Requirements for each provision and the statement of applicability on ORF-171.

The Frameworks exclude the selection of a certification body and certification audits: see Items with no Control in the Frameworks.

What does the ISO 42001 scope of the AIMS need to cover?

The organization must determine its AIMS boundaries and applicability, and consider external and internal issues and the requirements of interested parties (ISO/IEC 42001, 4.1 to 4.3). The scope must be available as documented information and determines which work the standard applies to. Roles can change if, and how much of a requirement or control applies (4.1). Clause 4.3 does not name the items that the scope must contain: functions, AI systems, and life cycle parts are decisions of the organization. See The scope of the AIMS.

What are the AI roles in ISO 42001?

ISO/IEC 42001 gives six example roles: AI providers, AI producers, AI customers, AI partners, AI subjects, and relevant authorities (4.1 NOTE 1). Other roles are possible, and an organization can have more than one. The organization must determine its roles for AI systems that it makes, supplies, or uses, because roles can change which requirements and controls apply.

EU AI Act roles come from that Act: ISO/IEC 42001 includes AI deployers as examples of AI producers, while Article 3(4) gives the definition of a deployer for the Act. See AI roles.

How often are ISO 42001 surveillance and recertification audits?

ISO/IEC 42001 sets no certification cycle. In management system certification in general, the cycle is three years, with surveillance audits each year and a recertification audit (IAF MD 5:2023). See The certification audit cycle.

What is the difference between AI risk assessment (6.1.2) and AI impact assessment (6.1.4)?

For ISO/IEC 42001, the organization's AI risk assessment identifies risks that can help or prevent its AI objectives (6.1.2). It analyzes possible effects on the organization, individuals, and societies. The AI system impact assessment assesses possible effects of AI systems on individuals, groups of individuals, and societies (6.1.4). The organization must consider impact assessment results in the risk assessment, and can use an impact assessment to assess those effects (6.1.2 NOTE). See Clause 6.

The other differences are:

• Risk assessments occur at planned intervals and when significant changes are “proposed” or occur (8.2).
• Impact assessments occur at planned intervals and when significant changes are “proposed” (8.4). See assessment times.
• EU AI Act Article 27 is a different duty for some deployers before deployment: see ISO/IEC 42001 and the Act.

How often must ISO 42001 risk assessments, internal audits and management reviews be done?

ISO/IEC 42001 requires planned intervals that the organization sets for internal audits (9.2.1), management reviews (9.3.1), AI risk assessments (8.2), and AI system impact assessments (8.4). Risk assessments are also required when a significant change is “proposed” or occurs. Impact assessments are also required when a significant change is “proposed”. If the organization selects A.2.4, it must review the AI policy at planned intervals and when necessary.

ISO/IEC 42001 sets no procedure for certification audits. See When to do the assessments, audits, and reviews again and The certification audit cycle.

What documented information does ISO 42001 require?

ISO/IEC 42001 requires the documentation that its clauses name and the documentation that the organization determines is necessary for AIMS effectiveness (7.5.1). The quantity can be different for each organization. The documented information table gives these items:

• Scope and AIMS (4.3, 4.4), policy (5.2), and objectives (6.2).
• Actions on AI risks and AI opportunities, AI risk assessment and AI risk treatment processes, necessary controls, and the statement of applicability (6.1.1 to 6.1.3).
• Impact assessment results (6.1.4, 8.4), competence (7.2), and process information as much as necessary (8.1).
• AI risk assessment and AI risk treatment results (8.2, 8.3), monitoring results (9.1), audit program and results (9.2.2), and management review results (9.3.3).
• Nonconformities, corrective actions, and results (10.2).

All identified risks also require documentation (3.26 Note 2). Some Annex A controls require documentation if selected, for example A.5.3 and A.6.2.7. See Documented information in Clauses 4 to 10.

Does ISO 42001 require climate change to be considered?

Yes. ISO/IEC 42001:2023 requires the organization to determine if climate change is a “relevant” issue (4.1). This requirement is in the first edition, not a subsequent change. The NOTE to 4.2 tells organizations that “relevant” interested parties can have requirements about climate change. See Clause 4.

Are ISO/IEC 42001 Annexes A–D normative or informative?

ISO/IEC 42001 Annexes A and B are normative, while C and D are informative. The organization does not have to use all Annex A controls, and can design others (A.1). It must determine necessary controls, compare them with Annex A, consider “relevant” Annex A controls, and justify each inclusion and exclusion (6.1.3 b), c), f)). It must consider Annex B guidance but can change it or use a different method (6.1.3 e), B.1). Annexes C and D give information that the organization can use. See Normative and informative annexes.

Why is ISO 42001 Annex A informative when ISO 27001 Annex A is normative?

ISO/IEC 42001 Annex A is normative, as ISO/IEC 27001 Annex A is. The organization determines necessary controls through risk treatment, compares them with Annex A, and makes a statement of applicability with justifications. ISO/IEC 42001 lets the organization exclude controls and use other controls (A.1).

ISO/IEC 42001 requires justification for each control inclusion and exclusion (6.1.3 f)). ISO/IEC 27001 requires justification for each necessary control and each Annex A control that the organization excludes (6.1.3 d)). Only ISO/IEC 27001 requires implementation status in the statement of applicability. Only ISO/IEC 42001 requires all identified risks and their controls in it (3.26 Note 2). See The statement of applicability and Normative and informative annexes.

What does the ISO 42001 Annex A cover?

ISO/IEC 42001 Annex A has 38 controls in nine areas (A.2 to A.10). These areas are policy, organization, resources, impacts, life cycle, data, information for interested parties, use, and relations with third parties and customers. Each area has one control objective, but A.6 has two. A.10.4 Customers is in the 2023 first edition.

The organization applies controls selected through AI risk treatment and can design others (6.1.3, A.1). Annex B gives guidance for each control. See Annex A.

Is ISO 42001 Annex B mandatory?

ISO/IEC 42001 Annex B is normative, but the organization does not have to use its guidance without change. It must consider the guidance for controls determined in 6.1.3 b) and c) (6.1.3 e)). Guidance is not always applicable or sufficient: the organization can extend or change it, or use a different method (B.1). The statement of applicability requires no documentation or justification to include or exclude guidance (B.1). Table A.1 uses "shall" for controls, while Annex B uses "should". See Annex B.

How does Annex C support the risk and impact assessments?

ISO/IEC 42001 Annex C gives possible objectives and risk sources that the organization can consider in risk management (C.1 to C.3). It is informative: the sets of objectives and risk sources are not complete, and the organization determines which items apply. The NOTE to 6.2 refers to Annex C for AI objectives. Clauses 6.1.2 and 6.1.4 do not refer to Annex C, and Annex C does not refer to 6.1.4 or A.5. Impacts on individuals, groups of individuals, and societies come from 6.1.4, A.5.4, and A.5.5. See Annex C for its objectives and seven risk sources.

How should I structure AI Systems for an ISO 42001 AIMS?

For ISO/IEC 42001, Modulos recommends OFF-10 on the organization AI System and MFF-10 on one AI System for each AI system in the AIMS scope. Determine the organization's roles (4.1) and scope (4.3) first. The standard sets one AIMS: the two levels are the Modulos structure. With only OFF-10, Clauses 8.2 to 8.4 and most Annex A controls have no AI System Requirement. Those clauses give requirements for AI risk assessment, AI risk treatment, and AI system impact assessment.

Contact Modulos support if your organization has no organization AI System. See Recommended AI System structure.

Where does the Statement of Applicability live in Modulos?

The ISO/IEC 42001 statement of applicability is in ORF-171 (AI risk treatment, 6.1.3) of OFF-10. It must give necessary controls, justify each inclusion and exclusion, and show all identified risks with their controls (6.1.3 f), 3.26 Note 2). Annex A controls are in other Requirements: ORF-173 and ORF-191 to ORF-195 in OFF-10, and MRF-215 to MRF-220 in MFF-10. See The Requirements and The statement of applicability.

How does Modulos handle the AI impact assessment (Clause 6.1.4)?

Modulos has the ISO/IEC 42001 impact assessment process (6.1.4) in ORF-172 of OFF-10, and each assessment (8.4) in MRF-215 of MFF-10. Annex A.5.2 is in ORF-194, and A.5.3 to A.5.5 are in MRF-215: see The Requirements.

These conditions apply:

• Annex A controls apply if selected through AI risk treatment. Each exclusion requires justification in the statement of applicability (6.1.3 f)). Clauses 6.1.4 and 8.4 apply also without those controls.
• The process assesses effects on individuals, groups, and societies. The organization must document the results and consider them in its AI risk assessment (6.1.4): see Clause 6.
• Assessments occur at planned intervals and when significant changes are “proposed”, with results retained (8.4): see Clause 8.
• EU AI Act Article 27 is a different duty for some high-risk AI deployers: see ISO/IEC 42001 and the Act.

Where is Annex A.6 in Modulos?

For ISO/IEC 42001, Modulos has A.6.1.2 and A.6.1.3 in ORF-195 at the Organization level (OFF-10). A.6.2.2 to A.6.2.8 are in MRF-216 at the AI System level (MFF-10), with A.4.3 to A.4.6. Each control applies where AI risk treatment selects it as necessary (6.1.3). See The Requirements.

How does Modulos help with internal audit and management review?

For ISO/IEC 42001, Modulos has internal audit in ORF-184 and ORF-185, and management review in ORF-186 to ORF-188, all in OFF-10. The organization must do internal audits at planned intervals (9.2.1), and top management must review the AIMS at planned intervals (9.3.1). ISO/IEC 42001 sets no period. See The Requirements and assessment, audit, and review times.