Appearance
ISO/IEC 42001:2023 — AI Management System
ISO/IEC 42001:2023, "Information technology — Artificial intelligence — Management system", is an International Standard of ISO and IEC for an AI management system (AIMS) in an organization. ISO/IEC JTC 1/SC 42 prepared it, and ISO and IEC released the first edition in December 2023. The ISO catalog page has this text about the standard: "ISO/IEC 42001 is the world's first AI management system standard".
ISO/IEC 42001 is a voluntary standard. Modulos gives it as two Frameworks, OFF-10 and MFF-10. The section ISO/IEC 42001 in Modulos gives more information.
Primary sources
- ISO/IEC 42001:2023, "Information technology — Artificial intelligence — Management system", first edition, 2023-12. ISO catalog page.
- EU AI Act: Regulation (EU) 2024/1689, consolidated version of 27 July 2026, on EUR-Lex.
Key facts
Publisher
ISO and IEC, joint standard of ISO/IEC JTC 1/SC 42
Edition
First edition, December 2023 (the published edition on the ISO catalog page)
Type
Voluntary management system standard
Applies to
All organizations that supply or use products or services that use AI systems (Clause 1)
Structure
Requirements in Clauses 4 to 10 (harmonized structure); Annexes A and B normative; Annexes C and D informative
Certification
Optional, by an accredited certification body; the standard sets no certification procedure
Modulos Frameworks
OFF-10 (Organization level) and MFF-10 (AI System level)
Organizations that the standard applies to
ISO/IEC 42001 applies to all organizations, large or small and of all types, that supply or use products or services that use AI systems (Clause 1). Clause 1 also gives the object and the purpose of the standard:
- The standard gives requirements and guidance to establish, implement, maintain, and continually improve an AIMS in an organization.
- The purpose of the standard is to help the organization to make, supply, or use AI systems with responsibility, while it works for its objectives.
- The purpose of the standard is also to help the organization to "meet" applicable requirements, its obligations related to interested parties, and their expectations.
ISO/IEC 42001 is a voluntary standard, and no law that this page examines (the EU AI Act and the NIS2 Directive) makes its use necessary. An organization that wants to show conformity with the standard (3.15), or that wants certification, must conform to each requirement of Clauses 4 to 10. This includes the statement of applicability of Clause 6.1.3 f). In the Introduction, conformity with the requirements can give an organization evidence of its responsibility and accountability for its role with AI systems.
The persons and groups in Clauses 4 to 10 include the organization, top management, interested parties, designated management, and internal auditors (Clauses 4 to 10). The roles that the organization determines for its AI systems in Clause 4.1 can determine if, and how much, requirements and controls apply (AI roles).
Structure of the standard
ISO/IEC 42001 has 10 clauses, 4 annexes, and a bibliography. Clauses 4 to 10 contain the requirements for the management system. In the table of contents of the standard, Annex A and Annex B are normative, and Annex C and Annex D are informative.
| Part | Title | Contents | Type | Page |
|---|---|---|---|---|
| Clauses 1 to 3 | Scope, Normative references, Terms and definitions | The scope (see the section above), one normative reference (ISO/IEC 22989:2022), and the terms and definitions of the standard. Clause 3 also uses the terms and definitions of ISO/IEC 22989. In Clause 2, the parts of ISO/IEC 22989 that the standard refers to are requirements of the standard. | Scope, normative references, terms and definitions | This page |
| Clause 4 | Context of the organization | External and internal issues, interested parties, AI roles, the AIMS scope, and the requirement to establish, implement, maintain, continually improve, and document the AIMS (4.4) | Requirements | Clause 4, scope of the AIMS |
| Clause 5 | Leadership | Top management, the AI policy, and roles and responsibilities | Requirements | Clause 5 |
| Clause 6 | Planning | AI risk criteria, AI risk assessment, AI risk treatment with the statement of applicability, AI system impact assessment, AI objectives, and planning of changes | Requirements | Clause 6, statement of applicability |
| Clause 7 | Support | Resources, competence, awareness, communication, and documented information | Requirements | Clause 7 |
| Clause 8 | Operation | Operational planning and control, and the AI risk assessment, AI risk treatment, and AI system impact assessment during operation | Requirements | Clause 8 |
| Clause 9 | Performance evaluation | Monitoring, measurement, analysis, and evaluation, internal audit, and management review | Requirements | Clause 9 |
| Clause 10 | Improvement | Continual improvement, and nonconformity and corrective action | Requirements | Clause 10 |
| Annex A | Reference control objectives and controls | Table A.1, with 38 controls in 9 areas (A.2 to A.10) | Normative | Annex A |
| Annex B | Implementation guidance for AI controls | Guidance for each control in Table A.1 | Normative | Annex B |
| Annex C | Potential AI-related organizational objectives and risk sources | Objectives (C.2) and risk sources (C.3) that the organization can consider | Informative | Annex C |
| Annex D | Use of the AI management system across domains or sectors | Use of the AIMS in different sectors, and integration with other management system standards | Informative | Annex D |
The organization selects its controls through its AI risk treatment (6.1.3), and it does not apply all Annex A controls automatically (Annex A).
Use with ISO/IEC 27001 and ISO/IEC 27701
ISO/IEC 42001 uses the harmonized structure of management system standards (Introduction). This structure gives the same clause numbers, clause titles, and text, and the same basic terms and definitions. In the Introduction, this structure helps organizations to implement ISO/IEC 42001 with other management system standards, for example on quality, safety, security, and privacy. ISO/IEC 27001:2022 (0.2) refers to the high-level structure of Annex SL of the ISO/IEC Directives.
ISO/IEC 27001:2022 gives requirements for an information security management system (ISMS). ISO/IEC 27701:2025 (edition 2) gives requirements and guidance for a privacy information management system (PIMS). The 2025 edition is a "stand-alone" management system standard. ISO/IEC 27001 and ISO/IEC 27701 have the same structure of Clauses 4 to 10 as ISO/IEC 42001. Annex A of ISO/IEC 27001 is normative, as Annex A of ISO/IEC 42001 is.
ISO/IEC 42001 puts its AI requirements in clauses that have the same number in ISO/IEC 27001. Examples are:
- The intended purpose of AI systems and the AI roles (4.1)
- The AI policy (5.2) and the AI risk criteria (6.1.1)
- The AI risk assessment and the AI risk treatment with Annex A (6.1.2, 6.1.3)
- The AI objectives (6.2)
- The AI risk assessment and the AI risk treatment during operation (8.2, 8.3).
Only 6.1.4 and 8.4 of ISO/IEC 42001, the AI system impact assessment, have no equivalent clause in ISO/IEC 27001:2022.
ISO/IEC 42001 does not make ISO/IEC 27001 or a different management system standard necessary. An organization with an ISMS or a PIMS can use one process for more than one standard. Examples are internal audit, management review, documented information, policy, objectives, and improvement. But each process that it uses for more than one standard must also conform to ISO/IEC 42001. For example, the internal audit must give information about conformity with the requirements of ISO/IEC 42001, not only with the requirements of the organization (9.2.1 a)). The standard also gives these two notes:
- An audit can be a combined audit (3.18 Note 1).
- If applicable, the organization can make its AI risk management a part of its other management systems (6.1.3 NOTE 2).
Annex D (D.2) also gives information about the use of the AIMS with ISO/IEC 27001 and ISO/IEC 27701 (Annex D). The page ISO/IEC 42001 and ISO/IEC 27001 compares the clauses and the Annex A controls of the two standards. In Modulos, ISO/IEC 27001 and ISO/IEC 27701 have their Frameworks at the Organization level: OFF-9 for ISO/IEC 27001 and OFF-12 for ISO/IEC 27701.
Certification
ISO/IEC 42001 sets no certification procedure, and certification of the AIMS by an accredited certification body is a different step, which the organization can select. The page Scope and certification gives information about certification bodies and the general audit cycle for management systems.
ISO/IEC 42001, the EU AI Act, and NIS2
The EU AI Act, Regulation (EU) 2024/1689, is EU law. ISO/IEC 42001 is a voluntary standard, and an ISO/IEC 42001 certificate is not conformity with the Act. NIS2, Directive (EU) 2022/2555, is also EU law. The last row of the table gives its Article 21(2)(d).
Article 40(1) of the Act gives a presumption of conformity to high-risk AI systems or general-purpose AI models "which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union". Article 40(1) applies to the requirements in Section 2 of Chapter III or, as applicable, to the obligations in Chapter V, Sections 2 and 3. The presumption of conformity applies "to the extent that those standards cover those requirements or obligations". Conformity with ISO/IEC 42001 gives no presumption of conformity in Article 40(1).
The table below puts ISO/IEC 42001 provisions next to related EU provisions, with the object of each EU provision and who has the obligation. The objects are different, and conformity with one provision is not conformity with the other. Articles 9, 10, 13, 16, 17, 20, 25, and 27 of the EU AI Act are in Chapter III, Sections 2 and 3. These Sections apply from 2 December 2027 or 2 August 2028, by the type of high-risk AI system (Article 113, point (c)). See the dates of the EU AI Act.
| ISO/IEC 42001 | EU provision | Object, and who has the obligation |
|---|---|---|
| 6.1.2 and 8.2, AI risk assessment | EU AI Act Article 9 | A risk management system for high-risk AI systems. Providers must make sure that their high-risk AI systems conform to Article 9 (Article 16(a)). |
| 6.1.4 and 8.4, AI system impact assessment | EU AI Act Article 27 | A fundamental rights impact assessment by some deployers of high-risk AI systems (see the text after the table). |
| 5.2, AI policy, and the AIMS | EU AI Act Article 17(1) | A quality management system of providers of high-risk AI systems. Its object is different from the AI policy of 5.2. |
| A.7, Data for AI systems | EU AI Act Article 10 | Data and data governance for high-risk AI systems. Providers must make sure that their high-risk AI systems conform to Article 10 (Article 16(a)). |
| A.8, Information for interested parties of AI systems | EU AI Act Articles 13 and 50 | Article 13: transparency and provision of information to deployers, for high-risk AI systems. Providers must make sure that their high-risk AI systems conform to Article 13 (Article 16(a)). Article 50: transparency obligations for providers and deployers of some AI systems. |
| A.10, Third-party and customer relationships | EU AI Act Article 25 | "Responsibilities along the AI value chain". Article 25(1) gives the conditions in which a "distributor, importer, deployer or other third-party" has the obligations of a provider of a high-risk AI system in Article 16. |
| 9.1, Monitoring, measurement, analysis and evaluation | EU AI Act Article 72 | Post-market monitoring by providers of high-risk AI systems. Clause 9.1 is about the performance of the AIMS, and this is a different obligation. |
| 10.2, Nonconformity and corrective action | EU AI Act Articles 20 and 73 | Article 20: corrective actions by providers of high-risk AI systems that are not in conformity with the Act. Article 73: "Reporting of serious incidents" by providers. A nonconformity of the AIMS is a different object. |
| A.10.3, Suppliers | NIS2 Directive (EU) 2022/2555, Article 21(2)(d) | In Article 21(1), Member States must make sure that "essential and important entities take appropriate and proportionate technical, operational and organisational measures". In Article 21(2)(d), these measures include "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers". |
Article 27 of the EU AI Act requires a fundamental rights impact assessment only from some deployers, before they deploy a high-risk AI system of Article 6(2), on the conditions of Article 27 (Article 27). Clause 6.1.4 of ISO/IEC 42001 applies to each organization with an AIMS. It does not give the conditions of Article 27, the items (a) to (f) of Article 27(1), or an obligation to tell an authority.
Records of an AIMS can be inputs to some obligations of the Act. Examples are the results of AI risk assessments, AI risk treatment, and AI system impact assessments (8.2 to 8.4). The role names of ISO/IEC 42001 are not the role names of the Act (AI roles). For the quality management system of Article 17 and EN 18286, see the page ISO/IEC 42001 and the EU AI Act. For the NIST AI RMF, see the page ISO/IEC 42001 and the NIST AI RMF.
Other standards for AI management systems
The standards in the table below are also from ISO/IEC JTC 1/SC 42.
| Standard | ISO “Status” | Contents |
|---|---|---|
| ISO/IEC 42005:2025, "Information technology — Artificial intelligence (AI) — AI system impact assessment" | “Published”, edition 1, 2025-05 | Guidance for organizations that do AI system impact assessments |
| ISO/IEC 42006:2025, "Information technology — Artificial intelligence — Requirements for bodies providing audit and certification of artificial intelligence management systems" | “Published”, edition 1, 2025-07 | Requirements for certification bodies that audit and certify an AIMS to ISO/IEC 42001 (Scope and certification) |
| ISO/IEC AWI 42003, "Information technology — Artificial intelligence — Guidance on the implementation of ISO/IEC 42001" | "Under development". On 11 March 2025, ISO gave it the code 20.00, "New project registered in TC/SC work programme". | Guidance to implement ISO/IEC 42001, "including competencies for AI management systems (AIMS) professionals" |
ISO/IEC 42001 in Modulos
Modulos gives ISO/IEC 42001 as two Frameworks with the name ISO 42001: OFF-10 at the Organization level and MFF-10 at the AI System level. Only MFF-10 holds Clauses 8.2 to 8.4 and most Annex A controls. Add it to the AI System of each AI system in the scope of the AIMS. The page Operationalizing ISO/IEC 42001 in Modulos gives the set-up and the steps that Modulos recommends. It also gives the AI roles in the Requirements and the Requirement for each clause and Annex A control.
Where to go next
Scope and certification
The AI roles, the scope of the AIMS, the statement of applicability, and certification.
Clauses 4–10
The requirements of Clauses 4 to 10 and the documented information that they give.
Annexes A to D
The Annex A controls, the Annex B guidance, and the informative Annexes C and D.
Operationalizing in Modulos
The decisions before you start, the Requirement for each provision, and the steps for OFF-10 and MFF-10.
ISO 42001 vs ISO 27001
The two management system standards, side by side.
ISO 42001 vs NIST AI RMF
ISO/IEC 42001 and the NIST AI Risk Management Framework, side by side.
EU AI Act high-risk AI systems
The requirements for high-risk AI systems in Section 2 of Chapter III of the EU AI Act.
Frequently asked questions about ISO/IEC 42001
See Frequently asked questions about ISO/IEC 42001 for the full FAQ.
Sources of this page
Modulos wrote this page from these sources:
- ISO/IEC 42001:2023, first edition of December 2023 (ISO catalog page). This page uses these parts:
- the Foreword, the table of contents, the Introduction, and the bibliography
- Clauses 1 to 3, with 3.15, 3.18, and 3.26
- 4.1, 4.4, 5.2, 6.1.1 to 6.1.4, and 6.2
- 8.2 to 8.4, 9.1, 9.2.1, 9.2.2, and 10.2
- A.1, Table A.1, B.1, and Annex D (D.2).
- ISO/IEC 27001:2022 (0.2, 6.1.3, Annex A, table of contents) and ISO/IEC 27701:2025 (title page, Foreword, table of contents, Introduction).
- EU AI Act, Regulation (EU) 2024/1689, consolidated version of 27 July 2026, with the changes of Regulation (EU) 2026/1744: EUR-Lex. Articles 6(2), 9, 10, 13, 16(a), 17(1), 20, 25(1), 27, 40(1), 50, 72, 73, and 113 (point (c)).
- NIS2 Directive, Directive (EU) 2022/2555, Article 21(1) and 21(2)(d): EUR-Lex.
- The ISO catalog pages for ISO/IEC 42005:2025, ISO/IEC 42006:2025, and ISO/IEC AWI 42003.
- IAF MD 5:2023, Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems (Issue 4, Version 3), clauses 0.1, 5, and 6, for the general certification cycle: IAF.
Disclaimer
This page gives general information and is not legal advice. It does not replace the audit of a certification body.