Docs

Appearance

ISO/IEC 42001:2023 — scope and certification ​

ISO/IEC 42001:2023 gives requirements for an AI management system (AIMS). The standard applies to all organizations, large or small and of all types, that supply or use products or services that use AI systems (the ISO/IEC 42001 page). This page gives the AI roles (Clause 4.1), the scope (Clause 4.3), the statement of applicability (Clause 6.1.3 f)), and certification by a third party. Modulos has two Frameworks for ISO/IEC 42001, each with the name ISO 42001: OFF-10 at the Organization level, and MFF-10 at the AI System level for each AI System in the scope (Operationalizing ISO/IEC 42001 in Modulos).

Primary sources

ISO/IEC 42001:2023 (first edition, 2023-12), 3.26, 4.1, 4.3, 6.1.3, A.1, and B.1, from the ISO catalog page. For certification: ISO/IEC 42006:2025 and IAF MD 5:2023. The section Sources of this page gives all the sources.

AI roles (Clause 4.1) ​

ISO/IEC 42001 Clause 4.1 gives the organization two requirements about its AI systems:

  • For each AI system that the organization makes, supplies, or uses, the organization must consider the intended purpose of that AI system.
  • The organization must determine its roles for these AI systems.

NOTE 1 to Clause 4.1 gives examples of roles. Other roles are possible, and one organization can have one or more of these roles:

  • AI providers — for example AI platform providers.
  • AI producers — for example AI developers and AI deployers.
  • AI customers — for example AI users.
  • AI partners — for example data providers and AI system integrators.
  • AI subjects — for example data subjects.
  • Relevant authorities — for example policymakers and regulators.

NOTE 1 also tells the organization that its roles can determine if a requirement or control applies, and how much of it applies. ISO/IEC 22989 gives more information about the roles. NOTE 3 to Clause 4.1 gives two more items that can have an effect on the role decision:

  • obligations for the types of data that the organization processes, for example as PII controller or PII processor
  • legal requirements for AI systems.

Some role names in ISO/IEC 42001 are almost the same as role names in the EU AI Act. But the role names of each instrument come from that instrument. Article 3(3) of Regulation (EU) 2024/1689 (the EU AI Act) gives the definition of a "provider", and Article 3(4) gives the definition of a "deployer". ISO/IEC 42001 gives AI deployers as one example of AI producers.

The role of an organization in the EU AI Act comes from the Act, not from the role decision of Clause 4.1. For more about the two instruments, see ISO/IEC 42001, the EU AI Act, and NIS2.

In Modulos, each Requirement of OFF-10 and MFF-10 has tags for the Clause 4.1 roles to which it applies (AI roles in the Requirements).

The scope of the AIMS (Clause 4.3) ​

ISO/IEC 42001 Clause 4.3 tells the organization that it must determine the boundaries and applicability of its AIMS. These boundaries and this applicability set the scope of the AIMS. When the organization determines the scope, it must consider these two items:

  • the external and internal issues of Clause 4.1
  • the requirements of interested parties of Clause 4.2.

For the requirements of Clauses 4.1 and 4.2, see Clause 4 (Context of the organization).

Clause 4.3 also gives these two requirements:

  • The scope must be available as documented information.
  • The scope determines the work of the organization to which the requirements of ISO/IEC 42001 apply.

Clause 4.3 does not give the items that the scope must contain. The scope can name functions of the organization, AI systems, and parts of the AI system life cycle. This is a decision of the organization. Legal requirements and contractual obligations are not items of Clause 4.3. NOTE 2 to Clause 4.1 gives them as examples of the issues that the organization must consider.

ISO/IEC 42001 has one AIMS for the organization, in the scope that the organization determines. The standard does not divide the AIMS into an organization level and an AI system level. NOTE 2 to Clause 6.1.1 tells the organization that the scope of the AIMS can hold more than one AI system. For such a scope, the NOTE tells the organization that it determines opportunities and uses for each AI system or for each group of AI systems. The Organization level and the AI System level in Modulos are a Modulos set-up (Recommended AI System structure).

Clause 4.3 does not give a time to examine the scope again. When the organization determines that changes to the AIMS are necessary, it must make the changes in a planned manner (Clause 6.3). The results of the management review must include decisions about opportunities for continual improvement. They must also include decisions about if changes to the AIMS are necessary (Clause 9.3.3). See Clause 6 (Planning) and Clause 9 (Performance evaluation).

The statement of applicability ​

ISO/IEC 42001 Clause 6.1.3 f) tells the organization that it must make a statement of applicability. The statement of applicability is an output of the AI risk treatment process of Clause 6.1.3. To conform to ISO/IEC 42001, an organization must have a statement of applicability. For all of the AI risk treatment process of Clause 6.1.3, see Clause 6 (Planning).

Clause 3.26 gives this definition: the statement of applicability is the documentation of all necessary controls and of the justification to include or exclude controls. The statement of applicability contains these items:

  • The necessary controls that the organization determines in Clause 6.1.3 b), c), and d). These controls can be Annex A controls or controls from other sources.
  • A justification for each control that the organization includes.
  • A justification for each control that the organization excludes. A justification for exclusion can be that the risk assessment does not find the control necessary. It can also be that applicable external requirements do not make the control necessary, or give an exception from it.
  • All identified risks and the controls that the organization sets up for them. Note 2 to entry 3.26 makes this item necessary. Note 2 also tells the organization that it must document all identified risks.

Note 1 to entry 3.26 gives this information: it is possible that some Annex A controls are not necessary for the organization. Note 1 also tells the organization that it can add controls that it sets up. NOTE 3 to Clause 6.1.3 lets the organization document justifications to exclude a control objective. These justifications can be for all AI systems of the organization, or only for one or more AI systems. NOTE 3 applies to the control objectives of Annex A and to the control objectives that the organization sets up.

Annex A is normative. But A.1 tells the organization that it is not necessary to use all control objectives and controls of Table A.1. The organization can also design and implement other controls. For Annex A, see Annex A (Reference control objectives and controls). It is not necessary to document or justify the Annex B guidance in the statement of applicability (B.1). For Annex B, see Annex B (Implementation guidance for AI controls).

These items are not items of the ISO/IEC 42001 statement of applicability:

  • Implementation status — in ISO/IEC 27001:2022 Clause 6.1.3 d), the statement of applicability must show if the organization implements each necessary control. ISO/IEC 42001 Clause 6.1.3 f) does not have this item.
  • Other data for each control — for example the person or function that operates the control, or the location of the evidence. The organization can add these data, but they are not items of Clause 6.1.3 f).

ISO/IEC 27001:2022 and ISO/IEC 42001 each have a normative Annex A, and each makes a statement of applicability with justifications necessary (ISO/IEC 42001 and ISO/IEC 27001 compared).

Certification bodies and accreditation ​

ISO/IEC 42001 tells the organization that it must have an AIMS (Clause 4.4), but it does not give a certification procedure. ISO/IEC 42001 is a voluntary standard. The certification of the AIMS by a third party is a different step, and the organization can select it. An accredited certification body audits the AIMS of the organization. Then it can certify the AIMS. Before you select a certification body, make sure that its accreditation includes ISO/IEC 42001.

ISO/IEC 42006:2025 (edition 1, 2025-07) adds requirements to ISO/IEC 17021-1 for certification bodies that audit and certify an AIMS to ISO/IEC 42001. An ISO/IEC 42001 certificate is not conformity with the EU AI Act (ISO/IEC 42001, the EU AI Act, and NIS2).

The certification audit cycle ​

ISO/IEC 42001 does not give information about certification audits. In management system certification in general, the certification cycle is three years (IAF MD 5:2023). The cycle has these audits:

  • An initial certification audit in two parts, Stage 1 and Stage 2.
  • Surveillance audits each year.
  • A recertification audit.

Speak to the certification body to get its audit plan. The audit does not select the Annex A controls that apply. The organization determines them in its AI risk treatment (Clause 6.1.3) and shows the result in its statement of applicability.

ISO/IEC 42001 requires internal audits and management reviews at planned intervals that the organization sets (Clauses 9.2.1 and 9.3.1). For these intervals, see When to do the assessments, audits, and reviews again.

The Requirements in Modulos ​

In Modulos, these Requirements of the OFF-10 Framework (Organization level) are for the clauses of this page: ORF-162 for Clause 4.1, ORF-164 for Clause 4.3, and ORF-171 for Clause 6.1.3 with the statement of applicability. For all Requirements and the provisions of each Requirement, see The Requirements. No Requirement of OFF-10 or MFF-10 is for the selection of a certification body or for the certification audits (Items with no Control in the Frameworks).

Where to go next ​

ISO/IEC 42001 overview

The standard, its structure, its use with ISO/IEC 27001, and the EU AI Act

Clauses 4 to 10

The requirements of Clauses 4 to 10, with the AI risk treatment of Clause 6.1.3

Annexes A to D

Annex A controls and Annex B guidance (normative), Annexes C and D (informative)

Operationalizing in Modulos

OFF-10 and MFF-10: decisions before set-up, Requirements, and steps

Sources of this page ​

Modulos used these sources for this page:

  • ISO/IEC 42001:2023, first edition, 2023-12 (ISO catalog page). Clauses: 3.26 (Notes 1 and 2), 4.1 (NOTES 1 to 3), 4.2 to 4.4, 6.1.1 (NOTE 2), 6.1.3 (NOTE 3), 6.3, 9.2, and 9.3. Annexes: A.1 and B.1.
  • ISO/IEC 27001:2022, Clause 6.1.3 d) and Annex A.
  • Regulation (EU) 2024/1689 (EU AI Act), Article 3(3) and Article 3(4), consolidated text of 27 July 2026 (EUR-Lex).
  • ISO/IEC 42006:2025, edition 1, 2025-07 (ISO catalog page).
  • IAF MD 5:2023, Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems, Issue 4, Version 3: 0.1, 5, and 6 (IAF).

Disclaimer

This page gives general information only. It is not legal advice. It does not replace the audit of a certification body. Always compare this page with the text of ISO/IEC 42001:2023 and with the conditions of your certification body.