Specialty — Artificial intelligence
ISO/IEC 42001 — AI Management
Artificial Intelligence Management System (AIMS) — govern the development and use of AI in a responsible, transparent and compliant manner.
ISO/IEC 42001:2023, published in December 2023, is the first international standard dedicated to Artificial Intelligence Management Systems (AIMS). It provides a rigorous framework to develop, deploy and oversee AI systems responsibly, ethically and in compliance with emerging regulatory requirements.
Why pursue ISO 42001 certification?
- Regulatory compliance — Alignment with the EU AI Act, Canada’s AIDA (Bill C-27), the NIST AI Risk Management Framework, and upcoming sector-specific requirements.
- Stakeholder trust — Formal proof that your AI systems are governed, monitored and explainable. A differentiating factor in B2B and public procurement.
- AI risk management — Structured identification of biases, drift, hallucinations, data leakage, and impact on fundamental rights.
- Commercial advantage — First-of-its-kind standard: early positioning sets your organisation apart in a transforming market.
- Complementary to ISO 27001 & 27701 — 42001 integrates naturally with information security (27001) and privacy management (27701) for complete digital governance.
What the standard requires
- AI policy — Defining principles, values and usage limits of AI in the organisation
- Governance and roles — AI steering committee, AI lead, decision-making bodies, escalation paths
- AI impact assessment — Systematic evaluation of consequences (technical, ethical, social, environmental) before deployment
- Risk management — Identification of bias, drift, security, robustness, fairness, transparency
- AI system lifecycle — Design, development, training, deployment, monitoring, decommissioning
- Documentation and traceability — Training data, models, decisions, updates
- Human oversight — Human control procedures, AI incident management, right of appeal
- Continuous improvement — Audits, KPIs, lessons learned, adjustment of models and policies
Our 6-step approach
- AI diagnosis and mapping — Inventory of your current and planned AI systems, use cases, risk levels, data used, external AI providers.
- AI policy and governance — Definition of ethical principles, AIMS scope, AI committee, roles and responsibilities.
- AI impact and risk analysis — Methodology aligned with EU AI Act + ISO 23894. Statement of Applicability.
- Controls implementation — Procedures for the AI lifecycle, security, human oversight, data management, traceability.
- Internal audit and management review — Effectiveness verification, training of AI and business teams.
- Certification audit support with an accredited body (BSI, PECB, MSECB).
Who is it for?
- Developers of AI products/services (SaaS, platforms, proprietary models)
- Banks, insurers and FinTechs integrating AI in decision-making (scoring, fraud, KYC)
- Healthcare organisations using AI for diagnosis, imaging or research
- Governments and public bodies deploying AI for citizen services
- Industrials integrating AI in predictive maintenance, quality control, robotics
- Any organisation subject to the EU AI Act (high-risk systems, GPAI, foundation models)
Timeline and cost
Typical duration: 6 to 12 months for initial certification, depending on AI governance maturity and the number of in-scope systems.
Pricing: fixed-price. Tailored quote within 48 hours after initial diagnosis.