Kort gezegd: ISO 42001 is the international standard for an AI management system: the policies, roles and checks an organisation uses to run AI responsibly. You can get certified against it. Its core demand is that you find your AI risks, deal with them, and prove over time that your controls work. Regular testing is how you get that proof.
More and more customers ask how you keep your AI under control. A policy document is a start, but it doesn’t show that your AI behaves today. ISO 42001 gives a shared answer to that question. It is also where many companies get stuck. Writing the policy is the easy part. Showing evidence that it works, month after month, is the hard part.
What is ISO 42001?
ISO/IEC 42001 is an international standard, published in December 2023, that sets out how to build and run an AI management system. A management system is the set of rules, roles and routines an organisation uses to manage something well. You may know ISO 27001 for information security or ISO 9001 for quality. ISO 42001 does the same for AI and uses the same basic layout, so it fits next to those standards. It applies to any organisation that builds, sells or uses AI, of any size. It does not tell you which AI to use or how to build it. It asks you to know your AI systems, judge their risks and their impact on people, set controls, and check that those controls work. An accredited body can audit you and certify you against it.
What does ISO 42001 ask you to do?
ISO 42001 asks you to manage AI in a loop: plan, do, check and improve. First you set the scope, your AI policy and who is responsible. Then you assess the risks of each AI system and its impact on people and society. You pick controls from a reference list in the standard’s annex, or explain why one does not apply. Next you put those controls to work and keep records. Then you monitor and measure whether they work, run internal audits and review the results with management. Finally you fix what falls short and start again. The loop matters more than any single step. An auditor looks for proof that it really runs, not just a plan on paper.
Here is the order of the work in practice:
- List your AI systems and who owns each one.
- Write an AI policy and set clear goals.
- Assess the risks and the impact on people, per system.
- Choose controls and record why.
- Monitor, measure and audit on a schedule.
- Fix gaps and review with management.
Where does testing fit in ISO 42001?
Testing fits in the check step, where you must show that your AI and your controls do what you claim. The standard asks you to monitor and measure performance, and to keep records as evidence. For AI, that means more than checking a server is up. You need to know if the model gives accurate answers, treats people fairly, protects private data and resists misuse. And you need to know it over time, because even well-designed AI systems drift and misbehave over time. A test that runs once a year before the audit shows how your AI behaved on one day. Tests on a fixed schedule show a trend. They also give the auditor something they can check: which tests ran, when, what the model answered, and what you changed.
This is where many first audits get hard. The policy is fine, the risk register is fine, but the monitoring records are thin. Plan the evidence from day one.
Do you need ISO 42001 certification?
You need ISO 42001 certification if your customers, partners or sector ask for it, or if AI is central to what you sell. When a buyer asks how you govern AI, a certificate is a clear answer. It is voluntary, though. It does not by itself make you compliant with the EU AI Act. Much of what it asks does overlap with that law, such as risk management, monitoring and records. Providers of high-risk AI must even run a quality management system under Article 17 of the AI Act. The NIST AI Risk Management Framework covers similar ground and is free, but it is a guide, not a certifiable standard.
There is a trade-off. Certification takes time, money and an audit every year. If you use one internal chatbot with low stakes, you may not need it yet. In that case, use ISO 42001 as a checklist. Know your AI, assess the risks, test on a schedule and keep the records. You can go for the certificate later.
What this means for your team
Start with the list of AI systems and an owner for each, including tools you bought. You’re responsible for your AI, even when you didn’t build it. Then decide how you will measure each system and how often. That decision shapes your evidence for years.
For organisations that need more than a standard test set, VeritasAI offers tailored assurance. Our experts customise your test framework to your specific risks, data sources and model architecture. We assess connected systems, governance setup and compliance posture, and deliver a complete AI assurance report built around your environment. The Enterprise plan adds custom test sets and governance frameworks aligned with your architecture and risk profile, with daily scheduled runs. That gives you the monitoring records an ISO 42001 audit asks for. It does not guarantee you will pass, and it does not replace your own management system. It does make the check step something you can show.
Turn your AI policy into evidence an auditor can check.
Frequently asked questions
Is ISO 42001 mandatory?
No. ISO 42001 is a voluntary standard. Some customers or sectors may require it in contracts, which makes it a business need rather than a legal one.
What is the difference between ISO 42001 and ISO 27001?
ISO 27001 covers information security. ISO 42001 covers the responsible use of AI, including risks such as bias, transparency and impact on people. They share the same layout, so you can run them side by side.
Does ISO 42001 make you compliant with the EU AI Act?
Not on its own. The two overlap on risk management, monitoring and records, so ISO 42001 helps. You still need to check the specific duties for your AI Act risk category.
How long does ISO 42001 certification take?
It depends on your size, how many AI systems you run and what you already have in place. A company that already runs ISO 27001 can reuse much of its setup, which usually speeds things up.