ISO MeQualifications guide · UK
Menu

Artificial intelligence management · AIMS

ISO/IEC 42001:2023

The first management-system standard for artificial intelligence: requirements for organisations that develop, provide or use AI systems to manage AI risks and impacts responsibly.

Full title
Information technology — Artificial intelligence — Management system
Edition
1st edition, December 2023
Status
Current Current (first) edition.
Type
Requirements standard — organisations can be certified against it
Official page
View ISO/IEC 42001 on iso.org

1 What it covers

ISO/IEC 42001 applies the familiar management-system approach to AI. Alongside the Harmonized Structure clauses, it requires an AI risk assessment, AI risk treatment and an AI system impact assessment that considers effects on individuals, groups and society. Annex A provides reference controls covering areas such as AI policy, internal organisation, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems and third-party relationships.

2 Who uses it

Organisations building AI products, companies deploying AI in their services, and their suppliers — increasingly asked about in procurement. Training interest has grown quickly since publication; many providers now offer foundation, implementer and auditor courses.

3 Structure and key clauses

Clauses 4–10 follow the Harmonized Structure. AI-specific points courses focus on:

  • Clause 6 — AI risk assessment, AI risk treatment (with a Statement of Applicability against Annex A) and the AI system impact assessment
  • Clause 8 — carrying out the AI risk assessment, risk treatment and impact assessment in operation
  • Annex A — reference control objectives and controls
  • Annex B — implementation guidance for the Annex A controls

4 Key facts for courses and exams

  • Current edition: ISO/IEC 42001:2023 (first edition).
  • Annex A contains 38 controls grouped under 9 control objectives (A.2 to A.10), according to multiple published control lists.
  • As with ISO/IEC 27001, controls are selected through risk treatment and justified in a Statement of Applicability.

5 ISO/IEC 42001 qualifications

QualificationUK courses listed
ISO/IEC 42001 Foundation / requirements6
ISO/IEC 42001 Internal auditor3
ISO/IEC 42001 Lead auditor4
ISO/IEC 42001 Implementer / lead implementer4
ISO/IEC 42001 Auditor conversion1

6 Prepare

S Sources

Facts on this page last checked 3 October 2026.

  1. iso.org, ISO/IEC 42001:2023 page — https://www.iso.org/standard/42001
  2. Annex A control count — e.g. https://certpro.com/hub/iso-42001/controls/iso-42001-controls-list/