AIMS
It is a management system standard
ISO 42001 specifies requirements — not suggestions — for establishing, implementing, maintaining and continually improving an AI Management System.
01 · Start with the basics
What is ISO/IEC 42001 — and why certifiability changes everything.
ISO/IEC 42001:2023 is an international management system standard for organizations that develop, provide or use AI. It gives the organization a structured way to establish, implement, maintain and continually improve an AI Management System (AIMS). Unlike voluntary guidance frameworks, ISO 42001 is certifiable — an accredited third-party body audits the system and issues a certificate. That certificate becomes internationally recognised evidence of governance substance.
✓
It is certifiable
You can be audited by an accredited third-party certification body and receive a certificate. That certificate is internationally recognised evidence of governance substance in procurement and regulatory conversations.
🌍
It travels across geographies
ISO standards dominate procurement and vendor due diligence across Europe, the UK, Asia, the Middle East and Latin America. One certificate works everywhere.
4–10Certifiable management-system clauses
9Annex A control objectives (A.2–A.10)
38/48Minimum certification readiness score
3-yrTypical certification cycle
Why the certificate matters
Enterprise clients in financial services, healthcare and government are increasingly asking for evidence of AI governance. A self-assessment does not carry the same weight as a third-party certificate. ISO 42001 is also increasingly recognised as strong governance evidence for the EU AI Act conformity assessment process. Certificate holders start the regulatory conversation from a materially stronger position — see our GRC services for related regulatory support.
02 · ISO 42001 vs ISO 27001
The same architecture. A different substance.
ISO 42001 uses Annex SL — the shared high-level structure used by ISO 9001, ISO 27001 and other modern management-system standards. If you already have ISO 27001, you already know 30–40% of what you need to build. Your document control system, internal audit programme, management review cycle, nonconformity process and understanding of the clause structure all transfer directly. What you still need to build is the AI-specific substance.
✓
What ISO 27001 already gives you
Document control system already established · Internal audit programme already running · Management review cycle already embedded · Nonconformity and corrective action process in place · Annex SL clause structure already understood by your team.
+
What you still need to build for ISO 42001
AI-specific scope statement and context analysis · AI asset register covering models, data and AI tools · AI System Impact Assessment process and evidence · AI risk assessment procedures beyond cyber risk · Annex A controls covering ethics, transparency, human oversight, data governance · ISO 42001-specific auditor engagement.
4ContextOrganizational context & scope
5LeadershipPolicy, roles & accountability
6PlanningRisk, opportunity, objectives
7SupportResources & competence
8OperationAI lifecycle control
9EvaluationMonitoring & internal audit
10ImprovementCorrective action & continual improvement
Identical clause structure across ISO 9001, ISO 27001, and ISO 42001. If you have one, you understand the model.
03 · Why organizations need it
AI can create value — and risk at the same time.
AI can improve productivity, decision-making and services. It can also introduce privacy, bias, security, transparency, safety, performance, regulatory and reputational risks. ISO 42001 gives management a repeatable framework for handling both risk and opportunity — and demonstrates to customers, partners and regulators that AI is governed on purpose.
Who owns the AI decision?
Clear accountability prevents AI governance from becoming everyone's responsibility and nobody's responsibility.
Can you trust the data?
Data quality, provenance, preparation and representativeness can directly affect AI outcomes.
Who could be affected?
AI impact assessment helps identify possible effects on individuals, groups and wider stakeholders.
What happens after launch?
AI governance must continue through testing, deployment, operation, monitoring, change and retirement.
04 · Structure & scope
10 core clauses + Annex A controls.
Certification readiness requires all clauses and Annex A to be fully evidenced. Annex A is where organizations with strong generic management systems but weak AI-specific practices tend to struggle — see Annex A below.
4ContextOrganizational context, interested parties & AIMS scope
5LeadershipLeadership, AI policy, roles & accountability
6PlanningAI risks, opportunities, objectives & impact
7SupportResources, competence, awareness & documentation
8OperationAI lifecycle control & operational planning
9EvaluationMonitoring, audit & management review
10ImprovementNonconformity, corrective action & continual improvement
05 · What auditors actually look for
Substance versus documentation. Auditors can tell the difference.
Certification readiness means scoring 3 (Compliant) on all 16 scorable clauses with no clause scoring 1. Target total score: 38+ out of a maximum 48.
4
Context of the Organization
PassSpecific scope statement naming AI systems and business processes covered. Clear exclusions justified.
FailScope too vague to be meaningful, or so narrow the certificate has no credibility.
5
Leadership
PassBoard or executive meeting minutes discussing AI risk. Named individual with authority and resources. AI policy formally approved and communicated.
FailToken sign-off on a policy document. No evidence of genuine board-level engagement.
6
Planning
PassMeasurable AI-specific objectives. Progress evidenced. Risk-based approach documented.
FailObjectives like "improve AI transparency" with no metric, no deadline, no owner.
7
Support
PassCompetence records for AI governance roles. Document control system current and accessible. Communication plan evidenced.
FailDocuments exist but have not been reviewed or updated in 12 months.
8
Operation — AI System Impact Assessment
Your most important artefact. Before deploying any AI system, you must assess its societal, ethical and operational impacts. Auditors will read this document and probe whether the risks identified are plausible and the controls proportionate. Generic entries will not pass.
9
Performance Evaluation — Internal Audit & Management Review
Internal audit must happen at planned intervals with documented findings. Management review minutes are an audit artefact. If senior leaders cannot demonstrate they discussed AI governance performance and made decisions based on it, this clause fails.
10
Improvement — Nonconformity & Corrective Action
When something goes wrong, you identify it, investigate root cause, implement corrective action and verify it worked. Auditors want to see that cycle functioning in practice — not just described in a procedure.
Build the reality first. Document what you are actually doing. Because auditors talk to people, not just documents.
06 · The most important distinction in ISO 42001
Certificate theatre versus genuine governance.
Auditors can tell the difference. The tell is simple: ask an engineer what their AI risk register entry is for the model they are currently building. If they look at you blankly, you have certificate theatre.
Certificate theatre
- Documentation produced to pass audit
- Management system exists on paper
- AI risk managed ad hoc operationally
- Engineer asked about risk register — blank look
- Certificate filed and forgotten
Genuine governance
- Documentation reflects what is actually happening
- Management system embedded in governance culture
- AI risk managed systematically every sprint
- Engineer can describe their AI risk register entry
- Certificate renewed because governance is real
The tell:Ask an engineer what their AI risk register entry is for the model they are currently building. If they look at you blankly, you have certificate theatre.
07 · Annex A — where the AI substance lives
What does Annex A cover?
Annex A provides the AI-specific reference controls. The organization determines which controls are necessary based on its context and risk treatment, then documents the decision in its Statement of Applicability. Annex A is where organizations with strong generic management systems but weak AI-specific practices tend to struggle. Budget your implementation effort accordingly.
A.2
AI Policies
AI policy, alignment with other policies, and policy review. Ethics statements, use policies, data governance policies.
A.3
Internal Organization
AI roles, responsibilities, authorities, governance committee, reporting of concerns.
A.4
AI Resources
Human, data, tooling, computing and system resources. AI asset register, data inventory.
A.5
AI Risk Assessment
Processes for assessing and documenting AI-related risks. A process that must be systematic, not ad hoc.
A.6
AI Impact Assessment
Processes for assessing and documenting potential impacts of AI systems on individuals, groups and society.
A.7
AI System Lifecycle
Responsible design, development, verification, validation, deployment, operation and retirement.
A.8
Related Technologies
APIs, vendor risk, integration points, third-party AI services and technical dependencies.
A.9
Stakeholder Relations
Transparency disclosures, explainability mechanisms, user information and stakeholder communication.
A.10
Responsible AI Use
Intended use, responsible use, human oversight, monitoring and operationalised ethics principles.
Statement of Applicability (SoA)
The SoA is where your organization records the necessary controls, their applicability, implementation status and the justification for inclusion or exclusion. It connects your risk decisions to your control framework and certification evidence.
08 · AI lifecycle governance
From idea to production — with controls at every stage.
Good AI governance starts before a model is built and continues after deployment. The lifecycle approach connects business purpose, data, development, evaluation, deployment and monitoring.
1
Define
Understand the business problem and context.
- Identify the problem
- Understand stakeholders
- Frame the question
- Set objectives and metrics
2
Prepare data
Build confidence in the information that will support the AI system.
- Identify data sources
- Assess quality
- Clean and prepare data
- Consider representativeness and bias
3
Develop & evaluate
Build, test and improve the model iteratively.
- Define model features
- Benchmark performance
- Test on new data
- Document tools and evidence
4
Deploy responsibly
Move to production with defined expectations and safeguards.
- Choose deployment environment
- Consider security and scalability
- Define human oversight
- Communicate intended use
5
Monitor & improve
AI behaviour can change. Keep watching it.
- Monitor KPIs
- Track model behaviour
- Investigate issues
- Retrain or improve where required
09 · Implementation journey
Three stages: gap analysis → implementation → certification.
The timeline depends on what you already have — and who you can book. Certification readiness means all 16 scorable clauses scoring 3 with no clause scoring 1.
4–6 weeks
Know exactly what to build
- Assess current state against all 16 clauses
- Score each clause 1-2-3 (absent / partial / compliant)
- Identify which clauses benefit from ISO 27001 delta
- Produce a prioritised remediation roadmap
- No certification yet — but you know exactly what to build
3–5 months
Build the AI substance
- Build policies, procedures and AI asset register
- Implement AI System Impact Assessment process
- Establish internal audit programme
- Run first management review on AI governance
- Certification-ready when all 16 clauses score 3
+1–3 months
Independent audit and certificate
- Stage 1 audit: documentation review
- Stage 2 audit: on-site assessment and interviews
- Nonconformities addressed within agreed timeframe
- Certificate issued by accredited body
- Annual surveillance audits to maintain certificate
10 · Two things nobody tells you
Auditor scarcity and the ISO 27001 compressor.
The timeline depends on what you already have — and who you can book.
The auditor scarcity problem
ISO 42001-certified auditors are genuinely scarce. The standard is new. The pool is small. Demand is growing faster than supply. You can be implementation-ready and wait 2–3 months for an audit slot.
The fix: Engage your certification body at the start of implementation — not the end. Get on the schedule early. You can push the date back. You cannot manufacture a slot that does not exist.
The ISO 27001 compressor
The delta you close with ISO 27001 already in place is AI-specific content — not management system architecture. Your document control, audit programme and review cycle already exist. You are adding AI to a working system.
The compressed timeline below shows how much ISO 27001 saves you.
No ISO infrastructure
12–18
months to certification
Building management system foundations from scratch: document control, internal audit programme, management review cycle, corrective action process.
ISO 27001 in place
9–12
months to certification
Existing management system architecture carries over. Only AI-specific controls, impact assessment, and Annex A substance needs building.
Mature ISO 27001 + ISO 9001
7–9
months to certification
Fully mature management system. Focus entirely on AI-specific content and Annex A — plus early auditor engagement for the scarce audit slot.
11 · Case study
ISO 42001 applied: NovaCred CreditIQ v3.2.
A fintech case study — from gap analysis at Month 0 to certificate at Month 11. NovaCred already held ISO 27001, which compressed Clauses 5–7 and 10. Annex A controls drove the critical path.
12 · NovaCred critical path
Month 2 to Month 10: what actually happened.
Clauses scoring 1 at Month 0 drove the critical path. ISO 27001 foundation compressed Clauses 5–7 and 10. The AI-specific work — Annex A — dominated the timeline.
M 2–3
Clause 4 + A.2
AIMS Scope Statement drafted. AI Ethics Policy v2.0 board-endorsed. AI use policy and data governance policy created.
M 3–4
Clause 5 + A.3
AI Governance Committee established. Charter agreed. Board-level AI ethics reporting cadence set. RACI for CreditIQ documented.
M 4–5
A.5 + A.6
AI Risk Assessment process implemented. First formal assessment of CreditIQ conducted. AI System Impact Assessment template built and completed for CreditIQ.
M 5–6
Clause 8 + A.9
AI System Impact Assessment completed for CreditIQ v3.2. Explainability mechanism designed. Transparency disclosure framework for credit applicants created.
M 6–8
Clauses 6, 9, 10
Measurable AI objectives defined. Internal audit programme extended to cover AI. AI nonconformities logged. Management review conducted with AI agenda.
M 9–10
External Audit
Stage 1 documentation review passed. Stage 2 on-site audit passed with 2 minor nonconformities. Both closed within 4 weeks. Certificate issued Month 11.
Commercial outcome
Month 11: Certificate issued. Included as Exhibit A in a German bank master services agreement. Used in 3 subsequent enterprise pitches — including a UAE financial institution where CBUAE governance expectations were hardening. The certificate became a standing sales asset referenced in every new enterprise governance conversation.
13 · Outcome
NovaCred — Month 0 vs Month 11 gap scores.
Score improved from 26/48 to 46/48. All critical-path clauses reached 3. Certificate issued. This is what closing the AI-specific delta looks like in practice.
4
13
5
23
6
23
7
23
8
13
9
23
10
23
A.2
13
A.3
23
A.4
13
A.5
13
A.6
13
A.7
13
A.8
23
A.9
13
A.10
23
Month 0 — Gap score 26/48Month 11 — Certificate issued — 46/48
14 · Practitioner lessons
Three things NovaCred learned the hard way.
Their gap analysis, critical path and audit booking strategy reveal what actually drives ISO 42001 timelines.
Your ISO 27001 infrastructure is more valuable than you think.
NovaCred's gap analysis revealed that 6 of the 16 clauses were already partially compliant because of ISO 27001. They were not building from scratch. They were closing a delta. If you have ISO 27001, run your gap analysis against ISO 42001 clauses before assuming the timeline is long.
Annex A is where most organizations hit their wall.
The core management system clauses (4 through 10) benefited from ISO 27001 carry-over. Annex A controls — especially A.5 AI Risk Assessment, A.6 AI Impact Assessment, and A.9 Stakeholder Relations — were almost entirely absent. Budget your implementation effort accordingly.
Engage your certification body before you think you are ready.
NovaCred booked their audit slot at Month 3, while still in the middle of implementation. They were implementation-ready at Month 9 and audited at Month 10. Had they waited until Month 9 to book, they would have been waiting until Month 12 or 13 for a slot. Factor auditor availability into your plan.
15 · Gap analysis lite
Score your organization against 16 clauses. Find your critical path.
Score each clause: 1 = Absent, 2 = Partial, 3 = Compliant. For each clause scoring 1 or 2, write one specific remediation action. Certification readiness target: 38 out of 48 with no clause scoring 1.
What to do
- Work through all 16 clauses on the scoring sheet
- Score each clause: 1 = Absent, 2 = Partial, 3 = Compliant
- For each clause scoring 1 or 2, write one specific remediation action
- Add up your total score
- Compare your profile to NovaCred Month 0 — are you ahead or behind?
The self-assessment trap
- Most organizations score themselves too generously on first pass
- The discipline: score against evidence, not intent
- Ask yourself for each clause: if an auditor walked in today, what would I show them?
- Nothing or informal = 1
- Something partial = 2
- Documented, implemented, auditable = 3
- Only 3 counts as 3
16 · Support, evidence & readiness
Build the system — and the evidence behind it.
Certification is not about having a beautiful policy folder. Auditors need evidence that the management system is actually operating.
AI policy & objectivesApproved policy, objectives, governance direction and review records.
Scope & contextAIMS scope, internal/external context and interested-party analysis.
Risk registerAI risks, assessment criteria, owners, treatment and status.
Impact assessmentsDocumented analysis of potential impacts and affected stakeholders.
AI inventoryAI systems, roles, use cases, suppliers and lifecycle status.
Data evidenceSources, quality checks, preparation, provenance and relevant records.
Lifecycle evidenceDesign, development, testing, validation, deployment and monitoring records.
Audit & management reviewInternal audits, management reviews, findings, corrective actions and improvements.
A
Certification readiness
CyberAtrix can help organize the AIMS so that policies, processes, controls and operational evidence tell one consistent story.
- Gap assessment and implementation roadmap
- AI policy and governance framework
- Risk & impact assessment methodology
- Annex A applicability and SoA support
- Internal audit and management review readiness
- Certification audit preparation
17 · Certification lifecycle
How long is an ISO 42001 certificate valid?
A typical management-system certification cycle runs for three years. Certification is not a one-time event: surveillance keeps the AIMS under independent oversight between initial certification and recertification.
YEAR 0 · INITIAL CERTIFICATION
Stage 1 + Stage 2
Stage 1 examines readiness and documented arrangements. Stage 2 evaluates implementation and operational effectiveness. A positive certification decision starts the certification cycle.
Certificate issuedYEAR 1 · SURVEILLANCE 1
Why is it needed?
Checks that the AIMS continues to operate, that important processes are maintained, previous findings are addressed and significant changes are controlled. It is a sampling audit — not normally a complete repeat of Stage 2.
Maintain confidenceYEAR 2 · SURVEILLANCE 2
Why is it needed?
Provides another independent check that governance, risk management, operational controls, monitoring and improvement remain effective. Different areas may be sampled as part of the audit programme.
Demonstrate continuityYEAR 3 · RECERTIFICATION
Renew the certificate
Before expiry, the AIMS undergoes a recertification assessment. A successful decision starts the next certification cycle.
New 3-year cycleThe exact audit programme, timing, duration and scope are determined by the certification body and applicable accreditation/scheme requirements. Organizations should maintain the AIMS continuously rather than preparing only before an audit.
18 · Accreditation matters
Accredited certification vs. just a certificate.
ISO itself does not issue your company certificate. An independent certification body audits the AIMS. Where an accredited route is required, the certification body should hold appropriate accreditation for ISO/IEC 42001 within its scope.
Common accreditation bodies & pathways
Examples you may encounter internationally include:
ANABANSI National Accreditation Board · USA
UKASUnited Kingdom Accreditation Service · UK
UAFUnited Accreditation Foundation · international
JAS-ANZJoint Accreditation System of Australia and New Zealand
Why accreditation can matter
Accreditation provides independent oversight of the certification body's competence, impartiality and certification processes. It can make the certificate more credible to customers, procurement teams, regulators and international stakeholders.
- Check the certification body's current ISO/IEC 42001 accreditation scope.
- Check which accreditation body stands behind the certification.
- Confirm the certificate scope matches your actual AI activities.
- Do not assume every certification body has the same accreditation status in every country.
- Engage your certification body early — auditor availability for ISO 42001 is scarce.
19 · Why CyberAtrix
Why CyberAtrix stands out.
We focus on three things clients care about: performance, delivery and costing. The goal is a management system that works for the business — not a documentation exercise that disappears after certification.
01
Performance-first implementation
We connect governance, risk, controls, evidence and operational practices so the AIMS is designed for real performance and continual improvement — not certificate theatre.
02
Delivery discipline
A structured roadmap, defined deliverables, evidence tracking and audit preparation help keep the implementation moving from gap assessment to certification readiness.
03
Practical costing
We focus on right-sized implementation rather than unnecessary documentation or complexity, helping organizations invest where AI governance creates the most value.
04
AI + security mindset
AI governance rarely exists in isolation. We help organizations think across AI, information security, privacy, risk, vendors and business processes.
05
Evidence that tells a story
Policies, risk records, impact assessments, lifecycle evidence, audits and management reviews are aligned so auditors can follow the logic from risk to control to evidence.
06
Built for long-term maintenance
The objective is not only to reach certification. It is to help you maintain the AIMS through surveillance audits and continual improvement.
Ready when you are
Drop your enquiry with confidence.
Tell us what AI you develop, provide or use, what you want to certify, and where you are today. CyberAtrix will help you understand the practical path toward an ISO/IEC 42001-ready AIMS.
20 · FAQs
ISO 42001 questions, answered.
Simple explanations for management teams, AI teams, compliance teams and organizations preparing for certification.
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is an international management system standard for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS). It is certifiable by accredited third-party certification bodies.
Who can implement ISO 42001?
Organizations of different sizes and sectors can implement it if they develop, provide or use AI systems. The scope should reflect the organization's AI activities and context.
Is ISO 42001 only for companies that build AI models?
No. It can be relevant to organizations that develop AI, provide AI-based products or services, integrate AI into offerings, or use AI internally.
What is an AIMS?
An AI Management System is the set of interrelated policies, processes, objectives, responsibilities and controls an organization uses to govern AI responsibly.
Is ISO 42001 certification mandatory?
ISO/IEC 42001 certification is voluntary. Organizations may implement the standard without certification, while certification provides independent third-party confirmation of conformity.
What are Clauses 4–10 in ISO 42001?
They form the main management-system requirements: context, leadership, planning, support, operation, performance evaluation and improvement. They use the Annex SL high-level structure shared with ISO 27001 and ISO 9001.
What is Annex A in ISO 42001?
Annex A provides AI-specific reference controls organized under nine control objectives: AI policies, internal organization, AI resources, AI risk assessment, AI impact assessment, AI system lifecycle, related technologies, stakeholder relations, and responsible AI use.
What is a Statement of Applicability?
The SoA records which Annex A controls are necessary, their applicability, implementation status and the justification for inclusion or exclusion.
Why is data quality important in ISO 42001?
AI outputs depend heavily on data. ISO 42001 implementation therefore addresses data sources, quality, provenance and preparation as part of AI governance.
What is an AI impact assessment?
It evaluates the possible effects of an AI system on users, individuals, groups or society. It complements broader AI risk assessment. In ISO 42001 it is a required artefact before deploying AI systems.
How long is an ISO 42001 certificate valid?
A typical certification cycle is three years, subject to satisfactory surveillance and the certification body's programme. Surveillance audits normally take place in years 1 and 2, followed by recertification before expiry.
Why are surveillance audits required for ISO 42001?
They provide ongoing independent assurance that the AIMS continues to operate effectively, that important processes are maintained, findings are addressed and significant changes are controlled.
Is Year 2 surveillance the same as recertification?
No. Surveillance is generally a sampled review within the certification cycle. Recertification is the assessment used to renew the certificate for the next cycle.
Can CyberAtrix issue the ISO 42001 certificate?
CyberAtrix provides implementation and certification-readiness support. The ISO certificate itself is issued by an independent certification body following its audit and certification decision.
Can CyberAtrix help with accredited certification?
Yes. We can help prepare the AIMS and support your certification journey. The final choice of certification body and accreditation route should be made based on your scope, geography, customer requirements and the certification body's current accreditation status.
How much does ISO 42001 cost?
Costs vary based on scope, number of AI systems, organizational complexity, existing governance maturity, and chosen certification body. Certification body fees are separate from implementation consulting. Contact CyberAtrix for a tailored estimate.
How long does ISO 42001 implementation take?
Timelines vary with existing management system maturity. Organizations without prior ISO infrastructure typically need 12–18 months. Organizations with ISO 27001 already in place typically need 9–12 months. Organizations with mature ISO 27001 and ISO 9001 typically need 7–9 months.
What is the difference between ISO 42001 and NIST AI RMF?
ISO/IEC 42001 is a certifiable management-system standard assessed by an accredited certification body. NIST AI RMF is a voluntary risk-management framework published by NIST. Many organizations use both together.
Does ISO 42001 cover generative AI and large language models?
ISO/IEC 42001 is technology-neutral and applies to AI systems regardless of technique — including generative AI, large language models, classical machine learning, and future AI approaches.
Does ISO 42001 help with EU AI Act conformity?
ISO 42001 is increasingly recognized as strong governance evidence for the EU AI Act conformity assessment process. Certificate holders are in a materially better regulatory conversation.
What is the certification readiness threshold for ISO 42001?
Certification readiness typically means scoring 3 (Compliant) on all 16 scorable clauses, with no clause scoring 1, and a total score of at least 38 out of a maximum 48.