ISO/IEC 42001 (AI management systems)

What it is

ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS) inside an organization. ISO lists it as edition 1, published in December 2023, from technical committee ISO/IEC JTC 1/SC 42.

It is a management-system standard built on the Plan-Do-Check-Act methodology, and ISO places it alongside other management system standards such as ISO 9001 for quality and ISO/IEC 27001 for IT security.

What it covers

ISO’s own explainer says the standard defines requirements for:

• leadership and organizational context
• AI policy and objectives
• risk management for AI systems
• data governance and system lifecycle controls
• transparency and information provision
• performance evaluation and monitoring
• continual improvement

What it does not do

ISO states that, rather than looking at the details of specific AI applications, the standard provides a practical way of managing AI-related risks and opportunities across an organization. For aerospace and defense programs this matters: the standard is an organizational governance layer. It is not a product-level assurance method such as the learning assurance process in EASA’s concept paper, and it is not an acceptable means of compliance defined by an aviation authority.

Certification

ISO says organizations may choose certification when they want independent confirmation that their AI management system meets the standard, and that certification is performed by independent certification bodies. What those bodies publish about Stage 1, Stage 2 and evidence is in What auditors ask for in an ISO/IEC 42001 certification audit.

ISO/IEC 42006:2025 is the catalogued requirements document for those bodies. ISO lists it as edition 1, published July 2025, with the life-cycle table recording International Standard published on 2025-07-07. It sets out the additional requirements for bodies that audit and certify artificial intelligence management systems (AIMS) according to ISO/IEC 42001. ISO’s public FAQ: it does not replace ISO/IEC 17021-1; it supplements it. The audience on that page is certification bodies performing audits of AI management systems based on ISO/IEC 42001, as well as accreditation bodies assessing those certifiers.

How it relates to other frameworks

• ISO/IEC 23894. Organizational AI risk-management guidance is on the ISO/IEC 23894 page. 42001 remains the management-system requirements standard.
• ISO/IEC 42005. ISO lists ISO/IEC 42005:2025, AI system impact assessment as edition 1, 39 pages, Published with the life-cycle table recording International Standard published on 2025-05-28. The catalog FAQ How does ISO/IEC 42005 relate to other AI standards? says it complements standards like ISO/IEC 42001 (AI management systems), ISO/IEC 38507 (AI governance), and ISO/IEC 23894 (AI risk management). That page catalogues guidance, not a certifiable AIMS. See ISO/IEC 42005:2025 AI system impact assessment.
• NIST AI RMF. NIST’s AI Resource Center hosts a crosswalk from the AI RMF to ISO/IEC FDIS 42001. See our crosswalk article and the defense-contractor brief ISO 42001 vs NIST AI RMF for defense contractors.
• EU AI Act. See the EU AI Act page for its scope and dates. This site has not found an official source stating that ISO/IEC 42001 certification confers a presumption of conformity under the Act, so we make no such claim.

Primary sources

Read the standard itself at iso.org. ISO sells the full text.