Every board is now being asked a version of the same question: can you prove your organisation uses AI responsibly? Customers ask it in procurement. Regulators ask it under the EU AI Act. Investors ask it in diligence. For years there was no clean answer, only policies, principles and good intentions. ISO 42001 changes that. It is the first international, certifiable standard for managing AI, and it is fast becoming the way serious organisations demonstrate they have AI under control.
If your organisation already holds ISO 27001, the good news is that you are not starting from scratch. This is a board-level guide to what ISO 42001 is, why it matters now, and how to get there.
What ISO 42001 actually is
ISO/IEC 42001:2023 is the world's first management system standard for artificial intelligence. Published at the end of 2023, it does for AI what ISO 27001 does for information security: it sets out the requirements for an AI management system, a structured, auditable way of governing how AI is developed, procured, deployed and monitored across an organisation.
Crucially, it is certifiable. An accredited body can audit your organisation and certify that your AI management system meets the standard, giving you something you can actually show a customer, regulator or investor, rather than a policy document that asserts good behaviour. Because it follows the same high-level structure as ISO 27001 and ISO 9001, it slots alongside your existing management systems rather than sitting awkwardly beside them.
Why it matters now
Three forces are pushing ISO 42001 up the board agenda.
First, AI has become a board-level risk. The same technology delivering productivity gains also introduces new exposures: biased or wrong outputs, data leakage, opaque decision-making, and reputational damage when something goes wrong. Boards are accountable for that risk, and "the tech team is handling it" is no longer an adequate answer.
Second, regulation is arriving. The EU AI Act imposes real obligations on organisations that build or use AI, and while ISO 42001 is not a direct compliance tick for the Act, a certified AI management system is one of the most credible ways to demonstrate the governance the Act expects. It also sits naturally alongside frameworks you may already face, from ISO 27001 to, for financial services, DORA.
Third, it is becoming a commercial requirement. Increasingly, ISO 42001 is used as a benchmark in vendor selection: buyers want assurance that the AI-enabled products they purchase are governed properly. Certification is turning from a nice-to-have into a competitive differentiator, and in some sectors a condition of doing business.
What the standard requires, in plain English
Strip away the clause numbers and ISO 42001 asks an organisation to do a few sensible things well:
- Own it at the top. Leadership must set an AI policy, assign clear responsibility, and treat AI governance as a managed system, not an ad hoc project.
- Understand your AI risk. Assess the risks your AI systems create, not just to the business but to the people affected by them, and put controls in place proportionate to that risk.
- Govern the whole lifecycle. From data and design through deployment and monitoring, with the controls set out in the standard's Annex A covering areas like data quality, transparency, human oversight and impact assessment.
- Prove it works. Maintain the evidence, monitor performance, and improve continually, so that when someone asks you to demonstrate control, you can.
If that sounds familiar, it should. It is the same disciplined, risk-based, continually-improving management approach that underpins ISO 27001, applied to AI.
If you have ISO 27001, you are part-way there
This is the practical point most boards miss. An organisation with a mature ISO 27001 information security management system already has the scaffolding ISO 42001 needs: leadership commitment, risk assessment, a controls framework, internal audit, and a culture of continual improvement. Much of the governance, documentation and audit machinery is reusable. The work is in adding the AI-specific elements, the AI policy, the AI risk and impact assessments, the lifecycle controls, rather than building a management system from the ground up.
Having taken an organisation to ISO 27001 certification inside nine months, my experience is that the certification itself is rarely the hard part. The hard part is honest scoping and disciplined execution: knowing exactly which AI systems are in scope, being truthful about where the gaps are, and running the programme with the same rigour you would give any board-level commitment.
A practical path to ISO 42001
For most mid-market and PE-backed organisations, a sensible route looks like this. Start with scope and a gap analysis: what AI are you actually using, where, and how does your current governance measure against the standard. Reuse your ISO 27001 framework wherever it maps. Build the AI-specific policy, risk assessments and lifecycle controls. Run an internal audit and a management review to test that it works. Then bring in an accredited certification body. Done well, and especially where an ISO 27001 foundation exists, this is a matter of months, not years. For a closer look at the delivery detail, see my guide to the key steps for implementing ISO 42001.
Frequently asked questions
What is ISO 42001?
ISO/IEC 42001:2023 is the first international standard for an AI management system. It sets out certifiable requirements for governing how an organisation develops, procures, deploys and monitors artificial intelligence, in the same structured way ISO 27001 governs information security.
Who needs ISO 42001?
Any organisation that builds or relies on AI and needs to demonstrate it does so responsibly, whether to regulators, customers or investors. It is particularly relevant where AI touches customers or decisions, and increasingly where buyers demand assurance before purchasing AI-enabled products.
How does ISO 42001 relate to ISO 27001?
They share the same management system structure, so they fit together. An organisation with mature ISO 27001 already has much of the governance, risk and audit machinery ISO 42001 needs, which makes achieving it considerably faster than starting from scratch.
Does ISO 42001 help with the EU AI Act?
It is not a direct substitute for AI Act compliance, but a certified AI management system is one of the most credible ways to demonstrate the responsible-AI governance the Act expects, and it provides the structure to manage those obligations in an organised way.
How long does ISO 42001 certification take?
It depends on your starting point. An organisation with an existing ISO 27001 management system can typically reach certification in months by extending what it already has, whereas one starting without a management system foundation will take longer.
Turn AI governance into an advantage
ISO 42001 is not paperwork for its own sake. Done properly, it gives a board genuine assurance that its AI is under control, it satisfies the questions regulators, customers and investors are increasingly asking, and it turns responsible AI from a claim into something you can prove.
If your board wants to get ahead of the AI governance question, whether that means a full ISO 42001 programme or simply understanding your exposure, book a confidential conversation. I help boards and PE-backed businesses put credible AI and information-security governance in place, drawing on hands-on fractional and interim CISO leadership and ISO 27001 delivery in under nine months.