What is ISO/IEC 42001, and is it worth getting certified?
By Nick Jang, founder of MINERVA Studio ·
The short answer
ISO/IEC 42001 is the international standard for an AI management system (AIMS), published in December 2023 by ISO and the IEC. It sets requirements for how an organization governs the AI it develops, provides or uses: policy, roles, risk and impact assessment, controls, monitoring and continual improvement. Unlike the NIST AI RMF, it is certifiable: an accredited certification body can audit an organization against it.
What ISO/IEC 42001 is
ISO/IEC 42001:2023 follows the same structure as other ISO management system standards, such as ISO/IEC 27001 for information security and ISO 9001 for quality. If an organization already runs one of those, the shape will be familiar: clauses 4 to 10 set requirements on context, leadership, planning, support, operation, performance evaluation and improvement, in a plan-do-check-act cycle.
What makes it an AI standard is the content inside that shape: AI risk assessment, AI system impact assessment (the effects on people and society, not only on the organization), the AI system lifecycle, data for AI, and the relationship with suppliers and customers of AI.
What it requires
| Clause | What it asks for |
|---|---|
| 4. Context | The organization’s role with AI (developer, provider, user), its interested parties and the scope of the AIMS. |
| 5. Leadership | Top management commitment, an AI policy, and assigned roles and responsibilities. |
| 6. Planning | AI risk assessment and treatment, AI system impact assessment, objectives, and a Statement of Applicability for the Annex A controls. |
| 7. Support | Resources, competence, awareness, communication and documented information. |
| 8. Operation | Running the planned processes, including risk treatment and impact assessments in practice. |
| 9. Performance evaluation | Monitoring, measurement, internal audit and management review. |
| 10. Improvement | Nonconformities, corrective action and continual improvement. |
Annex A lists reference controls, 38 of them grouped under nine objectives, covering AI policies, internal organization, resources, impact assessment, the AI system lifecycle, data, information for interested parties, responsible use and third-party relationships. An organization picks the controls that apply and justifies its choices in a Statement of Applicability. Annex B gives implementation guidance for each control.
How certification works
ISO itself doesn’t certify anyone. Certification is done by independent certification bodies, which should be accredited for ISO/IEC 42001 by a national accreditation body (the Standards Council of Canada, in Canada). The usual path is a gap assessment, building or adapting the management system, running it for a period, an internal audit and management review, then a two-stage certification audit. A certificate typically lasts three years with yearly surveillance audits.
Two companion standards support this. ISO/IEC 42006 sets requirements for the bodies that audit and certify AI management systems, and ISO/IEC 42005 gives guidance on AI system impact assessment. ISO/IEC 23894 gives guidance on AI risk management more broadly.
An ISO/IEC 42001 lead auditor is a person trained and qualified to audit against the standard. A lead auditor course certifies the individual, not their employer’s management system.
Is ISO 42001 worth it?
Honestly, it depends on who’s asking you for it.
- For AI vendors selling to banks and large enterprises, often yes. A certificate answers a large part of a buyer’s AI due diligence in one document, and procurement teams increasingly ask for it.
- For a regulated bank or insurer using AI, it’s optional. OSFI doesn’t require ISO/IEC 42001; E-23 and the AI bulletin set the expectations. Some institutions use the standard as a structure for their AI governance without seeking a certificate.
- For organizations with ISO/IEC 27001 already, the marginal effort is lower, because much of the management system machinery is shared.
The cost is real: consultant or staff time to build the system, the audits themselves, and the discipline to keep it running. A certificate shows that a management system exists and works; it doesn’t show that any given AI system is safe or fair.
ISO 42001 beside the NIST AI RMF and OSFI E-23
The three fit together. The NIST AI RMF is a voluntary risk framework without certification. ISO/IEC 42001 is the management system around AI risk, certifiable. OSFI E-23 is the supervisory expectation for the models inside a Canadian bank’s AI. MINERVA keeps the 42001 records a management system needs, a Statement of Applicability, impact assessments and the audit and management review trail, on the same record as the E-23 inventory. MINERVA doesn’t certify anyone and its records aren’t a certificate.
Related questions
When was ISO/IEC 42001 published?
In December 2023, as ISO/IEC 42001:2023.
Is ISO 42001 certifiable?
Yes. Accredited certification bodies audit and certify organizations against it. ISO itself does not issue certificates.
How many controls are in ISO 42001 Annex A?
38 reference controls grouped under nine control objectives. An organization selects those that apply and records its choices in a Statement of Applicability.
Does OSFI require ISO 42001?
No. OSFI’s expectations for AI models are in Guideline E-23 and its July 2026 AI bulletin. ISO/IEC 42001 is voluntary.
What does ISO 42001 provide?
A structured, auditable way to govern AI across an organization: policy, roles, risk and impact assessment, controls, monitoring and improvement, and a certificate others can rely on.
Sources
- ISO — ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system
- ISO — ISO/IEC 42005:2025, AI system impact assessment
- Standards Council of Canada — Accreditation services
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.