If your organisation is deploying AI and someone in procurement has started asking for an ISO 42001 certificate, you need two answers before you sign anything. First, what the standard actually requires. Second, and more expensive to get wrong, what the certificate does not buy you. ISO 42001 is a real management system standard with a real audit behind it, and it is also routinely mis-sold as a shortcut to EU AI Act compliance, which it is not.
This post covers both. By the end you should be able to decide whether your organisation needs certification, and what legal obligations remain sitting on your desk afterwards.
What ISO 42001 Is
ISO/IEC 42001 is the certifiable management system standard for artificial intelligence, published jointly by ISO and IEC. It defines an AI management system, usually shortened to AIMS.
The word "management system" is doing the work in that sentence. ISO 42001 does not tell you how to build a model, what accuracy threshold to hit, or which datasets are acceptable. It specifies the organisational machinery around AI: how you set policy, assign accountability, assess AI-specific risk and impact, control your suppliers, monitor systems in production, and improve the whole arrangement over time. An auditor certifies the machinery, not the model.
That distinction is the source of most disappointment with the standard. A certificate says your governance process exists and is being followed. It says nothing about whether any particular system you built is safe, accurate or lawful.
Worth knowing: ISO 42001 is certifiable, which sets it apart from most AI governance publications. The NIST AI Risk Management Framework is still at version 1.0 and is voluntary, with no certification scheme attached. If a vendor offers you "NIST AI RMF certification", they are selling their own badge, not a recognised conformity assessment.
What Is Actually in ISO 42001: The Annex A Control Count
The requirements clauses follow the standard ISO management system shape that anyone who has implemented ISO 27001 will recognise: context, leadership, planning, support, operation, performance evaluation, improvement. The AI-specific substance sits in the annexes.
Annex A of ISO/IEC 42001 contains 38 controls across 9 categories, numbered A.2 to A.10.
Take that number seriously, because a large share of the material you will find online gets it wrong. The figure 37 appears constantly in vendor blog posts, consultancy summaries and readiness checklists. It is wrong, and it spreads the way most bad numbers spread: someone miscounted a summary, the next writer copied the summary rather than the annex, and the error compounded. The category numbering starting at A.2 rather than A.1 is exactly the kind of off-by-one trap that produces this.
If you are building a control matrix for an audit, count the annex yourself rather than trusting a blog post. Including this one. An implementation plan that tracks 37 controls has a gap in it by construction, and the gap will surface in the worst possible place, which is the certification audit.
The control categories cover ground that has no equivalent in an information security management system: AI policy, internal organisation, resources for AI systems, impact assessment for individuals and society, the AI system lifecycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships.
Normative Versus Informative Annexes
This trips people up during implementation planning, so it is worth stating plainly.
- Annex A and Annex B are normative. They are part of the requirements. Annex A gives the control set, Annex B gives implementation guidance on those controls.
- Annex C and Annex D are informative. They are reference material, not requirements. Treating them as mandatory inflates your project for no audit benefit.
Teams that skim the annexes and assume everything after the clauses is optional guidance end up under-scoping. Teams that treat all four as binding end up over-scoping. Both cost money.
ISO 42001 Compared With ISO 27001
Most organisations meeting ISO 42001 already hold ISO 27001, and the comparison sets expectations well.
| ISO/IEC 42001 | ISO/IEC 27001 | |
|---|---|---|
| Subject | AI management system (AIMS) | Information security management system (ISMS) |
| Annex A controls | 38 | 93 |
| Annex A grouping | 9 categories, A.2 to A.10 | 4 themes |
| Certifiable | Yes | Yes |
| Core concern | Responsible development and use of AI systems | Confidentiality, integrity and availability of information |
The smaller control count does not mean a smaller project. ISO 27001 controls mostly govern assets and processes you already own and can inventory. Several ISO 42001 controls, particularly around impact assessment and the AI system lifecycle, require you to produce evidence about systems whose behaviour you may not fully characterise yet. Assembling that evidence for the first time is usually the long pole.
ISO 42001 and the EU AI Act: The Part That Costs Money to Get Wrong
Here is the single most commercially important fact in this post.
Certification to ISO/IEC 42001 gives no presumption of conformity with the EU AI Act.
Presumption of conformity is a specific legal mechanism. When you conform to a harmonised standard that has been cited for a particular regulation, you are presumed to meet the corresponding legal requirements, and the burden shifts. An ISO 42001 certificate does not do that. Buying the certificate does not discharge the legal obligation. If you fall in scope of the AI Act, you still have to demonstrate conformity with the Act on the Act's own terms, with or without the ISO certificate in the drawer.
Europe has been building the dedicated instruments separately. EN 18286 is the dedicated European AI management system standard, made available in July 2026. The European adoption of the ISO standard, EN ISO/IEC 42001:2026, dates from 18 March 2026. These are the documents to watch if your compliance case depends on a European standard, rather than assuming the international certificate carries over.
None of this makes ISO 42001 worthless for AI Act work. The evidence you generate for the AIMS, particularly risk management, impact assessment, data governance and post-deployment monitoring, overlaps heavily with what the Act expects a provider of a high-risk system to be able to show. Reusing that evidence is legitimate and efficient. Claiming the certificate satisfies the regulation is not.
The AI Act Timeline Moved
If your compliance plan was built before mid-2026, check the dates again. High-risk obligations were delayed by Regulation (EU) 2026/1744, in force 27 July 2026.
- Annex III stand-alone high-risk systems: now 2 December 2027
- Annex I safety components: now 2 August 2028
The delay is breathing room for implementation, not a reason to stop. Certification bodies, auditors and trained implementers are a finite resource, and demand for them is being pushed toward the same two dates.
The Penalty Tiers, Accurately
Penalty figures get quoted carelessly, usually by people reaching for the biggest number in the regulation. The tiers are distinct.
| Breach | Maximum penalty |
|---|---|
| Article 5 prohibited practices | 35 million euro or 7% of global turnover |
| High-risk obligations and Article 50 transparency | 15 million euro or 3% of global turnover |
| Incorrect or misleading information to authorities | 7.5 million euro or 1% of global turnover |
Note the second row. High-risk breaches sit in the 3% tier, not the 7% tier. If an internal business case for AI governance spend quotes 7% for high-risk non-compliance, the number is wrong and the case will not survive scrutiny from anyone who has read the regulation.
Do You Actually Need ISO 42001?
Strip away the marketing and the decision comes down to who is asking you for what.
Certification is worth pursuing if:
- Customers or procurement teams are asking for it contractually, which is currently the most common driver by a distance
- You sell AI-enabled products into regulated buyers who need assurance about your governance
- You already run certified management systems and can extend the audit cycle rather than starting from nothing
- You need one internal framework that AI, security, legal and product teams can all work from
Certification is probably the wrong first spend if:
- Your immediate problem is an AI Act deadline, since the certificate does not answer it and the European instruments are the relevant ones
- You have no AI inventory yet, in which case build the inventory first or the audit scope will be fiction
- Nobody is asking for it and you are buying a badge for the website
The realistic sequence for most organisations is inventory, then governance framework, then AI Act gap analysis against your actual obligations, then certification if a customer or a market requires it. Certification first is an expensive way to discover you do not know which systems you own.
Where This Sits Alongside Service Management
Governance obligations do not arrive on a blank page. They land on organisations that already run change management, incident management, supplier management and service reporting, usually shaped by ITIL. AI-specific requirements such as post-deployment monitoring, incident handling for model behaviour and third-party AI supplier control map onto practices you are already running, and the fastest implementations extend existing practice rather than standing up a parallel governance function.
Our ITIL AI Governance course covers ISO/IEC 42001 as one of its eight domains and teaches how these regimes map onto service management practice, so the AIMS requirements become an extension of how your organisation already works rather than a separate bureaucracy.
The wider standards environment keeps expanding around the same set of concerns. IEEE 7014-2024, published 28 June 2024, covers emulated empathy in autonomous and intelligent systems, which is a reminder that specific AI behaviours are getting their own standards while ISO 42001 governs the management system above them.
Frequently Asked Questions
What is the ISO 42001 standard?
ISO/IEC 42001 is the international standard for an AI management system, published jointly by ISO and IEC. It sets requirements for governing the development and use of AI across an organisation, and organisations can be certified against it by an accredited body. Annex A contains 38 controls across 9 categories, numbered A.2 to A.10.
Who needs ISO 42001?
Nobody is legally required to hold it. In practice the organisations pursuing it are those facing customer or procurement demands for AI assurance, those selling AI-enabled products into regulated sectors, and those that already hold ISO 27001 and want one coherent governance framework across security and AI.
Does ISO 42001 make you EU AI Act compliant?
No. Certification to ISO/IEC 42001 gives no presumption of conformity with the EU AI Act. The evidence you produce for the management system supports an AI Act case and reduces duplicated effort, but the legal obligations remain and must be met on the Act's own terms. EN 18286, made available in July 2026, is the dedicated European AI management system standard.
How much does it cost to get ISO 42001 certified?
There is no published list price, because certification is quoted per organisation. The variables that move the number are the scope you certify, how many AI systems and sites fall inside it, your headcount, how much of the evidence already exists from an ISO 27001 programme, and the certification body you appoint. Get quotes from accredited bodies against a scope you have actually defined, since an undefined scope is what makes early quotes useless.
What are the steps to ISO 42001 compliance?
Build an inventory of the AI systems you develop or use, define the scope of the management system, run a gap analysis against the requirements clauses and the 38 Annex A controls, close the gaps and generate evidence, run an internal audit and management review, then engage an accredited certification body for the stage one and stage two audits.
Ready to Start Practising?
Knowing what ISO 42001 requires is one thing. Being the person in the room who can explain why the certificate does not close an AI Act gap, and what to do instead, is what gets you hired onto these programmes.
CertCrush has practice questions, flashcards and study guides for the AI governance and service management certifications that employers are hiring against right now. Start with the ITIL AI Governance course if you want the standards mapped onto service management practice, or compare your options in our guide to the best AI governance certification in 2026. If your governance work sits next to an existing ISMS, our breakdown of ISO 27001 Lead Auditor vs Lead Implementer covers which side of the audit you want to be on.
Create a free CertCrush account and start practising today.