If you sell software with AI features baked in, or you're an enterprise buyer trying to figure out whether a vendor's AI is being managed responsibly, you've probably run into the term ISO 42001. It's new, it's spreading fast through vendor security questionnaires, and most of what's written about it is either too legalistic or too vague to actually help you decide what to do. This guide skips the jargon and explains what ISO 42001 is, who actually needs it, what the work looks like, and the misconceptions that trip people up.
What ISO 42001 actually is
ISO 42001 is the first international standard for an artificial intelligence management system, or AIMS. Published by ISO in December 2023, it's built on the same management-system structure as ISO 27001 (the information security standard): you document how your organization governs a specific area, you run the processes you documented, and an accredited auditor checks that you actually did what you said you'd do.
The difference is the subject matter. Where ISO 27001 governs information security, ISO 42001 governs how you develop, deploy, and monitor AI systems. It covers things like how you assess AI-related risk, how you handle bias and fairness in models, how you document data provenance, how you monitor a model after it ships, and how you respond when something goes wrong. It's not a technical standard that tells you how to build a model. It's a governance standard that tells you how to manage the organization building and operating that model.
Who actually needs it
ISO 42001 is not yet a hard requirement anywhere, but it's becoming a de facto expectation in a few specific situations:
- SaaS vendors selling AI features into enterprise or regulated buyers. Procurement teams that already ask for SOC 2 are starting to add ISO 42001 or an equivalent to their vendor security questionnaires, particularly in finance, healthcare, and insurance.
- Companies operating in or selling into the EU. The EU AI Act imposes binding obligations on providers and deployers of certain AI systems, especially "high-risk" categories. ISO 42001 certification isn't a legal substitute for AI Act compliance, but it maps closely to several of the Act's governance requirements and gives you a documented management system to point to.
- US companies wanting to demonstrate AI governance maturity. There's no US federal AI certification requirement yet, but the NIST AI Risk Management Framework (AI RMF) covers similar ground voluntarily. Organizations already following NIST AI RMF are usually most of the way to ISO 42001 readiness, since the two frameworks overlap heavily on risk identification, measurement, and management.
- Companies that build AI-powered products but have never formalized how they manage the risk. If your engineering team is shipping model updates without a documented change process, or nobody owns AI risk assessment, that's the gap ISO 42001 is built to close.
If your company doesn't build or materially rely on AI in its product, you probably don't need this yet. Don't let a vendor questionnaire panic you into a certification project you don't need. That said, we're also fielding more fintech and SaaS clients where a buyer is explicitly asking for it, and that trend is accelerating, not slowing down.
What the work actually involves
Certification follows the same shape as any ISO management-system standard:
- Scoping. You define which AI systems, teams, and processes fall inside the management system. Not every AI use case in your company needs to be in scope on day one.
- Risk assessment. You identify risks specific to your AI systems, including bias, data quality, model drift, and misuse, and document how you evaluate and treat them.
- Controls and policies. ISO 42001 has an annex of controls similar in spirit to ISO 27001's Annex A, covering things like AI system impact assessments, data governance, third-party AI supplier management, and incident response for AI-specific failures.
- Operating the system. This is the part people underestimate. You have to actually run the processes for a meaningful period before an auditor will certify you, not just write the policy.
- Internal audit and management review. Before the external audit, you check your own work.
- Certification audit. An accredited certification body performs a two-stage audit (documentation review, then evidence review) and issues the certificate if you pass.
Most companies start with a readiness assessment rather than jumping straight to the audit. That's the point of our ISO 42001 readiness assessment, which gives you a gap analysis against the standard, a prioritized remediation plan, and an honest estimate of how far out certification actually is before you commit budget to a full audit cycle.
Realistic timeline
Vendors selling ISO 42001 packages sometimes imply this is a fast process. It generally isn't, for the same reason ISO 27001 isn't fast: you need evidence that the management system has been operating, not just documented. For a company with reasonably mature engineering and security practices already in place, expect three to six months from kickoff to certification audit. For a company starting from scratch with no formal AI governance, six to twelve months is more realistic. Companies that already hold ISO 27001 or have implemented NIST AI RMF tend to move toward the faster end, since a lot of the underlying documentation and risk process can be adapted rather than built new.
Common misconceptions
- "ISO 42001 certifies that our AI is safe or unbiased." It doesn't. It certifies that you have a management system for identifying and managing AI-related risk, including bias. It's a governance credential, not a technical guarantee about model behaviour.
- "It's required by law." Not in Canada or the US as of today. The EU AI Act creates legal obligations that ISO 42001 helps you meet, but the standard itself is voluntary everywhere.
- "It replaces SOC 2 or ISO 27001." It doesn't. AI governance and information security are related but distinct concerns, and most enterprise buyers who ask for ISO 42001 still expect SOC 2 or ISO 27001 as well.
- "Any AI feature triggers the need for certification." A chatbot widget or an internal use of a third-party LLM API is a very different risk profile than a company building and deploying its own models into regulated decision-making. Scope the actual risk before assuming you need the full standard.
Where to start
If a customer or prospect has asked whether you're ISO 42001 certified, or you're building AI features and want to get ahead of the requirement before it shows up in a deal, the right first step is a gap assessment, not a certification contract. It's the fastest way to find out what you already have in place, what's missing, and roughly what it will cost in time and effort to close the gap. If you're also weighing this against other compliance work already on your plate, our broader compliance practice can help you sequence ISO 42001 alongside SOC 2 or other frameworks so you're not running parallel projects that duplicate effort.
If you want a clear-eyed read on where your organization stands against ISO 42001, get in touch and we'll walk you through what a readiness assessment looks like for your specific AI footprint.