Clients are increasingly asking: "How do you handle AI?" A nice promise is not enough. They want to see that you have it arranged. That is why ISO 42001 is quickly gaining more attention.
ISO 42001 is the first international standard for managing AI in an organization. This article explains in simple terms what the standard requires, for whom certification is useful, and how to start. Even if you do not (yet) wish to certify.
What is ISO/IEC 42001?
The full name of the standard is ISO/IEC 42001:2023. It describes how to set up an AI management system, known in English as an AI management system or AIMS. It is not software, but a coherent set of policies, roles, processes, and controls for responsible AI.
The standard is intended for organizations that develop, offer, or use AI. So, it's not only for tech companies. Even an organization that deploys Copilot and AI agents can use the standard.
What does ISO 42001 require?
ISO 42001 is structured like other management system standards, such as ISO 27001 for information security. It works according to the familiar cycle: plan, do, check, and improve. The key components include:
- Context: what AI do you use, for what purpose, and which stakeholders are involved?
- Leadership: management takes responsibility and establishes an AI policy.
- Risks and impact: you assess the risks of your AI applications, including the impact on people.
- Support: people, knowledge, awareness, and documentation are in order.
- Operation: you manage AI applications throughout their lifecycle.
- Evaluation: you measure, monitor, and conduct internal audits.
- Improvement: you learn from incidents and make adjustments.
Additionally, the standard includes an annex with control measures (Annex A) and explanations on how to implement them.
ISO 42001 vs. ISO 27001
| ISO 27001 | ISO 42001 | |
|---|---|---|
| Subject | Information security | Responsible use and management of AI |
| Key question | Is our information secure? | Are we using AI responsibly and managedly? |
| Risks | Confidentiality, integrity, availability | Also bias, transparency, impact on people, reliability |
| Structure | Management system standard | Management system standard, with the same basic structure |
Do you already have ISO 27001? Then you have a significant advantage. The structure is similar, and many processes can be combined.
ISO 42001 and the AI Act
The European AI Act (the EU AI Act) is legislation. ISO 42001 is a voluntary standard. They complement each other. The law tells you what must be done, depending on the risk of your applications. ISO 42001 helps you organize and demonstrate that structurally. A certificate does not automatically mean you comply with the law, but it does help get your approach in order.
For whom is ISO 42001 certification useful?
- Organizations that deliver AI solutions to clients.
- Organizations in sectors where trust is crucial, such as healthcare, finance, and government.
- Organizations that already have ISO 27001 and want to expand their management system.
- Organizations whose clients or tenders demand demonstrable AI governance.
Do you use AI only on a small scale? Then full certification is often not necessary yet. But the standard is an excellent guide.
How to get ISO 42001 certification?
- Determine the scope. Which AI applications and which parts of the organization are included?
- Conduct a baseline measurement. Where do you stand relative to the standard's requirements?
- Set up the management system. Policy, roles, risk assessments, and processes.
- Run the system. Record, monitor, train, and conduct an internal audit.
- Get audited. An accredited certifying body performs the external audit, usually in two phases.
- Continue improving. After certification, periodic control audits follow.
What does ISO 42001 certification cost?
That depends heavily on your situation. Key cost drivers include the scope's size, the number of AI applications, the maturity of your current processes, whether you already have an ISO management system, and the amount of external guidance you enlist. Request quotes from multiple certifying bodies based on your scope.
How can Microsoft 365 help?
Microsoft 365 does not make you ISO 42001 compliant. But it does provide building blocks. Access management with Entra ID. Sensitivity labels and audit logs with Microsoft Purview. Usage insights through reports. And a dedicated space for policies and documentation in SharePoint.
How 365 Agents helps
The Frontier Crew is built with governance by design. Each agent has a specific role, approved knowledge with an owner for each source, clear boundaries, and monitoring. You can trace what happened afterward. These are exactly the building blocks you need to deploy AI managedly and demonstrably, even if you’re working towards ISO 42001.
Do you want to deploy AI in a way you can justify? Schedule a conversation and we will look at your situation.
Frequently Asked Questions
Is ISO 42001 mandatory?
No. ISO 42001 is a voluntary standard. However, clients and tenders are increasingly asking for it.
Can individuals be ISO 42001 certified?
The standard itself certifies organizations. For individuals, there are trainings and personal certificates available, such as for lead implementer or lead auditor.
How long does an ISO 42001 process take?
That depends on your scope and starting point. With an existing ISO 27001 system, it goes faster.
Where can I find the official text of ISO 42001?
The standard is available for purchase through ISO and through national standardization bodies, such as NEN in the Netherlands and NBN in Belgium.
