ISO/IEC 42001 is the international standard for an AI management system: the policies, roles, risk assessments and checks an organisation uses to develop, provide or use AI responsibly. It was published by ISO and IEC in December 2023, and it's the first AI standard an organisation can be certified against. This article explains what it is, what it asks for and how certification works. It's our own plain-English summary, not the standard itself.
Please read: SupplierVault isn't affiliated with or endorsed by ISO or IEC. This is a general summary to help you understand the standard. It isn't the standard's text, and it isn't legal or certification advice. Buy the standard (for example from BSI) and check your approach against it. Only an accredited certification body can certify your organisation.
Who it's for
Any organisation that builds, provides or uses AI, of any size and in any sector. That includes organisations that don't build AI themselves but use it, for example an AI feature inside software they buy, or a supplier that uses AI to deliver a service. It's most often asked for by:
- customers who want evidence that you manage AI risk, especially in tenders and security questionnaires;
- organisations that already hold ISO 27001 or ISO 9001, because ISO/IEC 42001 uses the same structure and the systems can be run together;
- organisations preparing for the EU AI Act, where it helps show you have a working system for AI risk (it doesn't by itself mean you meet the Act).
How the standard is laid out
Like ISO 27001 and ISO 9001, it has main clauses that are requirements, and annexes that add controls and guidance.
| Part | What it covers (our summary) |
|---|---|
| Clause 4: context | Understand your organisation, the people affected by your AI and what they expect, decide the scope of your AI management system, and your role (for example developer, provider or user of AI). |
| Clause 5: leadership | Senior management commitment, an AI policy, and clear roles and responsibilities. |
| Clause 6: planning | Assess AI risks, decide how to treat them, assess the impact of AI systems on people and society, choose controls (recorded in a Statement of Applicability), and set AI objectives. |
| Clause 7: support | Resources, competence, awareness, communication and keeping documented information. |
| Clause 8: operation | Run what you planned: carry out risk assessments, risk treatment and impact assessments, and control changes. |
| Clause 9: performance evaluation | Monitor and measure, carry out internal audits, and hold management reviews. |
| Clause 10: improvement | Fix nonconformities with corrective action, and keep improving. |
| Annex A | 38 controls you consider for your AI systems, grouped into areas such as AI policies, internal organisation, resources, impact assessment, the AI system life cycle, data, information for interested parties, responsible use, and third-party and customer relationships. |
| Annex B | Guidance on putting the Annex A controls in place. |
| Annex C | Examples of AI-related objectives and sources of risk. |
| Annex D | Using the management system across different domains and sectors. |
The main things you'll need
- A scope: which parts of the organisation and which AI systems the management system covers.
- An AI policy, approved by senior management, and named roles.
- A register of your AI systems, including AI you use through suppliers. The standard doesn't use the word "register", but you can't assess risks or impacts without knowing what you have.
- AI risk assessments and a risk treatment plan.
- AI system impact assessments: how a system could affect individuals, groups and society.
- A Statement of Applicability: each Annex A control, whether it applies, why, and whether it's in place.
- AI objectives with a way to measure them.
- Supplier controls: knowing which suppliers provide or use AI for you, and making sure their responsibilities are clear.
- Internal audits, management reviews and a record of corrective actions.
- Evidence for all of the above, kept up to date.
How certification works
- Get ready. Put the management system in place and run it for long enough to have evidence, including at least one internal audit and one management review.
- Choose an accredited certification body. In the UK, accreditation is by UKAS. UKAS accredited its first certification body for ISO/IEC 42001 in January 2026, and more are following, so check the UKAS website for who is accredited.
- Stage 1 audit. The auditor reviews your documents and whether you're ready.
- Stage 2 audit. The auditor checks that the system works in practice, with evidence and interviews.
- Certificate and surveillance. Certificates usually last three years, with surveillance audits in between and a recertification audit at the end.
How SupplierVault helps
SupplierVault has an optional AI management (ISO/IEC 42001) module on the Professional plan and above, and in the free month. Switch it on in Modules & forms. It gives you:
- an AI register, linked to the suppliers that provide or use AI for you, and to their AI use assessments;
- AI risk assessments and AI system impact assessments with sign-off and yearly reviews;
- a starter AI policy in our own words, for you to adapt;
- a Statement of Applicability for the 38 Annex A controls, with our own plain-English descriptions, owners and evidence;
- internal audits, management reviews and corrective actions;
- a readiness summary and an evidence pack to share with your auditor.
SupplierVault helps you organise the work and the evidence. It doesn't make you compliant or certified by itself: that depends on how your organisation runs its AI management system, and on your certification body's audit.