ISO 42001 is the world’s first international standard for AI management systems. The standard gives organisations a framework for managing risk, accountability, transparency and continual improvement in connection with the use of artificial intelligence (AI).

As artificial intelligence becomes an increasingly important part of organisations’ work processes, requirements for control, documentation and responsible use are also growing. At the same time, the EU is introducing new regulations through the AI Act. This is driving growing interest in establishing an AI management system based on ISO 42001.

In this article, we explain what ISO 42001 is, which organisations it is relevant for, what requirements it sets out, how it relates to the AI Act and how organisations can work towards certification.

ISO/IEC 42001:2023 is the world’s first international standard for artificial intelligence management systems. The standard has been developed by ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission) and describes the requirements for an Artificial Intelligence Management System (AIMS).

In the same way that ISO 9001 provides a framework for quality management and ISO 27001 provides a framework for information security, ISO 42001 provides a framework for the governance of artificial intelligence.

The goal is to help organisations use AI in a responsible, documented and controlled manner. The standard covers the development, procurement, implementation and use of AI systems.

ISO 42001 can be used by organisations in all industries and of all sizes, whether they develop their own AI solutions or use AI technology supplied by others.

AI creates significant opportunities for efficiency, innovation and better decision support. At the same time, the technology introduces new types of risk that traditional management systems do not fully address.

Organisations must, amongst other things, address questions such as:

• How do we ensure that AI models produce reliable results?

• How do we detect bias or discrimination in AI systems?

• How do we document decisions that have been influenced by AI?

• How do we safeguard data protection and information security?

• Who is accountable if AI provides incorrect recommendations or decision support?

• How do we monitor AI systems that evolve over time?

ISO 42001 was developed to give organisations a structured method for addressing these challenges through established management principles, risk management and continual improvement.

Many assume that ISO 42001 is only relevant for technology companies that develop their own AI models. In practice, the target audience is far broader. The standard is relevant for all organisations that develop, supply or use AI in their products, services or work processes.

Organisations that use tools such as Microsoft Copilot, ChatGPT or other AI features in their day-to-day work processes.

Organisations that use AI for analysis, decision support or automation of work processes.

Companies that use AI for predictive maintenance, quality control or production optimisation.

Organisations that use AI for risk assessments, fraud detection or automated decision-making.

Organisations that develop AI-based products or build AI functionality into existing solutions.

Organisations that assist clients with AI advisory services, implementation or development.

Many organisations think of AI as advanced language models or purpose-built solutions. The reality is that many organisations are already using AI today without being consciously aware of it.

AI is becoming an integrated part of:

• Microsoft 365

• CRM systems

• ERP solutions

• Analytics and reporting tools

• Marketing platforms

• Customer service systems

• Recruitment tools

This means the need for AI governance applies not only to organisations that develop AI, but also to organisations that use AI as part of their work processes.

An AI management system — also referred to as an artificial intelligence management system — is the totality of processes, roles, guidelines, controls and documentation that ensures responsible use of AI within the organisation.

The goal is not to control the technology alone. The goal is to control how the organisation uses the technology.

An AI management system contributes, amongst other things, to:

• Clear roles and responsibilities

• Systematic risk management

• Control over data and models

• Documentation of decisions

• Monitoring of AI systems

• Non-conformity handling

• Continual improvement

In the same way as other ISO-based management systems, the AI management system should be an integrated part of the organisation’s leadership and operations.

ISO 42001 follows the same harmonised structure used in modern ISO standards. This makes it easier to integrate the standard with existing management systems such as ISO 9001 and ISO 27001.

The requirements are organised into the following main clauses.

The organisation must understand how AI affects stakeholders, business objectives and its environment.

Management must establish policy, responsibilities and objectives for the AI management system.

The organisation must identify risks, opportunities and necessary actions.

Requirements for competence, resources, communication and documentation.

Management of AI-related activities and processes.

Monitoring, measurement, internal audit and management review.

Handling of non-conformities and continual improvement of the management system.

Although the standard contains many detailed requirements, there are a number of central themes that recur throughout.

The organisation must establish clear governance mechanisms for the use of artificial intelligence. This includes, amongst other things, roles, responsibilities, decision-making processes and reporting.

AI-related risks must be identified, assessed and managed systematically. The risks may be technical, legal, ethical or commercial in nature.

The standard places significant emphasis on understanding the consequences AI systems may have for individuals, the organisation and society.

AI systems must be governed throughout their entire lifecycle:

• Planning
• Development
• Testing
• Implementation
• Operations
• Monitoring
• Decommissioning

The organisation must maintain control over the quality, provenance and use of data employed in AI systems.

Stakeholders must receive the necessary information about how AI is used and what consequences its use may have.

The AI management system must be evaluated and improved over time in the same way as other management systems.

Get in touch to find out how we can help your organisation!

There is no definitive answer, but certain organisations will have greater need than others.

An AI management system is particularly relevant if the organisation:

• Develops its own AI solutions
• Delivers AI-based services to customers
• Uses AI in decision-making processes
• Processes personal data through AI
• Operates in regulated industries
• Anticipates requirements from customers or authorities relating to AI

Many organisations are already finding that customers are asking questions about how AI is used, which data is employed and which controls are in place.

ISO 9001 is about quality management.

ISO 42001 is about the governance of artificial intelligence.

Both standards are built on risk-based thinking, management commitment and continual improvement. ISO 42001, however, introduces requirements that are specific to AI.

These include, amongst others:

• AI risk assessments
• Data governance
• Transparency
• Human oversight
• Impact assessments
• AI-specific governance

For organisations already certified to ISO 9001, much of the structure will be familiar.

ISO 27001 focuses on information security.

ISO 42001 focuses on the governance of artificial intelligence.

There is significant overlap between the standards, particularly in:

• Risk management
• Supplier management
• Documentation
• Internal audit
• Management review
• Continual improvement

Many organisations will therefore be able to integrate ISO 42001 with existing management systems based on ISO 27001.

AI governance describes the discipline or field concerned with the management of artificial intelligence.

ISO 42001 is a concrete standard that describes how organisations can establish a management system for AI governance.

One way to put it is:

• AI governance is the goal.
• ISO 42001 is the framework.

In the same way that information security is the field, whilst ISO 27001 is the standard that describes how the work can be organised.

The AI Act is the EU’s regulatory framework for artificial intelligence.

ISO 42001 is an international standard for AI management systems.

These are two different things, but they share many common themes.

The AI Act sets legal requirements for certain types of AI systems. ISO 42001 provides a governance framework that can help organisations establish the processes, responsibilities and documentation that support compliance with these requirements.

Both focus, amongst other things, on:

• Risk management
• Documentation
• Transparency
• Accountability
• Monitoring
• Human oversight

Yes. ISO 42001 is an international standard and can be certified through accredited certification bodies in the same way as ISO 9001 and ISO 27001.

Interest in ISO 42001 is still at an early stage, but many expect demand to increase significantly as the AI Act gains greater relevance and AI is adopted by a growing number of organisations.

The path to certification will vary between organisations, but typically involves the following steps:

Identify which AI systems are in use within the organisation.

Compare current practice against the requirements of ISO 42001.

Define roles, responsibilities, processes and the necessary documentation.

Carry out actions relating to risk management, data governance and governance.

Verify that the management system is functioning as planned.

Management must evaluate the system’s effectiveness and maturity.

An accredited certification body carries out an audit and assesses whether the requirements have been met.

For many organisations, the most important first step is to gain an overview.

Start by mapping:

• Which AI tools are in use within the organisation
• Who is using them
• Which data is being processed
• Which risks exist
• Which requirements customers or authorities are setting

The organisation can then establish a management system that builds on existing processes for quality, information security, data protection and risk management.

ISO 42001 is the world’s first international standard for AI management systems. The standard gives organisations a structured framework for managing risk, accountability, transparency and continual improvement in connection with the use of artificial intelligence.

As AI becomes an increasingly important part of how organisations work, make decisions and deliver services, the need for AI governance and documented management will grow.

For organisations wishing to establish an AI management system, prepare for the AI Act or document maturity in the responsible use of artificial intelligence, ISO 42001 is likely to become one of the most important standards in the years ahead.

ISO 42001 is the world’s first international standard for AI management systems. The standard gives organisations a structured framework for managing risk, accountability, transparency and continual improvement in connection with the use of artificial intelligence.

As AI becomes an increasingly important part of how organisations work, make decisions and deliver services, the need for AI governance and documented management will grow.

For organisations wishing to establish an AI management system, prepare for the AI Act or document maturity in the responsible use of artificial intelligence, ISO 42001 is likely to become one of the most important standards in the years ahead.

We help organisations with advisory services, establishment and further development of AI management systems. Get in touch to find out how we can help you!

When the General Data Protection Regulation (GDPR) was introduced, virtually every organisation was affected. Many leaders are therefore asking whether the AI Act will have similar consequences. The answer is more nuanced.

The AI Act is built around a risk-based approach, where the requirements depend on how artificial intelligence is used and what consequences it may have for individuals and society. Two organisations can therefore use AI every day whilst facing entirely different regulatory requirements.

For most organisations, it is not the industry alone that determines how significantly they are affected by the AI Act. What matters is which AI systems are in use, which data they process, and whether they feed into decisions that affect individuals.

The AI Act distinguishes between different risk levels. Whilst certain types of AI are prohibited, the most stringent requirements will apply to what are known as high-risk systems.

This means that many organisations will be able to use generative AI tools without extensive new obligations, whilst others must establish documented processes for risk assessment, control and follow-up.

It is therefore misleading to ask whether an organisation is “covered by the AI Act”. Every organisation that uses AI will be affected to a greater or lesser degree. The key question is how significant the regulation will be for each individual organisation.

For many organisations, AI is used primarily as a tool that supports employees in their day-to-day work.

Examples include:

• Generating text drafts and content
• Summarising meetings and documents
• Coding assistance for developers
• Language support and translation
• Analysis of large volumes of information

In such cases, it is humans who make the decisions, whilst AI functions as a productivity tool.

Although these organisations should still maintain an overview of which AI solutions are in use, they will not normally face the most extensive requirements under the AI Act.

A different picture emerges when AI becomes an integrated part of operational processes.

In industry, energy, transport and offshore, artificial intelligence is increasingly used for analysis, optimisation and predictive maintenance. AI can help identify anomalies, predict failures or recommend actions based on large volumes of data.

In such cases, the primary challenge is not necessarily human rights or discrimination. Rather, the need for control over data quality, traceability and an understanding of how AI models influence the basis for decisions becomes more pressing.

Many organisations in these sectors will therefore find that the AI Act creates a need for better documentation and governance, even if the solutions are not necessarily classified as high-risk systems.

The most extensive requirements under the AI Act are linked to AI systems that can affect individuals’ rights, opportunities or access to essential services. This applies, amongst others, to solutions used in the following areas.

AI used to rank candidates, filter applications or make recommendations in recruitment processes may fall within the high-risk categories of the regulation.

AI solutions that affect the assessment of students or decisions about educational pathways may trigger stricter requirements.

AI used for diagnostics or clinical decision support is among the areas subject to significant regulation.

Municipalities, directorates and other public bodies must be particularly attentive if AI is involved in case processing or decisions that affect citizens.

In such cases, the AI Act sets requirements for, amongst other things, risk management, documentation, human oversight and ongoing follow-up.

For leaders, it is therefore more relevant to map the organisation’s AI portfolio than to attempt to determine whether the organisation “is covered by the AI Act”.

Two organisations in the same industry can have very different risk profiles.

A university using AI for administrative tasks faces different requirements from one using AI to assess students. In the same way, a municipality using generative AI for content production will have a different risk profile from one using AI in case processing or decision-making.

The first step towards AI Act readiness is therefore to establish an overview of which AI systems are in use within the organisation, which processes they form part of, and what the consequences could be if they produce incorrect results.

For many organisations, the AI Act will not entail extensive new requirements in the near term. Nevertheless, the regulation helps to make visible a need that already exists: the need for control over how artificial intelligence is used within the organisation.

Organisations that establish an early overview of their AI portfolio will be better placed to handle both regulatory requirements and the rapid development of artificial intelligence.

We help organisations with advisory services, establishment and further development of AI management systems. Get in touch to find out how we can help you!

Many organisations already have established risk management processes. They identify risks, assess likelihood and impact, implement actions and follow up through audits and management reviews.

But artificial intelligence challenges several of the assumptions that traditional risk management is built on.

It is precisely for this reason that ISO 42001 places such emphasis on AI risk management. The standard builds on familiar principles from management systems, but also acknowledges that AI introduces risk factors that many organisations have not previously had to manage.

Traditional IT systems generally do what they are programmed to do. If a rule or process is defined, the system will follow it.

AI systems work differently.

They are typically built on statistical models that learn patterns from large volumes of data. The result is that the outcome is not always as predictable as in traditional software. The system can produce different answers to the same question, change behaviour over time or draw conclusions that are difficult to explain fully.

This does not mean that AI is necessarily dangerous. But it does mean that the risk must be assessed differently.

When leaders think about technology risk, it tends to focus on availability, security and data protection.

For AI, these remain important, but the risk landscape is broader.

Organisations must also consider questions such as:

• Can the AI model produce incorrect or misleading responses?
• Can it introduce bias or discrimination?
• Could employees become overly reliant on AI-generated recommendations?
• Is it clear who is accountable when AI is used in decision-making processes?
• Can the system be used in ways it was not originally intended for?

These are risks that often affect people, business processes, reputation and regulatory compliance at least as much as the technology itself.

Another important difference is that AI risk is rarely static.

A machine on the factory floor works much the same way tomorrow as it did yesterday. Many AI solutions, on the other hand, evolve continuously.

Underlying data changes. Suppliers update models. New use cases emerge. Employees begin using tools in ways that differ from what was originally planned.

ISO 42001 therefore emphasises continuous monitoring and evaluation, not just a one-off assessment before the system is deployed.

Risk management becomes an ongoing activity.

A central principle in ISO 42001 is that risk lies not only in the technology, but in how the technology is used.

The same AI model can represent very different levels of risk depending on its purpose.

A chatbot that helps employees draft emails presents an entirely different risk profile from a system used as decision support in recruitment, credit assessment or healthcare.

This means that effective AI risk management requires the organisation to understand:

• Where AI is used
• Who is affected by its use
• Which decisions AI influences
• What the consequences of errors could be

This perspective runs throughout the whole of ISO 42001.

A recurring theme in the standard is the importance of human oversight.

Many organisations introduce AI to streamline work processes, but streamlining must not lead to accountability becoming unclear.

Leaders must be able to answer questions such as:

• Who owns the process?
• Who approves the results?
• Who is accountable if something goes wrong?

ISO 42001 therefore requires the organisation to define roles, responsibilities and decision-making authority in connection with the use of AI.

Technology can support people. It does not relieve the organisation of responsibility.

One of the most common mistakes organisations make is treating AI as a purely IT project.

ISO 42001 takes a different view.

The standard places AI within the organisation’s existing governance model. AI should be assessed in the same way as other matters that affect the organisation’s objectives, risk exposure, compliance and reputation.

An AI management system therefore often involves functions beyond IT alone:

• Leadership
• Professional departments
• Compliance and quality
• Data protection and information security
• HR
• Risk management

The goal is not to control the technology itself, but to govern how the organisation uses it.

For leaders already working with quality, internal control, information security or compliance, much of the thinking in ISO 42001 will feel familiar.

What is new is not necessarily the methodology.

What is new is that AI introduces risks that require different assessments from those applied to traditional systems and processes — and that systematic AI risk management therefore becomes a core competence for organisations in the years ahead.

Organisations that succeed with AI in the coming years will likely be those that manage to combine innovation with governance. Not because regulation demands it, but because trust, accountability and control become ever more important as artificial intelligence is adopted in business-critical processes.

We help organisations with advisory services, establishment and further development of AI management systems. Get in touch to find out how we can help you!

Many organisations have developed AI strategies in recent years. They have identified opportunities, defined ambitions and pointed to areas where artificial intelligence can create value. But a strategy alone does not govern the use of AI.

The question leaders should be asking is therefore not whether the organisation has an AI strategy. The question is whether the organisation has control over how AI is actually being used.

An AI strategy tends to be about where the organisation wants to go. AI governance is about how the organisation gets there in a safe, responsible and controlled manner.

In many organisations, AI adoption is happening far faster than the governance surrounding it. Employees are picking up new tools, departments are experimenting with their own solutions, and AI is gradually becoming part of work processes and the basis for decisions.

Often without leadership having full visibility.

If you are a leader, can you answer these questions:

• Which AI tools are being used in the organisation today?
• Which data is being shared with these solutions?
• Who is responsible for approving new AI tools?
• How is AI-generated content quality-assured?
• Which decisions are influenced by AI?
• How do you document your use of AI to customers, owners and authorities?

Many leaders find they do not have good answers to all of these questions.

That does not necessarily mean the organisation has a problem. But it may mean the organisation lacks governance.

AI governance is the framework that ensures AI is used in line with the organisation’s objectives, values, risk appetite and regulatory requirements.

It covers, amongst other things:

• roles and responsibilities
• guidelines for AI use
• risk assessments
• control over data and models
• documentation and traceability
• compliance with legislation and standards

In short: AI governance turns AI into a governed organisational capability, rather than simply a set of tools employees use on their own initiative.

With the EU AI Act, it is becoming increasingly difficult to treat AI as a purely technology initiative.

Organisations must be able to document how AI is used, which risks have been assessed and which control mechanisms are in place. For many, this will require far more than a strategy or a general AI policy. It requires governance.

Many organisations spend considerable time discussing what AI can do for them. Perhaps it is time to spend just as much time discussing how AI should be governed.

Because when AI becomes part of the organisation’s work processes and decisions, having a strategy is no longer enough. What you need is AI governance.

We help organisations with advisory services, establishment and further development of AI management systems. Get in touch to find out how we can help you!

As AI is adopted in an ever-growing number of work processes, the same question arises in many organisations: Who is actually responsible for AI?

Is it the IT department? HR? The quality manager? Senior leadership?

The challenge is that AI rarely fits neatly within a single department.

An AI tool can simultaneously affect data protection, information security, quality, work processes, customer handling and decision-making. This quickly makes it unclear who should own the risk, the guidelines and the follow-up.

Many organisations start by placing responsibility with IT. This is understandable, but often insufficient.

IT can take responsibility for the technology and security, but rarely has the position to assess how AI affects the professional areas that use it.

If HR uses AI in recruitment, HR must understand the risks and own the process. If the marketing team uses generative AI for content production, the marketing team must take responsibility for how the tool is used. If the finance department uses AI for analysis or decision support, they must own their part of the usage.

Just as departments own their own systems and work processes, they must also own the AI solutions they use.

Large organisations are now beginning to establish AI steering groups, AI governance functions and dedicated leads for coordinating AI work.

The goal is not necessarily to control all use of AI, but to create visibility and ensure the organisation has shared guidelines and risk assessments.

For smaller organisations, dedicated AI roles are rarely necessary. There it is often more realistic to distribute responsibility between leadership, IT, quality functions and the departments that actually use the technology.

One of the challenges many organisations are now discovering is that they do not have a full overview of how AI is being used internally.

EU AI Act sets out different requirements depending on how AI is used. Before an organisation can assess which requirements apply, it must first map which AI systems are actually in use.

This is difficult for one person to do alone.

To gain an overview, the organisation must involve multiple professional areas. Each department must contribute information about which tools are in use, what they are used for and which processes they form part of.

Many organisations are looking for one person who can own AI.

In practice, good AI governance is often less about finding a single accountable individual and more about establishing clear roles and responsibilities across the organisation.

Someone must coordinate the work. Leadership must own the governance. But those who use AI day to day must also own the risk and the responsibility for how the technology is used in their own processes.

It is only when these roles are clearly defined that the organisation gains the visibility and control that both leadership, ISO 42001 and the EU AI Act call for.

We help organisations with advisory services, establishment and further development of AI management systems. Get in touch to find out how we can help you!