An AIMS is a systematic way of governing artificial intelligence across an organization: who may approve a new AI use, how its risks and impacts are assessed, which controls apply, and how the whole arrangement is checked and improved. ISO/IEC 42001:2023 specifies the requirements for one.
It applies to users, not just builders
ISO/IEC 42001 is written for organizations that provide or use products or services built on AI. A company that only uses AI tools can implement an AIMS and be certified. The scope follows your role: a company using AI internally will have a lighter system than one developing AI products.
The same structure as other ISO management systems
An AIMS follows the same harmonized structure as an ISO 9001 quality management system or an ISO/IEC 27001 information security management system. That is why an organization that already holds one of those can extend it to cover AI rather than building a second system.
What makes it specific to AI
On top of the common structure, ISO/IEC 42001 adds an AI policy, AI risk assessment and treatment, AI system impact assessment, and 38 reference controls in Annex A across nine areas, from data for AI systems to third-party and customer relationships. Which controls apply is recorded in a Statement of Applicability.
What certification does not mean
An AIMS certificate shows that a management system meets ISO/IEC 42001. It is not legal compliance with any AI law, and it is not a statement that any individual AI system is accurate, fair or safe. See ISO 42001 and AI laws for how it relates to current regulation, and ISO 42001 consulting for how we build one.