ISO/IEC 42001 — Artificial Intelligence Management Systems (AIMS)
ISO 42001 consulting for companies that build or use AI.
Why this matters
Customers have started asking. Security questionnaires, supplier reviews and enterprise contracts now include questions about how you govern AI: which systems you use, who approved them, what data they see, and how you would know if one went wrong. A policy document answers some of that. A management system an independent auditor has certified answers it in a way procurement teams recognize.
ISO/IEC 42001, published in December 2023, is the international standard for that system, an AI management system, usually shortened to AIMS. It follows the same structure as ISO 9001 and ISO 27001 and adds what is specific to AI: an AI policy, AI risk assessment, an assessment of the impact your AI systems have on people, and 38 reference controls in Annex A covering everything from data for AI systems to your relationships with suppliers and customers.
It applies whether you build AI or only use it, and the scope follows your role. We work on-site across the Kansas City metro and in Wichita, and remotely with companies across the US. If certification is not yet worth it for you, or if what you need is legal advice on an AI regulation rather than a management system, we tell you in the first conversation.
What's included
A full engagement takes you from an AI inventory to an ISO/IEC 42001 certificate. Each part is also available on its own: an inventory and gap analysis, an internal audit, or certification audit support.
-
AI inventory and scoping
A list of the AI systems you build, sell and use, including the AI features inside software you already pay for. We establish your role for each one, whether you develop it, provide it to customers or use it internally, and set an AI management system scope your customers and certification body will recognize.
-
Gap analysis against ISO/IEC 42001
Two to four weeks against the full standard and its Annex A controls, starting from what you already do. If you hold ISO/IEC 27001 or ISO 9001, we start from that system. You finish with a prioritized plan, an honest effort estimate and a clear answer on whether certification is worth pursuing now.
-
AI risk assessment and AI system impact assessment
ISO/IEC 42001 asks for two different assessments: risks to your organization and its objectives, and impacts on the people and groups your AI systems affect. We build both into a repeatable method, drawing on the guidance in ISO/IEC 23894 and ISO/IEC 42005, so new AI uses are assessed before they go live rather than after a customer asks.
-
Annex A controls and the Statement of Applicability
Annex A lists 38 reference controls across nine areas, from AI policy and data for AI systems to third-party and customer relationships. We decide with you which apply and why, record that in a Statement of Applicability, and build controls that fit how your teams already work.
-
Internal audit and management review
An internal audit against ISO/IEC 42001 before the certification body arrives, led by an ISO/IEC 42001 lead auditor, and a management review that produces decisions. Both feed an action register, so findings are closed before Stage 1. Also available on its own, every year.
-
Certification body liaison and audit support
Help comparing accredited certification bodies, preparation for Stage 1 and Stage 2, support through findings, and maintenance through surveillance. The choice of certification body is always yours.
How we work
The timeline depends mostly on how much AI you use and what you already have. Extending a working ISO 27001 or ISO 9001 system is the shortest route.
- 01
Inventory and gap analysis (2–4 weeks)
Your AI systems, your role for each, the scope, and a clause-by-clause comparison against ISO/IEC 42001 and its Annex A. Output: a prioritized plan, an honest effort estimate, and a recommendation on whether to certify or to adopt the standard internally first.
- 02
Build and implement
AI policy, roles, risk and impact assessment methods, the Statement of Applicability and the controls behind it, built into your existing system where you have one. Training for the people who will run it, then an internal audit and management review.
- 03
Certify
Stage 1 and Stage 2 audits by an accredited certification body. Findings addressed with corrective action that holds. Certification runs on a three-year cycle with annual surveillance audits.
- 04
Sustain
New AI uses assessed as they arrive, annual internal audits, surveillance audit preparation, and updates as customer requirements and AI rules change.
Where ISO/IEC 42001 fits among AI rules and frameworks
ISO/IEC 42001 is one piece of a fast-moving picture. Knowing what certification does and does not cover is part of scoping the work correctly.
ISO/IEC 27001
The closest relative. Both standards share the same management system structure, and many AI controls lean on information security controls you may already run. ISO/IEC 42001 does not require ISO/IEC 27001, but companies that hold it have a real head start. See our ISO 27001 consulting.
NIST AI Risk Management Framework
The US government's voluntary framework for AI risk, released in January 2023 and, according to NIST, now being revised. It is a framework, not a certifiable standard. Many companies use the NIST AI RMF to structure their thinking and ISO/IEC 42001 to build a system an auditor can certify. The two work well together; our comparison explains how.
EU AI Act
The European Union's AI regulation. Its obligations for high-risk AI systems were pushed back in 2026 and now start on December 2, 2027, for the uses listed in the Act's Annex III, and August 2, 2028, for AI in regulated products. ISO/IEC 42001 is not a harmonized standard under the Act, so certification does not by itself show compliance with it. It does give you much of the management structure the Act expects. If you sell AI into the EU, treat the Act as a legal question for counsel and the standard as the system that supports the answer.
US state AI laws
Changing quickly. Texas's AI law, in force since January 1, 2026, protects a business from liability in some cases if it finds a violation itself, for example through internal review or testing, and substantially complies with NIST's AI framework or another nationally or internationally recognized AI risk management framework. Colorado's 2024 AI Act, which named ISO/IEC 42001, was repealed and replaced in May 2026 by a narrower law taking effect January 1, 2027. We track what the rules say now, not what they said when the first articles were written, and we do not give legal advice. Our dated summary of each rule is here.
ISO/IEC 42005 and ISO/IEC 23894
Two guidance standards in the same family. ISO/IEC 42005 (2025) explains how to carry out an AI system impact assessment; ISO/IEC 23894 (2023) gives guidance on AI risk management. Neither is certifiable, and both make the ISO/IEC 42001 assessments easier to do well.
ISO/IEC 42006
Published in July 2025, it sets the additional requirements for bodies that audit and certify AI management systems. It is the reason to choose an accredited certification body: their auditors have to show AI competence, not just management system experience.
ISO 9001 and quality processes
If AI now inspects parts, schedules production or screens suppliers, it is part of how you control quality. ISO/IEC 42001 gives those uses an owner, a risk assessment and a record, and it integrates with an existing ISO 9001 system.
Who we serve
ISO/IEC 42001 is relevant wherever AI touches your products, your operations or your customers' data. The companies we build for include:
- Software and SaaS companies adding AI features to their products
- Companies answering AI questions in customer security reviews and questionnaires
- Manufacturers using AI for inspection, predictive maintenance or scheduling
- Professional services firms using generative AI with client information
- Healthcare, life sciences and medical device suppliers using or building AI
- AI startups selling into enterprise customers
- ISO 27001- or ISO 9001-certified companies extending their system to AI
Frequently asked
Common questions about ISO/IEC 42001
Is it ISO 42001 or ISO/IEC 42001?
Both refer to the same standard. The official designation is ISO/IEC 42001:2023, because it was developed jointly by ISO and the International Electrotechnical Commission (IEC) through their shared committee on artificial intelligence. Most people say and search for "ISO 42001", and that is fine. Your certificate will carry the full designation.
We only use AI tools; we do not build AI. Does ISO/IEC 42001 apply to us?
It can. The standard is written for organizations that provide or use products or services built on AI, so a company that only uses AI tools can implement it and be certified. The scope is set by your role: a company that uses AI internally will have a lighter system than one that develops AI products. The useful first step is an inventory, because most companies use more AI than they think, much of it inside software they already pay for.
Does ISO/IEC 42001 certification make us compliant with the EU AI Act?
No, and you should be wary of anyone who says it does. ISO/IEC 42001 is not a harmonized standard under the EU AI Act, so certification does not create a presumption of conformity with the Act. It does build much of the management structure the Act expects, such as risk management, documentation and oversight. Legal compliance is a question for your counsel; we build the system that supports their answer.
What does an ISO/IEC 42001 system actually produce?
A defined scope and an inventory of the AI systems in it; an AI policy and AI objectives; roles and responsibilities; a method and results for AI risk assessment and treatment; AI system impact assessments; a Statement of Applicability covering the Annex A controls; evidence of competence and awareness; and the internal audit, management review and corrective action records every management system standard expects. Most of it should be short and practical. If your team cannot use a document, it is the wrong document.
Do we need ISO 27001 first?
No. ISO/IEC 42001 can be implemented and certified on its own. If you already hold ISO 27001, you have the management system structure and many supporting controls in place, and the two can run as one integrated system with one internal audit program and one management review.
How is ISO/IEC 42001 different from the NIST AI Risk Management Framework?
The NIST AI RMF is a voluntary US framework that helps you think through AI risk. ISO/IEC 42001 is an international standard with requirements an auditor can certify. They are complementary: many companies use NIST's framework for vocabulary and risk thinking, and ISO/IEC 42001 for the system that proves it to customers. Texas's AI law also gives some protection from liability to businesses that substantially comply with NIST's AI framework or another recognized AI risk management framework.
Who certifies us, and how do we choose?
An accredited certification body. In the US, ANAB has accredited certification bodies for ISO/IEC 42001 since 2024, and ISO/IEC 42006 now sets extra competence requirements for the bodies and auditors that certify AI management systems. Ask a prospective certification body which accreditation covers its ISO/IEC 42001 certificates, and check it in ANAB's directory of accredited management systems certification bodies. We help you compare them; the choice is yours.
Can you run our ISO/IEC 42001 internal audits?
Yes. We run internal audits against ISO/IEC 42001 as a standalone service, led by an ISO/IEC 42001 lead auditor, and can combine them with your ISO 27001 or ISO 9001 internal audits so your teams are audited once rather than twice.
How long does it take, and what does it cost?
Both depend mostly on how much AI you use and what system you already have. A company extending a working ISO 27001 system is on the shortest route; a company with many AI products and no management system takes longer. The gap analysis gives you a real scope and timeline before you commit to anything more. We do not publish rate cards because they would mislead more than they would inform.
Other standards we cover
Related management systems
Ready to scope your ISO/IEC 42001 engagement?
Send a short note describing your current state, your target, and your timeline. We respond within one business day with clarifying questions and a path to a no-pressure scope call.
Last reviewed October 2026