ISO/IEC 42001 — the AI management system standard, explained
Voluntary standard · reviewed 2026-10-14
ISO/IEC 42001:2023, published in December 2023, is the first international management-system standard for AI. It follows the familiar clause structure of ISO management standards: context (4), leadership and policy (5), planning including risk and impact assessment (6), support such as resources and competence (7), operation (8), performance evaluation including internal audit and management review (9), and improvement (10). Annex A lists reference controls covering the AI lifecycle, data management, transparency, third parties and more. ISO/IEC 23894:2023 provides AI-specific guidance on risk management that 42001 draws on.
The standard is voluntary. Certification is available only through accredited certification bodies after an audit; ISO itself does not certify and neither does any software product. Copies of the standard are licensed documents; we reference clause numbers and summarize, we do not reproduce the text.
How the platform maps
| Framework element | Where it lives in the workspace |
|---|---|
| Clause 5.2 AI policy | Organizational AI Governance Policy with approval history |
| Clause 6.1 risk and impact assessment | Organization and system assessments; risk register with acceptance records |
| Clause 7.2 competence | Training records as evidence |
| Clause 8 operation / Annex A lifecycle | Inventory lifecycle, change history, vendor reviews, agent permission matrix |
| Clause 9.3 management review | Management Review Summary document and Executive Governance Summary report |
| Clause 10 improvement | Incident register with review stage; reassessment tasks |
Generating documents mapped to ISO/IEC 42001 clauses does not earn certification. If certification is your goal, plan for an accredited audit and treat the platform as your evidence and workflow system.