What is it?
ISO/IEC 42001 (published Dec 2023) is the world's first certifiable AI management standard. It applies the familiar ISO management-system shape (plan-do-check-act) to AI development, deployment and use, with 38 Annex A controls covering policies, data, lifecycle, impact assessment and third-party AI.
Who should care?
Any organisation that builds AI products, integrates third-party AI into its services, or operates in jurisdictions that reference 42001 (the EU AI Act, NIST AI RMF, and Singapore's AI Verify all align). It is fast becoming the procurement-checkbox standard for vendors that ship AI features.
How is it structured?
- Clauses 4–10 — AIMS (scope, leadership, planning incl. AI risk, operations, evaluation, improvement).
- Annex A — 38 controls grouped: Policies for AI, Internal organisation, Resources for AI systems (data, tooling, computational resources, system & computing resources, human resources), Assessing AI system impact, AI system lifecycle, Data for AI systems, Information for interested parties, Use of AI systems, Third-party relationships.
- Annex B — implementation guidance; Annex C — AI-system objectives & risk sources; Annex D — domain mapping.
How it interlocks with ISO 27001 and ISO 27701
If you already operate an ISMS (27001) and PIMS (27701), 42001 extends — not replaces — them. Many controls are direct extensions: 42001 A.7 (Data for AI) leans on 27001 A.8 (asset management) and 27701 (privacy of personal data used as training data).
Certification
Some accreditation bodies (UKAS, ANAB) now accredit certification bodies for ISO 42001. Expect Stage 1 + Stage 2 audits like 27001, plus AI-specific evidence: model cards, impact assessments, training-data provenance, post-deployment monitoring.
How iCompaas helps
iCompaas ships AIMS templates for each Annex A control area: AI policy, AI risk register, AI impact assessment workflow, model card library, AI incident register, and procurement-due-diligence questionnaires for third-party AI vendors.