# ISO/IEC 42001 — overview

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_overview_iso42001-isoiec-42001-overview
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [ISO/IEC 42001 (AI Management System)](https://support.icompaas.com/support/solutions/c_gen_iso42001) › [Overview](https://support.icompaas.com/support/solutions/folders/f_gen_cgeniso42001_overview)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

ISO/IEC 42001 · 38 Annex A controls for AI lifecycle governance

### What is it?

**ISO/IEC 42001** (published Dec 2023) is the world's first **certifiable AI management standard**. It applies the familiar ISO management-system shape (plan-do-check-act) to AI development, deployment and use, with **38 Annex A controls** covering policies, data, lifecycle, impact assessment and third-party AI.

### Who should care?

Any organisation that _builds_ AI products, _integrates_ third-party AI into its services, or operates in jurisdictions that reference 42001 (the EU AI Act, NIST AI RMF, and Singapore's AI Verify all align). It is fast becoming the procurement-checkbox standard for vendors that ship AI features.

### How is it structured?

-   **Clauses 4–10** — AIMS (scope, leadership, planning incl. AI risk, operations, evaluation, improvement).
-   **Annex A** — 38 controls grouped: _Policies for AI_, _Internal organisation_, _Resources for AI systems_ (data, tooling, computational resources, system & computing resources, human resources), _Assessing AI system impact_, _AI system lifecycle_, _Data for AI systems_, _Information for interested parties_, _Use of AI systems_, _Third-party relationships_.
-   **Annex B** — implementation guidance; **Annex C** — AI-system objectives & risk sources; **Annex D** — domain mapping.

### How it interlocks with ISO 27001 and ISO 27701

If you already operate an ISMS (27001) and PIMS (27701), 42001 extends — not replaces — them. Many controls are direct extensions: 42001 A.7 (Data for AI) leans on 27001 A.8 (asset management) and 27701 (privacy of personal data used as training data).

### Certification

Some accreditation bodies (UKAS, ANAB) now accredit certification bodies for ISO 42001. Expect Stage 1 + Stage 2 audits like 27001, plus AI-specific evidence: model cards, impact assessments, training-data provenance, post-deployment monitoring.

### How iCompaas helps

iCompaas ships AIMS templates for each Annex A control area: AI policy, AI risk register, AI impact assessment workflow, model card library, AI incident register, and procurement-due-diligence questionnaires for third-party AI vendors.