Regulations International (voluntary standard)
ISO/IEC 42001 AI management system standard
A voluntary, certifiable standard that sets requirements for establishing, running, and improving an AI management system.
Applies to: Organizations of any size that develop, provide, or use AI-based products or services. Adoption and certification are voluntary.
Status: Voluntary framework
Verified Oct 17, 2026.
Not legal advice. ISO/IEC 42001 is a voluntary international standard, not a law. This page summarizes the ISO catalogue page as checked on October 17, 2026. Verified Oct 2026.
What it is
ISO/IEC 42001:2023 is the international standard for an artificial intelligence management system (AIMS). ISO’s page says it “specifies requirements for establishing, implementing, maintaining, and continually improving” an AI management system. ISO calls it a management system standard, run with the Plan-Do-Check-Act method. It deals with how an organization governs AI across the board, not with the technical details of individual AI applications. It was developed by the joint ISO and IEC committee for AI (ISO/IEC JTC 1/SC 42).
ISO lists related AI standards: ISO/IEC 22989 (terminology), ISO/IEC 23053 (a framework for machine-learning systems), and ISO/IEC 23894 (AI risk management guidance).
Who it applies to
ISO says the standard is for “organizations of any size involved in developing, providing, or using AI-based products or services,” in any industry, including public-sector agencies and non-profits. No law cited on this site requires it. Organizations can choose to certify against it.
Key dates
- December 18, 2023: ISO/IEC 42001:2023, Edition 1, published (ISO life-cycle record, stage 60.60).
- As of October 17, 2026: ISO lists Edition 1 as the current published version. Its page shows no newer edition.
What security teams should do
These are our suggestions, not requirements of the standard.
- Decide where the AI management system sits. If you already run an ISO/IEC 27001 information security management system, look at extending the same governance, internal audit, and management review cycle to cover AI rather than building a separate one.
- Use it as evidence. A documented AI management system can support answers to regulators, auditors, and customers about how AI risk is governed. Map its controls to whichever laws apply to you.
- Ask suppliers about it. In AI vendor reviews, ask whether the supplier has an AI management system and whether it is certified, and check the certificate’s scope.
- Read it alongside AI risk guidance. ISO points to ISO/IEC 23894 for AI risk management guidance.
This page is general information, not legal advice. Verified Oct 2026 against ISO’s catalogue page for the standard.