AI governance
ISO 42001
ISO/IEC 42001 (AI management system)
ISO/IEC 42001 is the international standard for an AI management system. We help you build the governance to develop and use AI responsibly, and prepare you for certification by an accredited body.
What ISO 42001 is
ISO/IEC 42001 is the first international standard for an artificial intelligence management system (AIMS). It gives organisations a structured way to govern the development, provision and use of AI, addressing risks and impacts that are specific to AI such as bias, transparency, safety and the ongoing management of AI systems through their lifecycle.
Like other ISO management system standards, it follows a familiar structure of context, leadership, planning, support, operation and improvement, and comes with annexes of controls and implementation guidance. Certification is awarded by an independent, accredited certification body following an audit. It complements, rather than replaces, your information security and privacy programmes.
The structure of the standard
Clause 4 · Context
You establish the scope of the AI management system and identify the internal and external issues and interested parties that shape how AI is governed.
Clause 5 · Leadership
Top management sets the AI policy, assigns responsibilities and commits to the responsible development and use of AI.
Clause 6 · Planning
You assess AI risks and impacts, set objectives and decide which Annex A controls apply and which are justified out.
Clause 7 · Support
You provide the resources, competence, awareness, communication and documented information the system needs to run.
Clause 8 · Operation
You put the AI risk and impact assessments into practice and control the AI systems across their lifecycle.
Clause 9 · Performance evaluation
You monitor, measure, audit internally and hold management reviews to confirm the system is working.
Clause 10 · Improvement
You act on nonconformities and drive continual improvement of the management system over time.
Annex A · AI management controls
A reference set of controls covering areas such as AI policies, resources, impact assessment, data for AI and lifecycle responsibilities, selected to match your risks.
Who needs it
- Organisations that build, deploy or rely on AI systems and want demonstrable governance over them
- Companies whose customers or regulators are starting to ask how AI risk is managed
- Teams that want a certifiable framework to underpin responsible AI claims
What you get
- A scoped AI management system with an AI system inventory
- AI risk and impact assessment processes and lifecycle controls
- Governance documentation and internal audit evidence
- Readiness and support through certification audit
Timelines depend on your scope, the number and nature of your AI systems, and your current governance. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
The current edition is ISO/IEC 42001:2023, published in December 2023 as the first management-system standard dedicated to artificial intelligence. It is new and stable, so there is no revision in force yet, though ISO management-system standards are reviewed periodically and supporting documents in the 42000 family continue to be developed. Because it follows the same high-level structure as standards like ISO/IEC 27001, an existing management system gives you a foundation to build the AIMS onto rather than starting from scratch.
What it costs
Two costs sit side by side here. tr3labs charges a scoped advisory and implementation fee, quoted up front once we understand your size, the number and nature of your AI systems and your current governance. Separately, the accredited certification body that audits and issues the ISO/IEC 42001 certificate charges on its own schedule, and that party is independent of us, because tr3labs is never the certifier or auditor. We scope the work with you rather than quote blind.
How tr3labs gets you there
Scope and gap assessment
We define the AIMS scope, inventory your AI systems and their risks, and measure your current governance against the standard and its controls.
Build the management system
We help you implement the AI governance, policies, risk and impact assessment processes, and lifecycle controls the standard expects, documented as a managed system.
Test and prove
We run internal audits and reviews, and bring our security testing to bear on the systems that host and serve your AI, so the controls are operating and evidenced.
Certification support
We prepare you for audit by your chosen accredited certification body and support you through to the certificate and the surveillance cycle that follows.
ISO/IEC 42001 vs the EU AI Act
Both deal with governing AI responsibly, so teams often assume meeting one satisfies the other.
| ISO/IEC 42001 | EU AI Act | |
|---|---|---|
| Covers | An AI management system for any organisation | AI systems placed on or used in the EU market |
| Who asks for it | Customers, partners and your own board | The regulator, as a legal obligation |
| Core idea | Certifiable standard of good governance | Risk-based law you must comply with |
| Audit model | Certificate from an accredited certification body | Conformity assessment for high-risk systems, plus enforcement |
| Reach | Voluntary, worldwide | Binding, with extraterritorial effect |
| Often held with | ISO/IEC 27001 and SOC 2 | Alongside a 42001 management system as a foundation |
ISO 42001 FAQ
- How much does ISO 42001 certification cost?
- Our scoped advisory and implementation fee is quoted up front once we understand the number and nature of your AI systems. Separately, the accredited certification body that audits and issues the certificate charges on its own schedule; tr3labs is never that certifier.
- How long does ISO 42001 take?
- It depends on your scope, the number and nature of your AI systems and your current governance. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- Who issues the ISO 42001 certificate?
- An independent certification body accredited for ISO/IEC 42001 issues the certificate following an audit. tr3labs prepares you, builds the AI management system and evidence, and supports you through the audit; we are not a certification body.
- How does ISO 42001 relate to ISO 27001?
- They share the same management system structure and work well together. ISO 27001 governs information security, while ISO 42001 governs AI specifically. If you already run an ISMS, much of that foundation carries across to your AI management system.
- Does ISO 42001 help with the EU AI Act?
- A well-run AI management system gives you much of the governance, risk assessment and documentation that regulations like the EU AI Act expect. It is not a substitute for meeting the law's specific obligations, but it is a strong foundation, and we align the two where both apply.
The services that get you there
Related standards
Related reading
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read