ISO/IEC 42001:2023 is the first international standard for artificial intelligence management systems. It provides organizations that develop, provide or use AI systems with a structured and auditable model for the responsible management of artificial intelligence — with risk controls, transparency towards customers and regulators, and support for implementing and demonstrating part of the requirements of Regulation (EU) 2024/1689, the EU AI Act.
 
What is ISO/IEC 42001?
ISO/IEC 42001 was published in December 2023 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The standard specifies the requirements for establishing, implementing, maintaining and continually improving an artificial intelligence management system, or AI Management System – AIMS.
Just as ISO 9001 defines the framework for quality management, and ISO/IEC 27001 defines the framework for information security, ISO/IEC 42001 defines how an organization manages the entire life cycle of its AI systems: from planning and development, or supplier selection, through deployment and monitoring, to decommissioning.
Organizations can be certified against the standard — by undergoing an audit by an accredited certification body and obtaining an internationally recognized certificate.
 
Structure and main requirements of the standard
ISO/IEC 42001 follows the Harmonized Structure known from ISO 9001, ISO/IEC 27001 and ISO 45001 — clauses 4 to 10:

• Context of the organization (Clause 4) – determining the organization’s role with respect to AI systems, such as developing, providing, deploying or using AI systems, the interested parties and the scope of the AIMS;
• Leadership (Clause 5) – commitment of top management and an AI policy;
• Planning (Clause 6) – AI risk assessment, AI system impact assessment concerning individuals, groups and societies, and AI objectives;
• Support (Clause 7) – resources, competence of personnel, awareness and documented information;
• Operation (Clause 8) – operational control of the AI system life cycle and control of externally provided processes, products and services;
• Performance evaluation (Clause 9) – monitoring, internal audits and management review;
• Improvement (Clause 10) – nonconformities, corrective actions and continual improvement.

 
Annex A – controls for the responsible development and use of AI systems
Similarly to ISO/IEC 27001, the standard contains Annex A with reference controls — 38 controls in 9 groups — including:

• policies, roles and responsibilities related to AI;
• resources for AI systems – data, tools, computing resources, human resources and competence;
• assessment of impacts on individuals and society;
• life cycle management – system objectives, design, verification and validation, deployment, operation and monitoring;
• data management – quality, provenance and preparation of data for training and operational use;
• information for interested parties – transparency, user documentation, incident reporting;
• intended use and responsible use of AI systems;
• third-party relationships – suppliers and customers across the AI system life cycle.

The organization prepares a Statement of Applicability, in which it justifies which controls it applies — a mechanism well known to any organization with experience in ISO/IEC 27001.
 
Who is ISO/IEC 42001 applicable to?
The standard is applicable to any organization, regardless of size or sector, that develops, provides or uses AI systems. In practice, it is particularly relevant for:

• software and technology companies developing or integrating AI functionality into products and services;
• financial institutions and insurers – AI in credit scoring, risk assessment, fraud detection and customer service;
• organizations with high-risk AI systems under the EU AI Act – AI in recruitment and people management, education, critical infrastructure and access to essential services;
• public organizations and providers of public services;
• organizations certified to ISO/IEC 27001 that are extending their management system to cover risks related to artificial intelligence.

Important: if your employees use generative AI tools in their work, in many cases the organization may be considered a deployer of an AI system within the meaning of the EU AI Act.
 
ISO/IEC 42001 and the EU AI Act
Regulation (EU) 2024/1689, the EU AI Act, is the first comprehensive legal framework for artificial intelligence, with penalties of up to EUR 35 million or 7% of worldwide annual turnover. The obligations apply in stages:

The dates reflect the amendments adopted under the so-called Digital Omnibus for AI, finally approved by the Council of the EU on 29 June 2026; publication in the Official Journal of the EU is pending and does not change the dates above.
 
ISO/IEC 42001 does not replace the EU AI Act, but it provides one of the most structured practical approaches for managing, documenting and demonstrating compliance measures. The standard covers a substantial part of the Regulation’s requirements: risk management, data quality and data governance, human oversight, transparency, technical documentation, post-deployment monitoring and incident reporting. A certified AIMS can help demonstrate to regulators, customers and partners a systematic, traceable and audited approach to AI management.
 
ISO/IEC 42001 and ISO/IEC 27001
The two standards share a common structure and logic and are designed to work together:

• context, management of documented information, internal audits and management review are built upon, not duplicated;
• the risk assessment methodology is extended with AI-specific risks and with assessment of impacts on affected individuals;
• where AI systems process personal data, the AIMS is linked to GDPR processes, including the connection between the AI system impact assessment and the data protection impact assessment, or DPIA;
• an integrated ISO/IEC 27001 + ISO/IEC 42001 system is possible, with common processes and a combined certification audit — lower costs and less administrative burden.

For organizations with an existing ISO/IEC 27001 system, the path to ISO/IEC 42001 is significantly shorter.

Benefits of ISO/IEC 42001

• Regulatory readiness – systematic preparation for the EU AI Act instead of last-minute, campaign-style efforts;
• Managed risks – control over legal, reputational and operational risks: discriminatory outcomes, data leaks, incorrect automated decisions and uncontrolled “shadow AI” use;
• Competitive advantage – the certificate is increasingly appearing as a requirement in tenders and contracts with corporate customers, especially in the supply of software and services with an AI component;
• Trust – independent confirmation to customers, partners and regulators of the responsible use of AI;
• Clear internal rules – who may use AI tools in the organization, when and how.

 
Frequently asked questions about ISO/IEC 42001
 
Is certification to ISO/IEC 42001 mandatory?
No, the standard is voluntary. However, the EU AI Act creates mandatory requirements, and ISO/IEC 42001 is one of the most structured ways to implement and demonstrate them. The certificate is also increasingly required by corporate customers when selecting suppliers.
Does the standard apply if we only use ready-made AI tools and do not develop our own?
Yes. ISO/IEC 42001 is also applicable to organizations that only deploy and use third-party AI systems. The EU AI Act also imposes specific obligations on deployers, not only on providers.
What is the difference between ISO/IEC 42001 and the EU AI Act?
The EU AI Act is a binding regulation with legal force and sanctions; ISO/IEC 42001 is a voluntary management system standard. The Regulation states what is required, while the standard provides the framework for managing those requirements systematically and in an auditable way.
How long does implementation take?
Depending on the size of the organization and the number and complexity of the AI systems, usually between 3 and 8 months until readiness for a certification audit. Where an ISO/IEC 27001 system is already in place, the timeframe is significantly shorter.
Who issues the certificate?
Certification is carried out by an independent accredited certification body after an audit of the implemented system. CONSEJO prepares the organization for the audit and provides support throughout the entire procedure.
Have the EU AI Act deadlines been postponed?
Partially. The obligations for high-risk AI systems were postponed until 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems — finally approved by the Council of the EU on 29 June 2026. However, the requirements for AI literacy and prohibited practices have been in force since February 2025, and the transparency obligations apply from 2 August 2026.
 
How can CONSEJO help?
CONSEJO supports organizations throughout the entire path to ISO/IEC 42001 — using the methodology with which more than 1,000 of our clients have built their management systems:

• Implementation of the management system – gap analysis, development of documentation, training, internal audit and preparation for certification;
• AI literacy training under Article 4 of the EU AI Act – an obligation already in force for all organizations using AI;
• External AI Compliance Officer – subscription-based compliance support, following the model of our DPO service.

Contact us for a free initial consultation – we will discuss which AI systems your organization uses, what obligations apply to you and how ISO/IEC 42001 fits into your existing management systems.

Request a consultation | tel.: +359 2 408 5566 | email: office@consejo.bg
 
 

ISO/IEC 42001:2023 (BDS ISO/IEC 42001:2024) Information technology – Artificial intelligence – Management system