What Is ISO/IEC 42001? The AI Management System Standard Explained
Short answer: ISO/IEC 42001:2023 is the international standard that specifies requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS). ISO describes it as the world's first AI management system standard.
What an AI management system is
An AIMS is the set of policies, objectives and processes an organization uses to govern how it develops, provides or uses AI systems. Think of it the way ISO/IEC 27001 works for information security: it is about how the organization runs, not about the math inside one model.
ISO/IEC 42001 is a management system standard. Implementing it means putting policies and procedures in place for the sound governance of AI, using the Plan-Do-Check-Act cycle.
Who it is for
Organizations of any size that develop, provide or use AI-based products or services. It applies across all industries, and it is relevant for public sector agencies as well as companies and non-profits.
What it helps you do
- Manage AI risks and opportunities with a structured framework
- Show that you use AI responsibly
- Build traceability, transparency and reliability into AI work
- Support compliance with legal and regulatory expectations
Key facts
- Full name: ISO/IEC 42001:2023, Information technology - Artificial intelligence - Management system
- Published: December 2023 (Edition 1)
- Length: 51 pages
- Committee: ISO/IEC JTC 1/SC 42
How it relates to NIST AI RMF
The NIST AI Risk Management Framework is a voluntary risk framework organized around four functions: Govern, Map, Measure and Manage. ISO/IEC 42001 is a certifiable management system standard. Many organizations use NIST AI RMF to structure how they assess AI risk, and ISO/IEC 42001 to run the management system around it. See NIST AI RMF explained.
Where to start
- Inventory the AI systems you build, buy and use
- Assign clear ownership for each one
- Write an AI policy and risk criteria
- Run a gap assessment against the standard's requirements
- Build the evidence trail: see the AI audit checklist
Source: ISO/IEC 42001:2023, iso.org
FAQ
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is an international standard that sets out requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS) inside an organization.
Who is ISO/IEC 42001 for?
Organizations of any size that develop, provide or use AI-based products or services, in any industry, including public sector agencies and non-profits.
Is ISO/IEC 42001 a technical standard for AI models?
No. It is a management system standard. It asks for policies, objectives, roles and processes for the responsible development, provision or use of AI, run on the Plan-Do-Check-Act cycle, rather than prescribing how a specific model is built.
When was ISO/IEC 42001 published?
Edition 1 was published in December 2023 by ISO/IEC JTC 1/SC 42.