ISO 42001 Explained: The AI Management System Standard (and How It Maps to the EU AI Act)

What is ISO 42001?

ISO/IEC 42001:2023 is an international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations.Published in December 2023, it is the world's first certifiable AI management system standard, designed for entities that provide or use AI-based products or services.

Unlike the EU AI Act (which is binding law with enforcement penalties) or the NIST AI Risk Management Framework (which is non-certifiable guidance), ISO 42001 is a voluntary, certifiable management-system standard. Organizations can choose to implement it, undergo a third-party audit by an accredited certification body, and receive formal certification as evidence of AI governance maturity. (Source: ISO/IEC 42001:2023, ISO.org)

The standard uses the ISO harmonized structure (also called Annex SL), which means it follows the same management-system framework as ISO 27001 (information security), ISO 9001 (quality management), and other ISO management standards. This makes it straightforward to integrate ISO 42001 into existing governance frameworks—an important consideration for B2B SaaS companies that already hold ISO 27001 or SOC 2 certifications.

Is ISO 42001 Mandatory?

No. ISO 42001 is a voluntary standard. Unlike the EU AI Act, ISO 42001 certification is optional. Article 50 transparency obligations apply from August 2, 2026. Under the May 7, 2026 political agreement on the AI Omnibus, rules for systems in certain high-risk areas are scheduled for December 2, 2027 and product-integrated high-risk rules for August 2, 2028; those revised high-risk dates are not dates in the original Regulation text and remain subject to completion of the legal adoption process. (Source: European Commission AI Act overview) Organizations pursue ISO 42001 for three main reasons:

• Enterprise customer requirements: Increasingly, large enterprises ask "Are you ISO 42001 certified?" in security reviews and RFPs, particularly for AI-enabled SaaS products. It's becoming a table-stakes requirement alongside SOC 2 Type II and ISO 27001.
• Regulatory preparation: While ISO 42001 certification does not automatically satisfy EU AI Act compliance, it covers much of the process work behind high-risk obligations and demonstrates governance maturity to regulators.
• Operational discipline: The standard forces structured thinking about AI risk, data provenance, human oversight, and lifecycle controls—governance practices that reduce technical debt and mitigate reputational risk.

However: ISO 42001 is nota harmonized standard under the EU AI Act. As of July 2026, it has not been cited in the EU Official Journal, which means certification does not grant presumption of conformity with AI Act requirements (unlike what happens with harmonized standards under other EU regulations). A separate European standard, EN 18286 ("Quality management system for EU AI Act regulatory purposes", developed by CEN-CENELEC JTC 21), has passed its formal vote and is expected to be published in 2026; once cited in the Official Journal, it will give providers of high-risk systems a presumption of conformity with Article 17's quality-management requirements. Until harmonized standards are cited in the Official Journal, ISO 42001 certification remains best practice rather than a legal shortcut.

Structure of ISO 42001: The Management-System Framework

ISO 42001 follows the ISO harmonized high-level structure (Annex SL), which divides the standard into two main components:

Clauses 4–10: The Management-System Scaffold

These clauses define the Plan-Do-Check-Actgovernance cycle common to all ISO management-system standards. If you've implemented ISO 27001 or ISO 9001, this structure will be immediately familiar:

• Clause 4 — Context of the Organization: Understand internal and external issues affecting your AI systems, identify interested parties (stakeholders), and define the scope of your AIMS.
• Clause 5 — Leadership: Demonstrate top management commitment, establish an AI policy, and assign organizational roles and responsibilities for AI governance.
• Clause 6 — Planning: Identify risks and opportunities, establish AI objectives, and plan how to achieve them.
• Clause 7 — Support: Provide resources (people, tools, infrastructure), ensure competence through training, maintain awareness, control documented information.
• Clause 8 — Operation: Plan and control operational processes for AI systems, implement the controls defined in Annex A.
• Clause 9 — Performance Evaluation: Monitor, measure, analyze, and evaluate the AIMS. Conduct internal audits and management reviews.
• Clause 10 — Improvement: Address nonconformities, take corrective action, and continually improve the AIMS.

For organizations already operating an ISO 27001 ISMS, these clauses can be integrated rather than duplicated. You don't need separate management reviews, separate internal audits, or separate policy frameworks—you extend your existing governance to cover AI-specific risks and controls.

Annex A: The 38 AI-Specific Controls

While Clauses 4–10 provide the management scaffolding, Annex A is where the AI-specific substance lives. It contains 38 reference controls grouped under nine control objectives (numbered A.2 through A.10 in the published standard). Each control states an outcome, not a prescription—organizations decide how to implement it based on their context, and auditors assess whether the implementation satisfies the objective.

The nine Annex A control-objective areas are:

Organizations document which Annex A controls are applicable to their context in a Statement of Applicability (SoA)—a living document that justifies inclusion or exclusion of each control. Not every control will apply to every organization; for example, a SaaS company that only deploys AI (rather than developing foundational models) might exclude certain A.6 lifecycle controls related to model training.

ISO 42001 vs EU AI Act: What's the Difference?

ISO 42001 is a voluntary, certifiable management-system standard; the EU AI Act is mandatory law with enforcement penalties. This is the most critical distinction—one is optional best practice, the other is binding regulation.

However, there is substantial overlap. ISO 42001 covers much of the process work behind EU AI Act high-risk obligations, particularly for risk management (Article 9), quality management (Article 17), technical documentation (Articles 11 & Annex IV), transparency to deployers (Article 13), and human oversight (Article 14). An organization with a functioning AIMS starts AI Act compliance with the governance structures, risk processes, and documentation habits already in place—the remaining work is largely system-specific rather than organizational.

But certification ≠ compliance. Key gaps remain:

• Conformity assessment procedures (Article 43): The AI Act requires specific conformity assessment routes (internal control or third-party notified body assessment) before placing high-risk systems on the market. ISO 42001 certification audits a management system, not individual AI systems.
• CE marking and EU declaration of conformity (Article 48): High-risk AI systems must carry CE marking. ISO 42001 has no equivalent product-marking requirement.
• EU database registration (Article 49): Providers of high-risk systems must register in the EU database before market placement. ISO 42001 has no registration obligation.
• Specific technical documentation requirements (Annex IV): The AI Act prescribes detailed documentation items (e.g., data governance measures per Article 10, specific accuracy/robustness metrics per Article 15). ISO 42001 Annex A control A.8 covers documentation broadly but does not mandate every Annex IV detail.
• Post-market surveillance and incident reporting: The AI Act imposes specific timelines and notification duties for serious incidents. ISO 42001 Clause 9 (performance evaluation) covers monitoring but not regulatory incident reporting.

The bottom line: ISO 42001 provides a strong operational foundation for AI governance, and organizations pursuing both can leverage shared work (risk assessments, documentation, policies). But you cannot substitute one for the other. Think of ISO 42001 as the governance backbone that makes AI Act compliance easier, not a shortcut that replaces it. (Sources: Regulation (EU) 2024/1689; practitioner analyses from compliance consultancies)

ISO 42001 ↔ EU AI Act Mapping Table: Which Controls Support Which Obligations

The table below maps key ISO 42001 clauses and Annex A controls to corresponding EU AI Act articles for high-risk systems. This is information gain—most ISO 42001 explainers skip the detailed mapping, leaving you to guess. Coverage assessments reflect substantive overlap in process requirements; they do not imply that ISO 42001 certification constitutes legal proof of AI Act compliance.

Practical takeaway: If your SaaS operates high-risk AI systems under the EU AI Act, use ISO 42001 as the governance backbone—implement Clauses 4–10 and applicable Annex A controls, then layer on AI Act-specific requirements (conformity assessment, CE marking, EU database registration, Annex IV documentation checklist) as additional work. This avoids duplicate risk assessments, duplicate policies, and duplicate audits.

Do You Actually Need ISO 42001? (The Honest Decision Guide)

ISO 42001 certification is a significant investment of time, money, and organizational attention. Before you commit, ask yourself: is this solving a real problem, or chasing a credential?

You probably need ISO 42001 if:

• Enterprise customers are asking for it in RFPs and security reviews. If you're seeing "Are you ISO 42001 certified?" alongside "Are you SOC 2 Type II?" in multiple vendor assessments, it's becoming table stakes for your market segment. Losing deals over the absence of certification is a clear signal.
• You're selling AI-enabled SaaS to regulated industries. Healthcare, financial services, government, and critical infrastructure buyers increasingly expect demonstrable AI governance. ISO 42001 provides third-party validation that your governance isn't just a Word document.
• You operate high-risk AI systems under the EU AI Act and want a compliance foundation. While certification doesn't equal AI Act compliance, it covers much of the process work behind high-risk obligations and demonstrates governance maturity to regulators and auditors.
• You already hold ISO 27001 and want to extend governance to AI systems. If you have an existing ISMS, the incremental effort to add ISO 42001 is markedly lower, and you gain a unified governance framework covering both information security and AI.
• You're preparing for procurement in markets that will likely mandate it. Some jurisdictions (EU member states, Singapore, Australia) are signaling that AI governance certifications may become procurement requirements for government contracts. Getting ahead of the curve builds competitive advantage.

You probably don't need ISO 42001 yet if:

• You're pre-revenue or early-stage with no enterprise pipeline. If you're still finding product-market fit and selling to SMBs or startups, ISO 42001 is premature. Focus on building product and getting customers; revisit when enterprise deals enter your pipeline.
• No customer or regulator is asking for it. Governance for governance's sake is expensive theater. If your security reviews don't mention ISO 42001, and you're not in a regulated industry, the ROI is unclear. Wait until there's a forcing function.
• You only use third-party AI APIs (OpenAI, Anthropic, etc.) without custom models or significant AI development. If your AI use is limited to deploying off-the-shelf foundation models via API, the governance overhead of ISO 42001 may exceed the risk. Focus on deployer obligations under the AI Act instead.
• Your team lacks governance maturity or bandwidth. ISO 42001 certification requires dedicated ownership, cross-functional coordination, and sustained effort over 6–12 months. If you don't have a compliance or security team with capacity, you'll struggle. Build foundational practices first (AI inventory, basic risk assessment, acceptable-use policy), then pursue certification when you have the organizational muscle.

The honest assessment:ISO 42001 is becoming an enterprise sales requirement for AI-enabled B2B SaaS, much like SOC 2 Type II became table stakes for cloud software a decade ago. If you're targeting mid-market or enterprise customers, budget for it in your compliance roadmap. If you're early-stage or SMB-focused, defer until customer demand or regulatory pressure forces the issue.

The ISO 42001 Certification Journey: Timeline, Phases, and What to Expect

Realistic timeline: 6–12 months from kickoff to certification for most mid-market SaaS companies.Organizations with existing ISO 27001 certification can accelerate to 4–6 months by leveraging shared governance structures. Here's what the journey looks like:

Phase 1: Gap Analysis and Planning (2–4 weeks)

Objective: Understand your current state of AI governance, identify gaps against ISO 42001 requirements, and build a roadmap.

• Conduct an AI system inventory (every AI component across your product and operations).
• Assess current governance maturity against Clauses 4–10 and Annex A controls.
• Identify quick wins (policies already in place, existing risk assessments) and significant gaps (missing impact assessments, inadequate documentation).
• Define certification scope (which AI systems, which business units, which geographies).
• Build a project plan with milestones, owners, and resource allocation.

Cost driver: Many organizations hire external consultants for gap analysis to get an objective baseline and avoid blind spots (see the cost breakdown below).

Phase 2: Documentation Development and Policy Creation (4–8 weeks)

Objective: Build the documented AIMS—policies, procedures, controls, and the Statement of Applicability (SoA).

• Develop or update the AI policy (Clause 5.2, Annex A.2).
• Document organizational roles and responsibilities for AI governance (Clause 5.3, Annex A.3).
• Create the Statement of Applicability: for each Annex A control, document whether it's included or excluded and justify the decision.
• Write procedures for key processes: AI impact assessment, AI system lifecycle management, data governance, incident response.
• Integrate with existing policies (information security, privacy, acceptable use) to avoid conflicts.

Cost driver: Internal staff time (legal, compliance, engineering, product) is the largest cost here. Some organizations engage consultants to draft baseline documents, which internal teams then customize.

Phase 3: Control Implementation and Risk Assessment (8–16 weeks)

Objective: Operationalize the controls—turn policies into working processes, gather evidence, conduct impact assessments.

• Conduct AI impact assessments for in-scope systems (Annex A.5).
• Implement data governance controls: data lineage tracking, quality checks, training/validation/test splits (Annex A.7).
• Deploy human oversight mechanisms: approval workflows, override controls, monitoring dashboards (Annex A.9).
• Establish vendor/supplier management for third-party AI components (Annex A.10).
• Collect evidence for each control: meeting minutes, risk registers, impact assessment reports, training records, system documentation.

Cost driver: Engineering and product time to implement technical controls (logging, monitoring, data lineage). GRC software or compliance automation tools can reduce evidence-collection overhead.

Phase 4: Internal Audit and Management Review (2–4 weeks)

Objective: Validate that the AIMS is operating effectively before the certification audit.

• Conduct internal audit: test a sample of controls, review evidence, identify nonconformities (Clause 9.2).
• Document findings and corrective actions.
• Hold a management review meeting: top management reviews AIMS performance, approves corrective actions, confirms commitment (Clause 9.3).
• Address any critical gaps before the certification body arrives.

Phase 5: Certification Audit — Stage 1 and Stage 2 (4–8 weeks)

Objective: Pass the two-stage certification audit conducted by an accredited certification body.

• Stage 1 (Documentation Review): The auditor reviews your AIMS documentation (policies, SoA, procedures) to confirm readiness for Stage 2. Typical duration: 1–2 days. Minor findings are common; major gaps may delay Stage 2.
• Stage 2 (Implementation Audit): The auditor visits (virtually or on-site) to test whether controls are operating as documented. They interview staff, review evidence (risk assessments, impact assessments, meeting minutes, logs), and verify compliance with Clauses 4–10 and applicable Annex A controls. Typical duration: 2–5 days depending on scope. Nonconformities must be addressed before certification is granted.

Cost driver: Certification body fees are billed by audit-day, so scope drives cost. Larger or multi-jurisdiction scopes cost more (see the cost breakdown below).

Post-Certification: Surveillance Audits

Certification is valid for three years, but you'll undergo annual surveillance audits (lighter-touch reviews to confirm the AIMS is maintained). Surveillance audit fees are typically 20–30% of the initial Stage 2 audit cost.

How Much Does ISO 42001 Certification Cost? (Realistic Budget Breakdown)

Published market estimates for mid-market SaaS companies (50–500 employees) commonly put total first-year costs at $30,000 to $80,000. Smaller organizations tend to land below that range; larger enterprises and multi-jurisdiction scopes can run several times higher. Treat every figure in this section as a market estimate, not a quote—actual costs depend on scope, certification body, and how much you outsource. Organizations with existing ISO 27001 certification typically spend substantially less through shared governance and integrated audits.

The cost breaks down into four buckets—and the largest cost driver is almost always internal staff time, not the auditor's invoice:

1. Certification Body Audit Fees: $8K–$20K

This is the external auditor's fee for Stage 1, Stage 2, and the first surveillance audit (if bundled). Fees are typically quoted per audit-day and vary by:

• Organization size: More employees = more interviews, more evidence = more audit days.
• Certification scope: Certifying a single AI product is cheaper than certifying all AI systems across a global organization.
• Geography: Multi-site or multi-country audits increase travel costs and complexity.
• Certification body reputation: Tier-1 bodies (BSI, TÜV, LRQA, DNV) charge premium rates but carry more market credibility.

Budget tip: Get quotes from 2–3 accredited certification bodies. Ask about integrated audit discounts if you already hold ISO 27001 or ISO 9001.

2. Gap Analysis and Consulting: $5K–$40K (Optional but Common)

Many organizations hire external consultants to:

• Conduct the initial gap analysis ($5K–$15K).
• Draft baseline policies and procedures ($10K–$25K).
• Provide pre-audit coaching to prepare for Stage 1 and Stage 2 ($5K–$15K).

Trade-off: Consultants accelerate the process and reduce internal staff burden, but at a cost. Organizations with strong internal compliance or security teams can manage the work internally and save significantly. However, first-time certification attempts without expert guidance often result in failed audits and longer timelines.

3. Internal Staff Time: The Largest (and Often Underestimated) Cost

Implementing an AIMS requires cross-functional effort from:

• Compliance / Security lead: Project owner, coordinates across teams, manages evidence collection. Expect 20–40% FTE allocation over 6–12 months.
• Engineering / Product: Implement technical controls (logging, data lineage, human oversight mechanisms). Expect 10–20% FTE from senior engineers.
• Legal / Privacy: Draft policies, review contractual terms with AI vendors. Expect 5–10% FTE.
• Executive sponsor: Management reviews, policy approvals, resource allocation. Expect 2–5% FTE.

Reality check:For a mid-market SaaS company, internal staff time often represents $20K–$50K+ in opportunity cost. This is why organizations with existing ISO 27001 save so much—they already have the governance muscle, and they're extending rather than building from scratch.

4. Tooling and Software: $2K–$15K/year (Optional)

GRC (Governance, Risk, and Compliance) platforms can automate evidence collection, track control implementation, and maintain the Statement of Applicability. Examples: Vanta, Secureframe, Drata (though as of mid-2026, not all support ISO 42001 natively—check current feature sets). Costs vary widely; some platforms charge per-user, others per-certification.

Budget tip:If you're already using a GRC tool for SOC 2 or ISO 27001, check if it supports ISO 42001. Incremental cost may be minimal.

Ongoing Costs: Annual Surveillance Audits

After initial certification, expect annual surveillance audits at approximately 20–30% of the Stage 2 audit fee (typically $2K–$6K/year for mid-market SaaS). Every three years, you'll undergo a full re-certification audit at a cost similar to the initial Stage 2.

ISO 42001 and ISO 27001: How They Work Together

ISO 42001 and ISO 27001 are complementary, not substitutes. ISO 27001 protects information assets through an Information Security Management System (ISMS); ISO 42001 governs AI systems through an AI Management System (AIMS). Both use the same harmonized management-system structure (Annex SL, Clauses 4–10), which means organizations can integrate them rather than run parallel governance frameworks.

What They Share: The Management-System Scaffold

Both standards require:

• Leadership commitment (Clause 5): Top management must demonstrate commitment, establish policy, and assign roles. One management commitment, two scopes.
• Risk management (Clause 6): Identify and address risks. ISO 27001 focuses on information security risks; ISO 42001 focuses on AI-related risks. Run integrated risk assessments.
• Internal audit (Clause 9.2): Conduct periodic audits to verify compliance. Run one internal audit program covering both standards, with separate control checklists per Annex A.
• Management review (Clause 9.3): Top management reviews system performance and approves improvements. Hold one management review meeting covering both ISMS and AIMS.

What They Don't Share: The Annex A Controls

While the management scaffolding is identical, the control catalogues are different:

• ISO 27001 Annex A: 93 information security controls (access control, cryptography, incident management, physical security, etc.).
• ISO 42001 Annex A: 38 AI-specific controls (AI policy, impact assessment, data provenance, AI lifecycle, human oversight, third-party AI management).

Practical implication: You maintain a unified Statement of Applicability that tags each control against ISO 27001, ISO 42001, or both. For example, data classification (ISO 27001 A.8.2) supports data governance for AI systems (ISO 42001 A.7). Incident response (ISO 27001 A.5.24) supports AI incident reporting. Supplier security (ISO 27001 A.5.19) supports third-party AI management (ISO 42001 A.10).

Two Implementation Approaches

Organizations with existing ISO 27001 certification typically choose one of two approaches:

1. Unified approach (recommended for most SaaS companies): Extend your existing ISMS to include AI-specific controls. You maintain one integrated management system, one SoA (with controls tagged to both standards), one internal audit plan, one management review. The certification body audits both standards in a single engagement (often at a discount). This produces less documentation overhead and is easier for small teams to operate.
2. Federated approach: Maintain separate ISMS and AIMS with a shared governance layer (same leadership, same risk register, same management review). Produce separate SoAs and run separate audit tracks. This is appropriate when the AI function is operationally distinct (e.g., an AI research team embedded in a larger company), or when the AI system is high-risk under the EU AI Act and the evidentiary burden justifies dedicated documentation.

Cost and Timeline Benefits of Integration

Organizations with existing ISO 27001 certification typically implement ISO 42001 substantially faster and cheaper than those starting from scratch—practitioner estimates commonly cite cost reductions of roughly half. Why?

• Governance structures already exist: policies, risk processes, internal audit programs, management review cadence.
• Staff are trained on management-system thinking and evidence collection.
• Certification bodies offer integrated audit discounts (one auditor, one visit, two certifications).
• You avoid duplicate documentation: one policy framework, one risk register, one audit plan.

Bottom line:If you hold ISO 27001, adding ISO 42001 is an incremental lift, not a ground-up rebuild. If you don't hold ISO 27001 but are considering both, pursue them together to maximize shared infrastructure.

ISO 42001 vs NIST AI RMF: Which Framework Should You Use?

The NIST AI Risk Management Framework and ISO 42001 address the same challenge—how to manage AI-related risks—but through different mechanisms:

• NIST AI RMF is guidance, not a standard. It provides a voluntary framework organized into four core functions (Govern, Map, Measure, Manage) with detailed subcategories and actions. It's designed for flexibility and can be implemented at any maturity level. However, it's not certifiable—there is no third-party audit or NIST AI RMF certificate. You can claim alignment, but you can't prove it through certification.
• ISO 42001 is a certifiable standard. It prescribes specific requirements (SHALL statements) for an AIMS, and organizations can undergo third-party audit to demonstrate conformance. Certification provides market credibility—enterprise customers can verify your governance maturity through an accredited certificate, not just a self-assessment.

Overlap:The NIST AI RMF Govern function and ISO 42001 Clauses 4–10 are highly aligned (both cover leadership, policy, risk management, resource allocation, performance evaluation). NIST's Map/Measure/Manage functions align with ISO 42001 Annex A controls (impact assessment, data governance, lifecycle management, monitoring). Organizations implementing ISO 42001 will satisfy most NIST AI RMF subcategories as a byproduct.

Practical decision:If you're primarily selling to U.S. federal government or heavily regulated U.S. industries, start with NIST AI RMF (it's referenced in Executive Orders and state legislation). If you're selling globally or to enterprises that require certifications, pursue ISO 42001. If you're doing both, implement ISO 42001 and map your controls to NIST AI RMF subcategories—you'll achieve dual coverage with one implementation effort.

Common Questions About ISO 42001

Does ISO 42001 certification make me AI Act compliant?

No. ISO 42001 is a voluntary management-system standard; the EU AI Act is binding law. Certification covers much of the process work behind high-risk obligations, particularly risk management (Article 9), quality management (Article 17), technical documentation (Articles 11 & Annex IV), transparency (Article 13), and human oversight (Article 14). However, key gaps remain: conformity assessment procedures (Article 43), CE marking (Article 48), EU database registration (Article 49), and specific technical documentation requirements (Annex IV). Use ISO 42001 as the governance backbone, then layer on AI Act-specific requirements.

Can I self-certify to ISO 42001?

No. ISO 42001 certification must be granted by an accredited third-party certification body (e.g., BSI, TÜV, LRQA, DNV). You cannot self-certify. However, you can self-declare conformance (implement the standard without formal certification), which is common for organizations building governance maturity before pursuing the expense of certification. Self-declaration provides internal discipline but no market credibility.

How often do I need to renew ISO 42001 certification?

Certification is valid for three years. During that period, you'll undergo annual surveillance audits (lighter-touch reviews to confirm the AIMS is maintained). After three years, you undergo a full re-certification audit. This is identical to the ISO 27001 renewal cycle.

Do I need a separate AIMS if I already have an ISMS (ISO 27001)?

Not necessarily. Most organizations integrate the AIMS into their existing ISMS—extending Clauses 4–10 to cover AI-specific risks and adding ISO 42001 Annex A controls to their unified SoA. This unified approach reduces documentation overhead, enables integrated audits, and is easier to operate. A separate AIMS is only necessary if your AI function is operationally distinct or if you need dedicated documentation for high-risk AI systems under the EU AI Act.

What if I only use third-party AI APIs like OpenAI or Anthropic?

ISO 42001 Annex A.10 (third-party and customer relationships) covers supplier management for AI components. If you only deploy third-party AI APIs (no custom model development), many Annex A.6 (lifecycle) and A.7 (data for AI systems) controls may not apply, and you document exclusions in your SoA. However, you still need governance for how you use third-party AI: impact assessments (A.5), human oversight (A.9), transparency to end users (A.8), and vendor risk management (A.10). Certification is achievable but may be overkill if your AI use is minimal—evaluate based on customer requirements.

Will ISO 42001 become a harmonized standard under the EU AI Act?

Possibly, but not yet.As of July 2026, ISO/IEC 42001:2023 has not been harmonized under the AI Act (i.e., it has not been listed in the EU Official Journal with a presumption of conformity). A separate European standard (EN 18286) is under development by CEN-CENELEC JTC 21 to fulfill the harmonized-standard role for AI management systems. It's possible that ISO 42001 will be recognized or harmonized in the future, but the timeline is uncertain. Until then, certification remains best practice, not a legal shortcut.

Next Steps: Building Your ISO 42001 Roadmap

If you've decided ISO 42001 certification is right for your organization, here's how to start:

1. Conduct an AI system inventory. Document every AI component across your product and operations—foundation model APIs, custom models, AI-driven features, internal AI tools. Use our free deployer assessment to classify systems under the EU AI Act risk tiers (the same inventory feeds ISO 42001 scoping).
2. Perform a gap analysis. Assess your current governance maturity against ISO 42001 Clauses 4–10 and Annex A controls. Identify existing policies, risk assessments, and documentation you can leverage. Identify significant gaps (missing impact assessments, inadequate data governance, no human oversight mechanisms). Consider hiring a consultant for an objective baseline.
3. Define certification scope. Which AI systems, business units, and geographies will be in scope? A narrower scope reduces cost and complexity but may limit market credibility. Discuss scope with potential certification bodies to understand audit effort.
4. Build a project plan and secure resources. Assign a project owner (compliance or security lead), allocate cross-functional staff time (engineering, legal, product), and budget for consulting and certification body fees. Realistic timeline: 6–12 months (4–6 if you hold ISO 27001).
5. If you hold ISO 27001, integrate rather than duplicate. Extend your existing ISMS to include AI-specific controls. Run unified audits, unified management reviews, and a unified SoA. This is the fastest, cheapest path to dual certification.
6. Select a certification body and schedule Stage 1. Get quotes from 2–3 accredited bodies (BSI, TÜV, LRQA, DNV). Ask about integrated audit discounts if you hold other ISO certifications. Schedule Stage 1 for when your documentation is complete but before full control implementation—this gives you early feedback.