A plain-language answer to the question every AI-governance conversation now starts with.
ISO/IEC 42001 is the international standard for an AI management system (AIMS) — a structured, auditable way for an organization to govern the artificial intelligence it develops, provides, or uses. Published by ISO and IEC in December 2023, it is the first AI standard an organization can be formally certified against, and it applies to any organization of any size in any sector.
It covers the management system, not the model. Rather than dictating how a specific algorithm must be built, ISO 42001 requires you to have a repeatable process for identifying AI risks and impacts, assigning accountability, applying controls across the AI lifecycle, monitoring performance, and improving over time. It is built on the same Plan-Do-Check-Act logic as other ISO management standards, which is what makes it certifiable and auditable.
A management system is the set of policies, roles, processes, and records an organization uses to consistently achieve an objective — in this case, trustworthy AI. The point is repeatability: instead of every team inventing its own approach to AI risk, the whole organization runs one defined process. That is the difference between a responsible-AI statement and a responsible-AI capability, a distinction we unpack in from principles to proof.
The standard explicitly recognizes different roles in the AI value chain — you might develop AI, provide it to others, or use third-party AI — and it scales to each. A startup deploying a single customer-facing model and a bank running hundreds of use cases both implement the same framework at proportionate depth. If your organization makes decisions with AI, sells software with AI in it, or depends on foundation models from a vendor, you are in scope.
It is not a certification of individual AI systems, and it does not certify that any given model is unbiased or safe. It certifies that your management system for AI meets a recognized standard. It is also not the same as personal certification: organizations are certified, while people earn professional credentials to build and audit those systems.
ISO 42001 in five points
Because it converts trust into evidence. A certificate from an accredited body lets a customer, regulator, or investor rely on an independent assessment instead of taking your governance claims on faith. As AI-specific regulation arrives — the EU AI Act, India's AI governance guidelines — a certified AIMS is the operating backbone that makes demonstrating compliance far cheaper than assembling it per regulator. For the full picture of how the standard is built and certified, start with our complete ISO 42001 guide.
It is a checklist-and-process standard for governing AI responsibly. It tells an organization what a good AI governance system must include and lets an independent auditor confirm the system is really working.
ISO/IEC 42001 is the standard's number, not an acronym. Its full title is "Information technology — Artificial intelligence — Management system." ISO is the International Organization for Standardization and IEC is the International Electrotechnical Commission.
ISO/IEC 42001:2023 was published on 18 December 2023 and is the first edition of the standard.
Both. The standard defines requirements for organizations that develop, provide, or use AI systems, and scales to each role.
Start here — what ISO 42001 is, what it requires, costs, and how to get certified.
The world's first certifiable AI management system standard — requirements, Annex A controls, certification, cost, training and India relevance.
The standard explained in plain language.
You're here
The clauses and Annex A controls ISO 42001 asks for.
The 38 AI controls across 9 objectives (A.2–A.10), and how you select which apply.
What ISO 42001 certification costs, including in India.
A step-by-step readiness checklist for certification.
The mandatory policies, procedures and records — and what a good ISO 42001 toolkit includes.
How the AI and information-security standards differ.
The certification process, step by step.
Courses and credentials for individuals.
The role that builds and runs the AIMS — course, exam and how it differs from Lead Auditor.
DPDP Act, MeitY guidelines and RBI FREE-AI, mapped to one AIMS.
A standard, a voluntary framework and a law — how they fit together.
How smaller AI companies scope, cost and pursue certification proportionately.
Who is certifying, why the list is growing, and how to verify a certificate.