QULDEXResources · Glossary
ISO 42001 definition: the AI management system standard
What does ISO 42001 mean?
ISO 42001 treats AI as something to be managed like security or quality: with a scope, a policy, assigned responsibilities, assessed risks, chosen controls and regular review.
Two things set it apart from other management system standards: an assessment of the impact AI systems may have on individuals and society, and controls that follow an AI system through its life cycle.
What are the main parts of ISO 42001?
The same structure as other ISO management system standards.
38 controls covering policies, roles, resources, impact assessment, the AI life cycle, data and third parties.
An assessment of the consequences an AI system may have for individuals, groups and society.
What does the standard ask an organisation to do?
Typical activities in an AI management system.
| Activity | What it involves |
|---|---|
| Inventory | List the AI systems you develop, provide or use, and your role for each |
| Assess | AI risk assessment and AI system impact assessment |
| Control | Select controls and record them in a statement of applicability |
| Operate | Manage each system through design, deployment, monitoring and retirement |
| Check | Internal audit and management review |
This is an illustration written for this page, not a customer record.
ISO 42001: key facts
| Topic | Detail | Notes |
|---|---|---|
| Published | 2023 | ISO/IEC 42001:2023, the first edition. |
| Controls | 38 | In Annex A, with implementation guidance in Annex B. |
| Impact assessment | Clause 6.1.4 | AI system impact assessment is a requirement of planning. |
| Relationship to law | Supports, does not replace | It is a voluntary standard; laws such as the EU AI Act apply separately. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What do people get wrong about ISO 42001?
'It certifies our AI model'
It certifies the management system, not a product.
Instead: describe it as a management system certificate.
'It equals EU AI Act compliance'
The standard and the law are separate.
Instead: map the standard's controls to your legal obligations.
'Only AI developers need it'
It also applies to organisations that use AI systems.
Instead: identify your role for each system.
How does QULDEX handle this?
One control and one piece of evidence count towards every framework they apply to.
ISO 42001: common questions
What is an AIMS?
An artificial intelligence management system: the policies, processes, roles and controls an organisation uses to govern the AI systems it develops, provides or uses.
Is ISO 42001 certifiable?
Yes. An accredited certification body can audit the management system and issue a certificate.
Does ISO 42001 replace the EU AI Act?
No. The standard is voluntary and the Act is law. The standard can help organise the governance the Act expects.
AI governance audits alongside security and privacy
Controls, evidence, findings and corrective actions in one audit workspace.