What ISO 42001 is
ISO/IEC 42001:2023 is the first international management system standard for artificial intelligence. It sets requirements for an AI Management System (AIMS) covering how an organisation develops, provides or uses AI responsibly.
How it relates to ISO 27001
It follows the same management-system structure as ISO 27001 — scope, leadership, risk, controls, internal audit, continual improvement — so organisations already certified to ISO 27001 can extend their existing system rather than start again.
What it asks you to put in place
- An AI policy and defined roles and responsibilities
- AI risk assessment and AI system impact assessment
- Controls across the AI lifecycle — data quality, transparency, human oversight, monitoring
- Management of third-party and supplier AI
- Records showing the controls operate over time
Certification
As with ISO 27001, an accredited certification body audits in two stages, followed by annual surveillance audits over a three-year cycle.
How muVerity helps
We scope the AIMS, run AI impact assessments, write the policy set and help integrate it with an existing ISO 27001 system. AuditLance was designed with ISO 42001 evidence tracking in mind.