ISO 42001
ISO/IEC 42001: Artificial Intelligence Management Systems
ISO/IEC 42001 is the first international standard for AI management systems. It certifies how an organization governs the AI it builds or uses.
Last verified Jul 17, 2026
Q&A
What is ISO 42001?
ISO/IEC 42001 is the first international standard for AI management systems. It certifies how an organization governs the AI it builds or uses.
Who needs ISO 42001?
Organizations that build, deploy, or significantly rely on AI systems and want independent assurance over their AI governance: AI-first product companies, enterprises adopting AI in regulated contexts, and vendors whose customers are beginning to ask how their AI is governed.
How long does ISO 42001 take?
Establishing an AIMS before a first certification audit typically takes six to twelve months depending on AI maturity, followed by the same three-year certification cycle with annual surveillance audits.
How much does a ISO 42001 audit cost?
Fees vary with scope and the number of AI systems governed, plus the internal effort to stand up the AIMS. Because the market is new, availability of accredited bodies can affect cost and lead time.
What does a ISO 42001 audit cover?
An accredited certification body audits your AI Management System against ISO/IEC 42001 and issues a certificate, with annual surveillance. It assesses governance and process, not the technical performance of individual models.
What it is
ISO/IEC 42001, published in December 2023, is the first international management-system standard for artificial intelligence. It certifies an AI Management System (AIMS): the governance an organization puts around how it develops, deploys, and monitors AI, including risk assessment, transparency, data governance, and human oversight.
Structurally it mirrors ISO 27001: an accredited certification body audits the AIMS and issues a certificate on a three-year cycle with annual surveillance. It is designed to sit alongside existing management systems rather than replace them.
As AI governance expectations rise, including under the EU AI Act, ISO 42001 is emerging as the practical way for organizations to demonstrate responsible AI management to customers and regulators. The certification ecosystem is still young, so accredited bodies and experienced auditors are fewer than for ISO 27001.
Organizations that build, deploy, or significantly rely on AI systems and want independent assurance over their AI governance: AI-first product companies, enterprises adopting AI in regulated contexts, and vendors whose customers are beginning to ask how their AI is governed.
An accredited certification body audits your AI Management System against ISO/IEC 42001 and issues a certificate, with annual surveillance. It assesses governance and process, not the technical performance of individual models.
Establishing an AIMS before a first certification audit typically takes six to twelve months depending on AI maturity, followed by the same three-year certification cycle with annual surveillance audits.
Fees vary with scope and the number of AI systems governed, plus the internal effort to stand up the AIMS. Because the market is new, availability of accredited bodies can affect cost and lead time.
Look for a certification body accredited to issue ISO 42001 certificates and auditors with genuine AI-governance experience. Because the standard is new, confirm the body's accreditation scope explicitly covers 42001 rather than only 27001.
Service pathways
Not every service under this framework is fully available today. Hover a pathway for context.
- EmergingAIMS certification auditISO 42001 is only accredited by a handful of certification bodies globally as of 2026. Expect limited scheduling flexibility and a smaller pool of qualified auditors than ISO 27001.
- AvailableReadiness assessment