Artificial Intelligence (AI) is everywhere these days. It has within a short period of time become a daily part of how we interact with the internet and in some cases work. I won’t deny that AI does have its benefits, however, can cause issues of concern when not used responsibly. ISO 42001 seeks to outline a framework for companies to implement to enable responsible use of AI and better AI governance.
In this article I seek to explain what an AI management system is, who can benefit from it and how to implement an AI management system. The ISO/IEC 42001 standard is built on the harmonized structure in alignment with other ISO standards making it easy to implement. It is also built on the plan-do-check-act framework. Thus, companies that are already certified to other ISO standards should find it easier to integrate the requirements of ISO/IEC 42001 into their existing management system.
What Is ISO/IEC 42001?
ISO/IEC 42001 is the first management system standard released by the International Organization for Standardization (ISO) in 2023. AI management systems enable organizations to responsibly integrate AI into what they do. Per ISO the standard is applicable to “organizations of all sizes and sectors that develop, provide, integrate, or use artificial intelligence (AI) systems”.
What does this mean in plain English, and should you consider applying it to your organization? What if your employees use a Large Language Model (LLM) such as ChatGPT or Claude in their daily work? If you answered yes, then the standard applies to your organization, and you can benefit from the controls outlined in the standard. These controls are based on best practices for AI governance. It also applies if you develop AI software, AI agents, integrate AI agents into what you provide as a service and more.
Certification to ISO 42001 does not imply that your product or tool is certified. Rather it is a certification of your management system and how you implement and manage the risks from the use, integration or building of AI within your organization.
Why AI Governance Matters Now
As companies integrate AI into what they do, the products they deliver or build LLMs there are many concerns. The primary concerns include accountability, data privacy and bias in the dataset. The internet is full of AI and Terminator memes. There is also news of AI hacking of networks and companies without initiation by a human. The impact of such unwanted actions can spell huge legal issues for companies and potentially impact to brand reputation.
With new technology comes new risks, many of which may be unknown at this point. ISO 42001, as with other ISO management system standards, is meant to be used as a preventative tool. The framework and controls identified in the standard allow organizations to take a proactive approach to managing risks from AI. Customers are already concerned with how they data may be compromised from the irresponsible use of AI with propriety information available to all when used, for example in LLMs.
Taking a proactive approach allows organizations to provide continued confidence to customers that they are caring for their data and information.
Key Requirements of ISO 42001
ISO/IEC 42001 requirements are captured in clauses 4 through 10 of the standard. As the standard is based on the Annex SL structure, users and implementers of the standard will find similarity with other standard in the clauses under 4, 5, 7, 9 and 10. The primary differences in clauses 6 and 8. Additionally there are 38 controls across 9 control objectives. As with ISO/IEC 27001, the controls are not mandatory and serve as a reference catalog. Organizations need to consider the applicability and justify inclusion or exclusion of the controls.
The structure of the standard follows the PDCA cycle with leadership first determining the business risks to the AI management system and identifying the scope of the system (Clause 4). Leadership then commits to supporting the system and enabling its success (Clause 5). This is done by identifying the policy and roles and responsibilities for success of the AI management system.
In clause 6 risks and opportunities are determined based on the needs of the interested parties and contextual risks identified in clause 4. Clause 7 asks the organization to provide the needed support and resources to enable successful implementation of the plan and continual improvement of the system. Clause 8 provides the framework for operational controls. Clause 9 the controls to enable performance evaluation of the system including checks via internal audits and reviews by the leadership. Clause 10 identifies improvement requirements including identifying and recording non-conformities and working to improve on them.
Who Needs ISO 42001 Certification?
While many organizations can apply ISO 42001, certification may be most valuable when independent assurance is needed. This may be driven by customer requests, purchase order requirements or contractual commitments. Sometimes it may be based on a decision by leadership to provide external evidence that the organization has established a formal approach to managing AI. The question is therefore not only whether an organization uses AI, but whether it needs to demonstrate that its approach has been independently audited.
An organization should consider certification where AI is important to its operations, forms part of a major customer offering or is likely to be reviewed during supplier approval. The business case may also be stronger when several departments share responsibility for AI and a consistent approach is needed across the organization. Certification is generally voluntary, but it can become a commercial requirement when customers include it in procurement criteria or contracts. Smaller organizations may choose to implement the standard first and pursue certification later when there is a clear customer, regulatory or market need.
ISO 42001 vs ISO 27001 vs ISO 9001
I did mention earlier in the article that ISO 42001 is built on the same harmonized structure other ISO management system standards such as ISO 9001 and ISO 27001. Often companies see additional management systems and additional certifications as a burden. This is myth however, as an integrated management system can help alleviate this. Companies choosing to implement the three standards above, could have an integrated policy, an integrates risk register, an integrated system for control of documented information and more.
The below table in brief outlines the similarities and differences:
| Clause | ISO 9001 | ISO 27001 | ISO 42001 |
| 4. Context | QMS scope | ISMS scope | AIMS scope, incl. AI role |
| 5. Leadership | Quality policy, customer focus | Security policy | AI policy |
| 6. Planning | Quality risks, objectives | Security risk assessment and treatment | AI risk assessment, AI impact assessment |
| 7. Support | Resources, competence, documents | Same | Same |
| 8. Operation | Product/service delivery | Risk treatment in operation | AI risk treatment, impact assessment |
| 9. Evaluation | Customer satisfaction, audit, review | Audit, review | Audit, review |
| 10. Improvement | Corrective action, continual improvement | Same | Same |
| Annex A | No controls | 93 controls | 38 controls |
Steps to Implement ISO 42001
As with any project, the first step should be the purpose. Begin by determining why your organization wants to implement ISO 42001 and what it expects the AI management system to achieve. From there, identify the scope by considering the departments, products, services and locations where AI is developed, provided or used. Everything withing scope will need to be controlled, and scope should not be sued to exclude that which you are responsible for. You should then create an AI inventory that identifies the AI systems in use, their purpose, the data involved, the responsible owners and the risks that may arise.
Next, conduct a gap analysis against clauses 4 through 10 and the applicable Annex A controls. The results will help you develop an implementation plan, assign responsibilities and prioritize actions. The organization should then complete its AI risk and impact assessments, decide how identified risks will be treated and implement the needed policies, procedures and controls. Employees must also be made aware of their responsibilities and provided with training appropriate to how they develop, manage or use AI.
Once the system has been implemented, allow time for records to be generated and for the controls to operate. Conduct an internal audit and management review to determine whether the AI management system is effective and ready for certification. Finally, select an accredited certification body. Any non-conformities identified must be corrected before certification can be granted.
In Conclusion
ISO/IEC 42001 provides organizations of all sizes with a practical framework for managing AI responsibly by addressing governance, risk, impact, accountability and continual improvement. Its harmonized structure makes it easier to integrate with standards such as ISO 9001 and ISO 27001, while certification can provide independent assurance where customers, contracts or market expectations require it.
Should AI management systems not be on your priority list for now, at a minimum set and implement an AI use policy for employees within your organization. The risks identified in this article are prevalent and action is needed now.
FAQs
How much does ISO 42001 certification cost?
The cost will depend on the size and complexity of your organization, the number of locations, the scope of the AI management system and how much work is needed before the certification audit.
How long does it take to implement ISO 42001?
There is no single timeline that applies to every organization. A smaller organization with an established ISO 9001 or ISO 27001 management system may be able to move more quickly, while an organization with several AI systems, locations or departments may need more time. QMII’s ISO 42001 training and consulting services can help your team understand the requirements, assign responsibilities and move from gap analysis to audit readiness.
Is ISO 42001 certification mandatory?
ISO 42001 certification is generally voluntary, but it may become a customer, procurement or contractual requirement. Even where certification is not yet a priority, implementing the standard can help an organization manage AI risks and demonstrate a responsible approach.
How does ISO 42001 relate to ISO 27001?
ISO 42001 focuses on the responsible management of AI, while ISO 27001 focuses on information security. The two standards share the harmonized management system structure and can be integrated. QMII can help organizations integrate ISO 42001 into an existing ISO 27001 or ISO 9001 management system rather than create a separate system.
__
About the Author
Julius DeSilva is CEO of QMII (Quality Management International, Inc.), with more than 25 years of experience in quality management systems, maritime safety and security, and information security. A former seagoing officer and Exemplar Global Certified Lead Auditor (ISO 9001, ISO 27001, ISO 50001, RC14001), he has trained over 1,500 professionals as lead auditors and led consulting and auditing engagements across manufacturing, government, maritime, and aerospace sectors. He holds an MBA from the Darden School of Business, University of Virginia, and is an Associate Fellow of the Nautical Institute.
