ISO 42001: What Companies Need for AI Management Systems

← All Articles

ISO/IEC 42001: The Standard for AI Management

ISO 42001 is the first international standard for AI management systems (AIMS). In force since December 2023 — and increasingly a baseline requirement for tenders and customer requests.

What Does ISO 42001 Require?

Clause 4 — Context: Understanding the organisation and its use of AI.

Clause 5 — Leadership: Clear responsibilities for AI decisions at the leadership level.

Clause 6 — Planning: Risk assessment and opportunity analysis for AI systems.

Clause 7 — Support: Resources, competence (AI literacy!), documentation.

Clause 8 — Operation: AI system lifecycle, impact assessment.

Clause 9 — Performance: Monitoring, internal audits, management review.

Clause 10 — Improvement: Nonconformities, corrective actions.

What’s New Compared to ISO 27001?

ISO 42001 is deliberately modelled on ISO 27001 — many structures are identical. The difference: 42001 explicitly addresses the risks of AI decisions, bias, transparency, and human control.

IIO’s ISO 42001 Score

IIO measures its own ISO 42001 compliance score daily. Currently: 91/100 points (as of the automatic measurement).

AI governance package for your organisation →

What ISO 42001 Requires From Your Organisation

ISO 42001 is the first internationally recognised management system for AI. It follows the familiar Annex-SL structure (like ISO 27001, ISO 9001) — anyone who knows one of these systems will find their way around quickly.

The 10 clauses at a glance:

1. Scope — which AI systems are in scope?
2. Normative references — embedded standards
3. Terms and definitions — a common language for AI governance
4. Context — stakeholders, external/internal issues, AI policy
5. Leadership — management commitment, roles, responsibilities
6. Planning — risks, opportunities, AI objectives
7. Support — resources, competence, documentation
8. Operation — AI system lifecycle, impact assessment
9. Performance evaluation — monitoring, internal audits, management review
10. Improvement — corrective actions, continuous improvement

IIO’s Implementation Status

IIO was the first company in the DACH region to fully implement ISO 42001 with Governance-as-Code:

• 53 of 53 controls documented and embedded in workflows
• Quarterly management reviews triggered automatically
• Audit trail machine-readable for every control point

Current score: 82% (PASS threshold: 80%).

Certification or Self-Assessment?

For most SMEs, a structured self-assessment is sufficient to start. Formal certification by an accredited body is relevant for companies with high-risk AI or for public procurement processes.

IIO compliance status → EU AI Act overview →