Standard

ISO/IEC 42001

ISO/IEC 42001 is the international management-system standard for artificial intelligence, published in December 2023. A management-system standard does not tell you which model to build; it tells you what processes, roles, controls, and evidence trails an organisation must have in place to run AI responsibly, and it expresses those requirements in a form a third party can audit. In shape, it is what ISO 27001 is for information security: the certifiable scaffolding around a discipline.
Reviewed by 7wData

Why it matters

The closest neighbour to ISO 42001 in the AI governance conversation is the NIST AI Risk Management Framework. The difference is the word certifiable. NIST RMF tells you WHAT a responsible AI program looks like; it is voluntary, descriptive, self-attested. ISO 42001 lets an accredited body AUDIT your program and CERTIFY that you actually do what you say you do. That distinction is starting to matter commercially: I am seeing procurement teams in regulated sectors (finance, health, public-sector suppliers) move ISO 42001 from “nice signal” to RFP tick-box, the same trajectory ISO 27001 followed a decade ago for security.

Where you’ll encounter it

Three contexts. First, a customer RFP starts asking whether you are ISO 42001 certified, aligned, or have a roadmap; the three answers are not the same. Second, the Big 4 consultancies and the established certification bodies (BSI, DNV, TÜV, LRQA) start selling readiness gap assessments against the standard’s clauses. Third, you face the internal call of whether to pursue full certification or simply align. The honest test: pursue certification only when a customer requires it, or when you are selling into procurement where the absence of the badge costs you the deal. Aligning buys most of the discipline at a fraction of the cost; certification buys the badge that closes the procurement loop.

Part of the 7wData AI Glossary. Tracking how concepts like this move in the expert conversation: daily signals at ins7ghts.com.