On this page
TL;DR
ISO/IEC 42001:2023 - Artificial Intelligence Management System (AIMS) - was published 2023-12-18 by the International Organization for Standardization and is now the de facto international management-system standard for AI. Certification is achieved through a Stage 1 (documentation review) and Stage 2 (implementation audit) by an accredited certification body (BSI, DNV, SGS, and others). A realistic timeline from kickoff to first certificate is 12 months for an organisation with an existing ISO 27001 management system, and 12 to 18 months for an organisation starting from scratch. Source: ISO/IEC 42001:2023, ISO/IEC 27001:2022, ISO/IEC 27006-1, ISO/IEC 23894:2023. Updated 2026-05-20.
What ISO/IEC 42001 actually is
ISO/IEC 42001:2023 is a Type-A management system standard for artificial intelligence, written in the same structure as ISO/IEC 27001 (information security) and ISO/IEC 9001 (quality). It uses the Annex SL "harmonised structure" - context of the organisation, leadership, planning, support, operation, performance evaluation, improvement - and adds Annex A controls specific to AI, including AI policy, internal organisation, resources for AI systems, assessing AI system impacts, AI life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships. The canonical reference is the ISO catalogue entry at iso.org/standard/81230.html.
The certification value proposition is that an accredited certification body audits the organisation's AI Management System (AIMS) against ISO/IEC 42001 and, on a successful Stage 2 audit, issues a certificate that the AIMS meets the standard. Certificates are valid for three years with annual surveillance audits and a recertification audit in year three. The companion document ISO/IEC 23894:2023 provides guidance on AI risk management and is referenced heavily throughout the 42001 controls.
The strategic takeaway: ISO/IEC 42001 is now the strongest single signal an organisation can show to enterprise customers, regulators, and partners that its AI programme is genuinely operationalised rather than aspirational. In 2026 the standard is being written into enterprise procurement questionnaires, third-party risk management programmes, and supplier code-of-conduct documents at scale. Vendors who certify in 2026 gain a substantial commercial moat that closes in 2027 and 2028 as the standard becomes table stakes.
ISO/IEC 42001 vs ISO/IEC 27001: overlap and differences
The two standards share the Annex SL harmonised structure, which means organisations with a working ISO 27001 management system can reuse roughly 60 to 70 percent of their existing artefacts when adding 42001. The reusable artefacts include the policy hierarchy, the risk management process, the internal audit programme, the management review cadence, the corrective action and continual improvement loop, and the document control system. The AI-specific deltas are concentrated in the Annex A controls (AI policy, AI impact assessment, AI lifecycle controls, data for AI systems) and in the risk treatment plan, which must address risks specific to AI (bias, explainability, model drift, training data provenance).
| Dimension | ISO/IEC 27001:2022 | ISO/IEC 42001:2023 |
|---|---|---|
| Subject of the management system | Information security | Artificial intelligence (development, provision, or use) |
| Annex A controls | 93 controls across 4 themes | 38+ controls organised by lifecycle and stakeholder lens |
| Risk methodology reference | ISO/IEC 27005 | ISO/IEC 23894 (AI risk management guidance) |
| Distinctive concept | Confidentiality, integrity, availability | AI lifecycle, AI impact assessment, AI system roles (provider, developer, deployer, user) |
| Certification mechanism | Accredited 3rd-party audit, 3-year cycle | Accredited 3rd-party audit, 3-year cycle (same model) |
| Maturity of certification ecosystem | Mature; thousands of certified organisations | Emerging; certificates began being issued in 2024 |
| Reuse from the other standard | Foundation for 42001 AIMS | ~60-70% of AIMS artefacts come from 27001 if 27001 is already in place |
The practical guidance: if you have a working ISO 27001 ISMS, the 42001 implementation is an addition rather than a parallel programme - extend the policy hierarchy, add AI-specific risk treatments, add the new Annex A controls, and re-scope internal audit and management review to cover AI. If you do not have ISO 27001, you have two options: stand up both together (more efficient long-term but more demanding short-term), or stand up 42001 alone and accept that the management-system foundations will not be reusable for other standards later.
The 12-month roadmap, phase by phase
The 12-month roadmap below assumes an organisation with an existing ISO 27001 management system or equivalent maturity. Organisations starting from scratch should add three to six months to the timeline. Phases are sized to be achievable by a single dedicated AIMS lead with cross-functional support from the AI Governance Committee.
Phase 1 (Months 1-3): Scoping, gap analysis, and AIMS foundation
The first three months establish the scope of the AIMS, complete a gap analysis against ISO/IEC 42001 Annex A, and stand up the foundational documents. The scoping decision is the single most consequential choice in the programme: scope too narrowly and the certificate has limited commercial value; scope too broadly and the implementation stalls under its own weight.
Concrete deliverables for Phase 1: a scoping memo naming the AI systems, business units, geographies, and customer segments in scope; a context-of-the-organisation analysis documenting interested parties, internal and external issues, and statutory and regulatory obligations; a gap analysis against each clause and Annex A control with a remediation owner and target date; an updated AI Acceptable Use Policy referencing 42001; the AIMS scope statement (this becomes the certificate scope and is what customers will read); and an AI Governance Committee charter naming the management representative for the AIMS.
Common Phase 1 pitfalls: scoping the AIMS only to in-house developed AI while customers care about the AI exposure inside vendor SaaS; treating gap analysis as a one-pass exercise rather than a living document; deferring the AI risk register to Phase 2 (the gap analysis already needs it). The risk register should land at the end of month three with the highest-impact AI risks and their treatment options documented.
Phase 2 (Months 4-6): Policy, risk management, and Annex A controls
Months four through six are the densest documentation phase. The policy hierarchy is finalised; the AI risk management process is operationalised; the AI impact assessment methodology is published; the Statement of Applicability (SoA) covering each Annex A control is drafted; and AI-specific operational procedures (model lifecycle, data lifecycle, third-party AI procurement) are stood up.
Concrete deliverables for Phase 2: an AI Policy (top-level), an AI Risk Management Procedure referencing ISO/IEC 23894, an AI Impact Assessment template and procedure, an AI System Inventory with risk tier and named owner per system, a Data for AI Systems Procedure covering training data and inference data lineage, an AI Lifecycle Procedure covering design through retirement, a Statement of Applicability with justification for every Annex A control, and a Third-Party AI Risk Procedure that integrates with the existing vendor risk programme.
This phase is where the NIST AI RMF crosswalk earns its keep. NIST AI 100-1 functions (GOVERN, MAP, MEASURE, MANAGE) overlap heavily with the 42001 Annex A controls. Organisations that have implemented the NIST AI RMF can typically reuse 70 percent of the artefacts directly, with relabelling and the addition of the management-system framing. See the NIST AI RMF hub for the Areebi crosswalk reference.
Phase 3 (Months 7-9): Operations, monitoring, and evidence generation
Phase 3 is where the AIMS moves from documentation to lived practice. The procedures from Phase 2 are executed; the monitoring and measurement programme begins producing data; the internal audit programme runs its first audit; and the AI Governance Committee starts its working cadence with documented decisions and minutes.
Concrete deliverables for Phase 3: AI impact assessments completed for every in-scope production AI system; the AI risk register populated with treatment status; monitoring dashboards capturing the AI control KPIs (policy violations, denied actions, near-misses, change frequency, training completion); the first internal audit report covering all clauses and a sample of Annex A controls; corrective actions raised and tracked for any non-conformities found; management review meeting one held with documented inputs (audit results, KPI trend, stakeholder feedback) and outputs (resource decisions, policy changes, improvement actions).
This phase is where most certification readiness gaps surface. A common failure mode is the documentation being beautiful and the evidence being thin - the auditor will ask "show me the last three impact assessments you completed" and "show me the management review minutes from the last quarter", and unconvincing answers in Phase 3 will become non-conformities in Stage 2. At Areebi, we use the audit log and policy engine to produce evidence as a byproduct of the platform operating, which removes the manual collection burden for many of the Annex A controls.
Phase 4 (Months 10-12): Stage 1 audit, remediation, and Stage 2 audit
The final three months are the certification audit itself. Stage 1 (typically months 10 and 11) is a documentation review by the certification body - the auditor evaluates whether the AIMS as documented is capable of meeting ISO/IEC 42001. Findings from Stage 1 are remediated, then Stage 2 (typically month 12) is the implementation audit - the auditor evaluates whether the AIMS as operated meets the standard.
Concrete deliverables for Phase 4: Stage 1 audit completed with findings documented; Stage 1 findings remediated with evidence of effective implementation; Stage 2 audit completed; non-conformities (if any) addressed with corrective action plans accepted by the certification body; the certificate issued; the certificate scope reviewed against the original scoping memo to confirm it is what was intended.
The Stage 2 audit typically lasts 5 to 10 working days on-site or hybrid depending on scope, with the auditor sampling Annex A controls and asking for objective evidence (records, logs, decisions, artefacts) that the controls are working. Realistic preparation for Stage 2 is a mock audit by an internal team or a separate consultant in month 11, with sufficient time before Stage 2 to remediate any findings. Vendors who try to fit Stage 1, remediation, and Stage 2 into a single month routinely slip - the certificate is worth more than the timeline.
Get your free AI Risk Score
Take our 2-minute assessment and get a personalised AI governance readiness report with specific recommendations for your organisation.
Start Free AssessmentChoosing a certification body
ISO/IEC 42001 certificates are issued by accredited certification bodies (CBs), not by ISO itself. CB accreditation is granted by national accreditation bodies that are members of the International Accreditation Forum (IAF), including ANAB (the ANSI National Accreditation Board, often paired with UL Solutions in the US), UKAS in the United Kingdom, DAkkS in Germany, and JAS-ANZ in Australia and New Zealand. As of 2026 the leading CBs offering accredited 42001 certification include BSI, DNV, SGS, Bureau Veritas, A-LIGN, Schellman, and TUV variants. The CB landscape is consolidating quickly and offerings vary by region.
The selection criteria most enterprises weigh: accreditation status with a recognised IAF member (an unaccredited certificate is materially less valuable in procurement); auditor depth in AI (an auditor with a long ISMS career but no AI exposure produces a less useful audit); industry experience (financial services and healthcare AI raise specific obligations the auditor should already understand); geographic footprint (multi-region audits require a CB that can resource them); and timing fit (some CBs have multi-month booking lead times in 2026).
Practical guidance: identify three candidate CBs in month 1, run accreditation and reference checks in month 2, and lock in the engagement in month 3 so the audit window in months 10-12 is reserved. CBs are not interchangeable late in the programme - changing CBs after Phase 2 typically forces a rework of the scope statement and Statement of Applicability to match the new CB's preferred conventions. For a broader compliance framing of how ISO 42001 sits alongside NIST AI RMF and the EU AI Act, see our AI compliance landscape piece.
ISO/IEC 42001 to NIST AI RMF crosswalk
The table below maps the 42001 clauses and Annex A control families to the NIST AI RMF functions and subcategories that overlap. Organisations implementing both frameworks (the increasingly common pattern in 2026) can use this crosswalk to point a single evidence artefact at both standards.
| ISO/IEC 42001 area | NIST AI RMF function | Areebi capability |
|---|---|---|
| Clause 5 Leadership; Annex A AI policy and internal organisation | GOVERN 1, GOVERN 2 | Policy engine and role-based access |
| Clause 6 Planning; Annex A risk and impact assessment | MAP 1, MAP 2, MAP 5 | AI Governance Assessment and inventory |
| Clause 7 Support; Annex A resources for AI systems | GOVERN 3, GOVERN 4 | Compliance dashboards and training analytics |
| Clause 8 Operation; Annex A AI lifecycle, data for AI systems | MEASURE 1-4, MANAGE 1-4 | Audit log, DLP, monitoring |
| Clause 9 Performance evaluation | MEASURE 1, MANAGE 4 | Dashboards and KPI feeds |
| Annex A third-party and customer relationships | GOVERN 6 | Vendor inventory and DLP at perimeter |
| Clause 10 Improvement | MANAGE 1, MANAGE 4 | Corrective action workflows and replay |
The strategic takeaway: a well-instrumented AI platform produces ISO/IEC 42001 evidence and NIST AI RMF evidence simultaneously. At Areebi, we built the audit log, policy engine, inventory, and dashboards specifically so that the same operational telemetry satisfies both frameworks (and the EU AI Act, the Colorado AI Act, and OMB M-24-10 as well) without doubling the compliance team's workload.
Common pitfalls in the 12-month run
Across the certifications we have observed in 2024 and 2025, three pitfalls show up repeatedly and each one is avoidable.
Pitfall 1: Scoping the AIMS too narrowly to make the timeline fit. The temptation is to scope only one or two AI products to keep the implementation manageable, then expand later. The procurement reality is that customers reading the certificate scope want it to cover the AI features they are buying, and a certificate that excludes the customer's use case is worth substantially less. Scope the AIMS to the AI surface area the certificate needs to mean something commercially, even if that adds three months to the timeline.
Pitfall 2: Documentation rich, evidence thin. The Stage 1 audit will accept beautifully written policies and procedures. The Stage 2 audit will not. Auditors sample controls and ask for objective evidence that the control has been operating consistently over time - typically the last three to six months. Programmes that defer the operational cycle (impact assessments completed, decisions logged, KPIs measured, internal audit run) to Phase 4 fail Stage 2 even though they pass Stage 1. The mitigation is to start the operational cycle in Phase 3 and to instrument the platform so that evidence is generated as a byproduct, not collected manually.
Pitfall 3: Choosing the wrong CB late in the programme. CB selection looks like a Phase 4 decision; it is actually a Phase 1 decision. The right CB knows the standard, has AI-experienced auditors, can resource the audit on the timeline you need, and has booked you in for Stage 1 and Stage 2 windows that match your readiness. Late CB selection produces compressed timelines, generalist auditors, and a fragile certificate scope. Lock the CB in the first quarter and treat the engagement letter as a Phase 1 deliverable.
What to read next
To go from this roadmap to an executable implementation plan, the cluster below is the next reading list.
- ISO 42001 Certification Guide - the practitioner-level companion piece covering requirements, timeline, cost, and the scoping decision in more depth.
- NIST AI RMF Implementation Guide - the operational playbook for the NIST framework that crosswalks cleanly to ISO/IEC 42001.
- NIST AI RMF GOVERN Function Deep Dive - the function that produces most of the ISO/IEC 42001 management system evidence as a side effect.
- AI Compliance Landscape 2026 - the cross-jurisdiction view of how ISO/IEC 42001 sits alongside the EU AI Act, FedRAMP, and state laws.
- FedRAMP 20x and AI Vendors - the federal-market companion piece covering the procurement overlay AI vendors need alongside ISO/IEC 42001.
Frequently Asked Questions
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is the international management system standard for artificial intelligence, published 2023-12-18 by the International Organization for Standardization. It defines requirements for an AI Management System (AIMS) and follows the same Annex SL harmonised structure as ISO/IEC 27001 (information security) and ISO/IEC 9001 (quality). Certificates are issued by accredited certification bodies on the back of a Stage 1 documentation audit and a Stage 2 implementation audit, valid for three years with annual surveillance.
How long does ISO/IEC 42001 certification take?
Twelve months is realistic for an organisation with an existing ISO 27001 management system or equivalent maturity. Organisations starting from scratch should plan for 12 to 18 months. Phase 1 (scope and gap analysis) takes about three months; Phase 2 (policy and risk management) about three months; Phase 3 (operations and monitoring) about three months; Phase 4 (Stage 1 audit, remediation, Stage 2 audit) about three months. Cutting the timeline shorter risks failing Stage 2, which is more expensive than running to schedule.
What is the difference between ISO/IEC 42001 and ISO/IEC 27001?
Both are Type-A management system standards using the Annex SL harmonised structure, which means policy, risk management, internal audit, and management review look very similar. 27001 covers information security with 93 Annex A controls; 42001 covers AI with a different Annex A set focused on AI policy, lifecycle, impact assessment, data for AI systems, and third-party relationships. Organisations with an existing 27001 ISMS can typically reuse 60 to 70 percent of their artefacts when adding 42001, but the AI-specific Annex A controls and the AI risk treatments are genuinely new work.
Do I need ISO/IEC 27001 before ISO/IEC 42001?
Not formally - 42001 is a standalone standard with no prerequisite. Practically, organisations with 27001 already in place find 42001 substantially easier because the management system foundations (policy hierarchy, risk methodology, internal audit, management review, document control) are reusable. Organisations without 27001 have two viable paths: stand up both standards together (more demanding short-term, more efficient long-term) or stand up 42001 alone and add 27001 later. Most mid-market enterprises already have or are pursuing 27001 anyway, so the question rarely matters in practice.
Who can issue an ISO/IEC 42001 certificate?
Certificates are issued by accredited certification bodies (CBs), not by ISO directly. Accreditation is granted by national accreditation bodies that are members of the International Accreditation Forum (IAF) - including ANAB / UL in the US, UKAS in the UK, DAkkS in Germany, and JAS-ANZ in Australia and New Zealand. As of 2026 the leading CBs offering accredited 42001 certification include BSI, DNV, SGS, Bureau Veritas, A-LIGN, Schellman, and TUV variants. Selecting a CB with current 42001 accreditation and AI-experienced auditors is the most important upstream choice in the programme.
How does ISO/IEC 42001 relate to the NIST AI RMF?
The NIST AI RMF (NIST AI 100-1, January 2023) and ISO/IEC 42001 (December 2023) were developed in parallel and are designed to be complementary. The four NIST RMF functions (GOVERN, MAP, MEASURE, MANAGE) crosswalk closely to the 42001 clauses and Annex A controls. Organisations implementing both frameworks (the increasingly common pattern in 2026) can use a single evidence pipeline that satisfies both. NIST AI RMF is voluntary in the United States; ISO/IEC 42001 certification provides the external assurance that many enterprise customers and regulators expect.
What does an ISO/IEC 42001 certificate cost?
Total cost varies widely by scope and organisation size. Direct certification body fees for a Stage 1 plus Stage 2 audit typically range from USD 30,000 to USD 150,000 plus annual surveillance audits. The larger cost is internal - the AIMS lead, the cross-functional implementation team, the technology investments to instrument controls and capture evidence, and the documentation effort. A realistic total cost for a mid-market enterprise running its first 42001 certification end-to-end is USD 250,000 to USD 750,000, with significant variation based on existing 27001 maturity and the breadth of the AIMS scope.
Related Resources
Stay ahead of AI governance
Weekly insights on enterprise AI security, compliance updates, and governance best practices.
Stay ahead of AI governance
Weekly insights on enterprise AI security, compliance updates, and best practices.
About the Author
Areebi Research
The Areebi research team combines hands-on enterprise security work with deep AI governance research. Our analysis is informed by primary sources (NIST, ISO, OECD, federal registers, IAPP) and the operational realities of CISOs running AI programs in regulated industries today.
Ready to govern your AI?
See how Areebi can help your organization adopt AI securely and compliantly.