ISO/IEC 42001 · AI management system
ISO 42001 software for your AI management system.
ISO 42001 is the international standard for managing AI responsibly. With Basenorm you set up, run and evidence your AI management system, on the same control library as your ISO 27001.
Hosted in the Netherlands. Your data stays in the EU.The standard in brief
- Published
- 2023By ISO and IEC
- Type
- Management system standardCertifiable by an accredited body
- Structure
- Clauses 4 to 10The same structure as ISO 27001
- Annex A
- Controls for AISelected for your scope and risks
01 / The requirements
What ISO 42001
asks of you.
ISO 42001 sets requirements for an AI management system: policy, roles, risk and impact assessment, and controls across the life cycle of your AI systems. It applies whether you develop, provide or use AI.
- Clause 4Context of the organisation
Determine your role as developer, provider or user of AI, and the scope of your AI systems.
- Clause 5Leadership
Set an AI policy and assign roles, responsibilities and authorities.
- Clause 6Planning
Assess AI risks and the impact on people, and set objectives.
- Clause 7Support
Arrange resources, competence, awareness and documented information.
- Clause 8Operation
Carry out risk treatment and AI system impact assessments in daily practice.
- Clause 9Performance evaluation
Monitor and measure, run internal audits and hold management reviews.
- Clause 10Improvement
Handle nonconformities and keep improving.
The clause titles follow the harmonised structure that ISO 27001 also uses.
02 / Annex A
The AI controls
in Annex A.
Annex A lists controls for AI. You select the controls that fit your scope and risks, and record your choices in a statement of applicability. Annex B gives guidance on implementing them.
- A.2Policies related to AI
- A.3Internal organisation
- A.4Resources for AI systems
- A.5Assessing impacts of AI systems
- A.6AI system life cycle
- A.7Data for AI systems
- A.8Information for interested parties
- A.9Use of AI systems
- A.10Third-party and customer relationships
03 / Next to ISO 27001
ISO 42001 next to ISO 27001.
| Topic | ISO 27001 | ISO 42001 |
|---|---|---|
| Subject | Information security | Responsible development, provision and use of AI |
| Structure | Clauses 4 to 10 | Clauses 4 to 10, the same structure |
| Risk | Information security risks | AI risks and the impact on individuals, groups and society |
| Annex A | Information security controls | Controls for AI |
| Statement of applicability | Required | Required |
| Certification | By an accredited certification body | By an accredited certification body |
Both share the structure of clauses 4 to 10. Reuse is assessed per control, not as a fixed percentage.
What you can usually build on
- Document control and approvals
- Internal audit and management review
- Nonconformities and corrective actions
- Competence and awareness
- Supplier management
What you add for AI
- AI systems and their intended use
- AI risk and impact assessment
- Data quality and provenance
- Human oversight
- Testing, monitoring and transparency
04 / The route
From scope to certificate.
- 01
Determine scope and role
List the AI systems in scope and whether you develop, provide or use them.
In BasenormRecord AI systems, owners and intended use in one place.
- 02
Set policy and responsibilities
Write your AI policy and assign roles and authorities.
In BasenormReuse your ISO 27001 policy structure and add the AI responsibilities.
- 03
Assess risks and impact
Assess AI risks and the impact on people and organisations.
In BasenormLink risks and impact assessments to controls and owners.
- 04
Select controls
Choose Annex A controls and record them in your statement of applicability.
In BasenormSee where controls you already have for ISO 27001 also count.
- 05
Show that it works
Collect evidence, run an internal audit and hold a management review.
In BasenormLink evidence once and see what is still open.
- 06
Certification audit
An accredited certification body audits your AI management system and decides on the certificate.
In BasenormGive your auditor access to controls and evidence with the auditor role.
05 / The AI Act
REGULATION (EU) 2024/1689ISO 42001 and
the AI Act.
ISO 42001 is a voluntary standard. The AI Act, Regulation (EU) 2024/1689, is law. Certification does not give a presumption of conformity, but the management system helps you organise and evidence your obligations.
Read about the EU AI ActprEN 18286 expected. Target date for the harmonised standard for the quality management system.
High-risk AI, Annex III. Obligations start to apply for most high-risk systems.
High-risk AI, Annex I. Obligations for AI in products covered by sectoral legislation.
Dates according to Regulation (EU) 2024/1689 as amended by the Digital Omnibus. The prEN 18286 date is a CEN-CENELEC target date.
06 / In Basenorm
How Basenorm supports you.
Unified Control Library
Define a control once and see whether it counts for ISO 42001, ISO 27001 or both.
02Governance Graph
Connect AI systems, risks, controls, evidence and owners.
03AskNorman
Ask what is still open for ISO 42001, in Basenorm or via MCP from ChatGPT or Claude. You review the evidence yourself.
07 / Questions
Questions about
ISO 42001.
What is ISO 42001?
ISO/IEC 42001 is the international standard for an AI management system, published in 2023. It sets requirements for policy, roles, AI risk and impact assessment, and controls across the AI life cycle. An accredited certification body can certify it.
Who is ISO 42001 for?
For organisations that develop, provide or use AI systems, regardless of size or sector. Your role determines which requirements and controls apply to you.
Is ISO 42001 mandatory?
No. ISO 42001 is a voluntary standard. Customers, partners or tenders can ask for it, and it gives you a structure to organise your obligations under laws such as the AI Act.
Do we need ISO 27001 first?
No. You can implement ISO 42001 on its own. If you already have ISO 27001, you build on the same structure and reuse processes such as document control and internal audit.
Can we combine ISO 42001 and ISO 27001?
Yes. Both follow the same structure, so you can run them as one integrated management system. Whether the audits are combined is something you agree with your certification body.
Does ISO 42001 certification make us AI Act compliant?
No. ISO 42001 is not a harmonised standard under the AI Act, so certification alone does not give a presumption of conformity. It does give you the management system to organise and evidence your obligations.
Does Basenorm certify our organisation?
No. Basenorm supports setting up, running and demonstrating your AI management system. An independent, accredited certification body performs the audit and decides on the certificate.
Book a demo
Start ISO 42001 from what you already have.
In a demo we look at your AI systems, your current setup and your next step.
- Which AI systems and roles are in scope.
- What you can reuse from ISO 27001.
- How you manage controls and evidence for both standards.
Hosted in the Netherlands. Your data stays in the EU.