AI governance: questions and answers.
ISO 42001, the EU AI Act and how AI governance builds on an existing ISMS.
What is ISO 42001?
ISO/IEC 42001:2023 is the international standard for an AI management system (AIMS). It sets requirements for how an organisation governs the development, provision or use of AI systems, including AI risk assessment, AI system impact assessment and the controls in Annex A. It follows the same harmonised structure, clauses 4 to 10, as ISO 27001.
Do we need ISO 27001 before ISO 42001?
No. ISO 42001 can be implemented on its own. If you already have ISO 27001, you can reuse much of the management system, such as document control, internal audit, management review and corrective action, and add the AI-specific parts.
How does ISO 42001 relate to the EU AI Act?
ISO 42001 is not a harmonised standard under the AI Act, so certification alone does not give a presumption of conformity. It does give you a management system to organise and evidence your AI obligations, such as risk management, data governance, human oversight and monitoring.
When does the EU AI Act apply?
The AI Act applies in phases. It entered into force on 1 August 2024; the prohibited practices and the AI literacy obligation apply since 2 February 2025, the obligations for general-purpose AI models since 2 August 2025, and most transparency obligations since 2 August 2026. After the Digital Omnibus, Regulation (EU) 2026/1744, the high-risk obligations apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI in Annex I products.
What is an AI system impact assessment?
It is an assessment of the potential consequences of an AI system for individuals, groups and society, required by ISO 42001. It looks at the intended use, foreseeable misuse and effects such as discrimination, safety or loss of privacy. It is one of the parts you add on top of an ISO 27001 risk assessment.
Who owns AI governance in the organisation?
Top management sets the AI policy and objectives and assigns responsibilities, as ISO 42001 requires. In practice each AI system has an owner, while the CISO or security officer covers security and the privacy officer covers personal data. Basenorm records these owners per control and per AI system.
Book a demo
Your question not answered?
In a demo we answer your questions in the context of your own frameworks and scope.
- Where you stand with ISO 27001 and ISO 42001.
- Which frameworks apply to you.
- How Basenorm keeps your management system current.
Hosted in the Netherlands. Your data stays in the EU.