ISO/IEC 42001:2023 is the international standard for an artificial intelligence management system, often shortened to AIMS. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organisation. Standards Australia has adopted it locally as AS ISO/IEC 42001:2023.
It is a management system standard, not a technical one. It does not tell you how to build a model, and it does not replace any law. It asks you to run AI the way a well-run organisation runs anything that carries risk: with a policy, clear responsibilities, assessed risks, chosen controls and regular review.
Who it suits
The standard applies to organisations of any size or type that develop, provide or use AI-based products or services. In practice it tends to suit:
- Businesses building AI into products or services their customers rely on.
- Organisations whose customers, partners or tenders are asking how AI is governed.
- Organisations already running a management system such as ISO/IEC 27001 that want AI under the same discipline.
For a small business using a handful of off-the-shelf AI tools, a clear acceptable-use policy and basic AI governance may be the right step for now. ISO/IEC 42001 is where you go when AI is central enough to your work, or to your customers, to need a formal system.
How it relates to ISO/IEC 27001
ISO/IEC 42001 follows ISO's harmonised structure so that it can align with existing management systems. Standards Australia notes that it includes guidance on integrating AI governance with information security and privacy management, and points to aligning it with existing programs such as ISO/IEC 27001.
If you already hold ISO/IEC 27001, much of the machinery carries over: scope, document control, objectives, performance evaluation and improvement. What is new is the subject matter. ISO/IEC 27001 is about protecting information. ISO/IEC 42001 is about how AI systems are developed, provided and used, including their effects on the people they touch. The two can run as one integrated system rather than two separate ones.
The core requirements
Like other ISO management system standards, ISO/IEC 42001 sets requirements for policy, leadership, planning, support, operation, performance evaluation and improvement. The parts that are specific to AI look like this:
| Requirement | What it means in practice |
|---|---|
| AI policy and roles | Leadership sets out how the organisation will develop, provide or use AI, with roles and accountabilities across the AI life cycle. |
| AI risk assessment and treatment | Identify what could go wrong with each AI system, decide how to treat it, and record the decision. |
| AI system impact assessment | A defined process for assessing the potential consequences of an AI system for the people and groups it affects, not only for the business. |
| Annex A controls | A normative set of reference control objectives and controls tailored to AI, used to treat the risks you have identified. |
| Objectives and oversight | Measurable AI objectives, with performance evaluated and improvements made over time under leadership oversight. |
The standard is meant to scale: your needs and objectives, processes, size and structure shape how it is implemented, and a risk-based approach sets how much control each AI use case needs.
Certification
Certification is voluntary. The standard sets the requirements; certification arrangements sit outside it. Organisations can adopt it for internal conformance or seek third-party assessment through a certification body where available. If you pursue certification, the decision rests with that body.
Where to start
A sensible first step is an inventory: the AI tools staff use, the AI features inside software you already run, and anything you build or are planning. From there, a gap assessment against the standard shows how far you are from a working AI management system. Our ISO/IEC 42001 service covers gap assessment, readiness and implementation, and can build on an ISO/IEC 27001 system if you already have one.