It gets ahead of the questions
"How do you govern AI?" is showing up in more security questionnaires every quarter. Certification is a far better answer than a nervous shrug.
Governance for the AI you build and buy.
ISO/IEC 42001 is the first management-system standard for artificial intelligence. It helps organisations govern AI responsibly — addressing risk, transparency, data quality and the AI lifecycle — much as ISO 27001 does for security.
The standard
ISO/IEC 42001:2023 — AI Management System
Who needs it
Any organisation developing, deploying or heavily relying on AI systems that wants to demonstrate responsible, well-governed AI to customers and regulators.
1st
AI management-system standard
The basics
ISO/IEC 42001 is the first international management-system standard for artificial intelligence. It does for AI what ISO 27001 does for security: it gives you a structured, auditable way to govern how AI is built, bought and used across its lifecycle.
It's not about slowing AI down. It's about being able to answer — credibly — the questions customers and regulators are starting to ask: what does your AI do, what data feeds it, where are its limits, and who's accountable when a human needs to step in?
Why it matters
"How do you govern AI?" is showing up in more security questionnaires every quarter. Certification is a far better answer than a nervous shrug.
Being early on responsible-AI governance signals maturity — a real edge while most competitors are still winging it.
If you already run an ISMS, you're halfway there; the governance muscles transfer directly, so the lift is smaller than it looks.
Policies, roles and processes for governing AI across its lifecycle.
Assess risks to individuals and society, not just to the business.
Data quality, model development, deployment and monitoring under control.
Document intended use, limitations and human oversight of AI systems.
AI governance done ad-hoc means scattered model notes, undocumented data flows and no clear owner — precisely the gaps a regulator or enterprise buyer will probe. Structure beats scramble.
Do it once, reuse it everywhere. Evidence you collect for ISO 42001is automatically mapped to every other framework whose controls it also satisfies — and since these standards overlap heavily, most of that work isn't repeated.
See exactly how Compliance One maps ISO 42001 to your environment in a 30-minute walkthrough — and how much of it we handle for you.