With the EU AI Act now in force, AI governance is no longer optional. What ISO 42001 means for your organisation and how to get started.
Artificial intelligence governance has moved from a nice-to-have to a regulatory requirement. The EU AI Act is now in force, and ISO 42001, the international standard for AI management systems, provides a structured framework for demonstrating responsible AI development and deployment. This guide explains what both mean for your organisation.
ISO/IEC 42001:2023 is the first international standard for Artificial Intelligence Management Systems (AIMS). Published in December 2023, it provides a framework for organisations to establish, implement, maintain, and continually improve their approach to responsible AI development and deployment.
Like ISO 27001 for information security, ISO 42001 is a certifiable standard. Organisations can achieve third-party certification demonstrating that their AI management system meets the requirements of the standard.
The standard applies to any organisation that develops, provides, or uses AI systems, from AI-native companies to enterprises deploying AI tools in their operations.
The EU AI Act classifies AI systems by risk level, unacceptable risk (prohibited), high risk (subject to strict requirements), limited risk (transparency obligations), and minimal risk (no specific requirements). High-risk AI systems include those used in critical infrastructure, education, employment, essential services, law enforcement, and migration.
ISO 42001 provides a management system framework that aligns well with the EU AI Act requirements. Implementing ISO 42001 does not automatically ensure EU AI Act compliance, but it provides a strong foundation, particularly for the risk management, documentation, and governance requirements.
For companies developing or deploying high-risk AI systems, ISO 42001 certification alongside a conformity assessment provides a credible demonstration of responsible AI governance to regulators and customers.
An AIMS under ISO 42001 requires organisational context assessment, understanding the internal and external factors that affect your AI activities, and the expectations of interested parties including regulators, customers, and affected individuals.
AI risk management is central to the standard. This includes identifying AI-specific risks, bias, explainability, robustness, security, and privacy, and implementing controls to address them. The standard includes an Annex with AI-specific controls analogous to ISO 27001 Annex A.
Transparency and accountability requirements include documentation of AI system objectives, data governance practices, human oversight mechanisms, and processes for handling AI-related incidents and complaints.
Understanding internal and external factors affecting AI activities, and the expectations of regulators, customers, and affected individuals.
Identification and treatment of AI-specific risks including bias, explainability, robustness, security, and privacy.
Policies and processes for data quality, data provenance, and responsible data use in AI systems.
Mechanisms for human review and intervention in AI decision-making, particularly for high-risk applications.
Documentation of AI system objectives, capabilities, limitations, and the basis for AI-driven decisions.
Processes for detecting, reporting, and responding to AI-related incidents, errors, and complaints.
Map all AI systems in development and deployment, including third-party AI tools used in your operations.
Classify AI systems by risk level under both ISO 42001 and the EU AI Act framework.
Design the AI management system, governance structure, policies, risk management process, and control framework.
Implement AI-specific controls covering data governance, model documentation, human oversight, and incident management.
Conduct an internal audit of the AIMS before the certification audit.
Stage 1 documentation review followed by Stage 2 assessment by an accredited certification body.
Netru methodology