Saying “we use AI responsibly” is no longer enough. Customer security questionnaires now include dedicated AI sections, procurement teams want proof of governance, and the EU AI Act lets regulators test those claims. For compliance and security teams, ISO/IEC 42001:2023 has quickly become the main framework for answering these questions.
According to Copla, ISO and IEC jointly published the standard in December 2023. It is voluntary and certifiable, and it sets the requirements for building, running and continually improving an AI management system (AIMS).
It does not test models, set accuracy thresholds or endorse a particular AI product. A certificate covers an organisation’s management system within a defined scope, so labelling a product “ISO 42001 certified AI” overstates what an auditor actually examined.
The standard uses the Harmonized Structure shared by ISO 27001 and ISO 9001. Clauses 4 to 10 contain the auditable requirements, covering context, leadership, planning, support, operation, performance evaluation and improvement. Annex A provides 38 controls across nine objectives. Organisations record in a Statement of Applicability which controls they adopt and why they exclude the rest.
The main difference from ISO 27001 is the AI system impact assessment. Clauses 6.1.4 and 8.4 require organisations to assess the consequences of their AI for individuals, groups and society, repeat the assessment when systems change significantly, and feed the results back into risk management.
An information security management system has no equivalent. Firms that already hold ISO 27001 can extend their existing policies, risk methods, internal audits and management reviews to cover both standards.
The standard applies to any organisation that develops, provides or uses AI. The strongest candidates are SaaS vendors selling to enterprises, regulated financial institutions using AI for credit decisions or fraud detection, and companies regularly facing AI questions in vendor due diligence.
The relationship with the EU AI Act causes the most confusion. ISO 42001 overlaps with the Act’s requirements on risk management, data governance, documentation, human oversight and post-market monitoring. However, it is not a harmonised standard. As of November 2026 it gives no presumption of conformity under Article 40. Conformity assessment, CE marking, EU database registration, Annex IV technical files and serious-incident reporting deadlines all fall outside its scope.
That status now belongs to EN 18286:2026, which covers the quality management system required under Article 17. The Commission cited it in the Official Journal on 14 October 2026. Under the Digital Omnibus on AI, Annex III high-risk obligations apply from 2 December 2027, and embedded high-risk AI follows on 2 August 2028.
Certification follows a two-stage audit, then a three-year cycle with annual surveillance. Programmes usually take four to nine months. The practical starting point is an AI inventory, then a gap analysis against the clauses and Annex A.
Read the full Copla post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
