https://systechitsolutions.co.uk/_next/static/chunks/pages/blog/is…01-ai-management-system-b5e395ce84678e0f.js

1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[2419],{8923:function(e,t,a){(window.__NEXT_P=window.__NEXT_P||[]).push(["/blog/iso-42001-ai-management-system",function(){return a(55473)}])},55473:function(e,t,a){"use strict";a.r(t),a.d(t,{default:function(){return m},faqs:function(){return c},meta:function(){return h}});var i=a(85893),n=a(11151),s=a(50148),o=a(86256),r=a(59569),l={structure:{id:"structure",section:"What certification actually involves",kind:"layers",alt:"Diagram of ISO 42001 certification built up from the management system in clauses 4 to 10, the controls your own risk treatment selects under clause 6.1.3, the Annex A check against omission, and a two-stage audit.",caption:"The same skeleton as ISO 27001. Annex A is a check against omission, not a list of 38 controls you must implement.",wide:{src:"/_next/static/media/blog-iso-42001-ai-management-system-structure.16a3b0b3.webp",height:874,width:1760,blurDataURL:"data:image/webp;base64,UklGRjgAAABXRUJQVlA4ICwAAACQAQCdASoIAAQAAkA4JaQAAudP3WAA/vouPHn6vCBKanGp/zxDuMyVUIAAAA==",blurWidth:8,blurHeight:4},narrow:{src:"/_next/static/media/blog-iso-42001-ai-management-system-structure-narrow.a69a7b33.webp",height:1120,width:1e3,blurDataURL:"data:image/webp;base64,UklGRkYAAABXRUJQVlA4IDoAAACwAQCdASoHAAgAAkA4JZwC7AEOuwSAAP79LaMd+6E7Vm7/9K2PT8Rfc3i2rnII6x/D/CZXmukbigAA",blurWidth:7,blurHeight:8}},groundwork:{id:"groundwork",section:"What to do if you are not ready to certify",kind:"process",alt:"Five groundwork steps before ISO 42001: build the AI inventory, write a usable AI policy, name an accountable owner, do the permissions work, and keep a record of decisions.",caption:"None of it is wasted if you certify later, and it answers most of what a customer questionnaire asks.",wide:{src:"/_next/static/media/blog-iso-42001-ai-management-system-groundwork.20d37002.webp",height:580,width:1760,blurDataURL:"data:image/webp;base64,UklGRigAAABXRUJQVlA4IBwAAABwAQCdASoIAAMAAkA4JZwCdAFAAAD++XKACgAA",blurWidth:8,blurHeight:3},narrow:{src:"/_next/static/media/blog-iso-42001-ai-management-system-groundwork-narrow.ca65fefa.webp",height:1220,width:1e3,blurDataURL:"data:image/webp;base64,UklGRioAAABXRUJQVlA4IB4AAABwAQCdASoHAAgAAkA4JZwCdAF1AAD++aRRb614kAA=",blurWidth:7,blurHeight:8}}};let h=(0,o.zQ)("iso-42001-ai-management-system"),c=[{q:"What is ISO 42001 in simple terms?",a:"ISO/IEC 42001:2023 is the first international management system standard for artificial intelligence. It does not certify that a particular AI system is safe or accurate. It certifies that your organisation has a working system for governing AI: who is accountable, how you assess the impact of what you deploy, how you handle the data, how you oversee it once it is live, and how you improve it. It is the same idea as ISO 27001 for information security, applied to AI."},{q:"Does ISO 42001 certification make us compliant with the EU AI Act?",a:"No, and any supplier who tells you otherwise is overselling it. The AI Act is law and sets out what must be achieved; ISO 42001 is a voluntary standard describing how to run and evidence an AI governance programme. Certification does not by itself confer legal conformity with the Act. What it does is give you a governance structure that maps well onto what the Act expects around risk management, data governance, documentation, human oversight and post-market monitoring, so the work is largely reusable. Useful, and not a substitute."},{q:"Do we need ISO 42001 if we only use AI rather than build it?",a:"Usually not yet, and possibly never. The standard applies to organisations that develop, provide or use AI, so a pure user is genuinely in scope, but the weight of what you would have to evidence is far lower and the commercial reason to certify is usually absent. If nobody is asking you for it, and you are not selling AI-enabled software, spend the effort on an AI use policy, a register of what you actually use, and the permissions work. Certify when a customer, an insurer or a tender makes it worth something."},{q:"Do we have to implement all 38 Annex A controls?",a:"No, and this is the most commonly misunderstood part. Clause 6.1.3 requires you to determine the controls your own risk treatment needs, then compare that set against Annex A to confirm you have not overlooked something relevant. Annex A is a checklist against omission, not a mandatory list. That works exactly like ISO 27001's Statement of Applicability, and if you hold 27001 the process will already be familiar."},{q:"How long does ISO 42001 certification take?",a:"It depends almost entirely on whether you already run a management system. An organisation with ISO 27001 in place is extending something that exists, and the shared clause structure means the governance, internal audit and management review machinery is reusable. An organisation starting from nothing is building a management system for the first time and should expect that to be the project, with the AI-s

1pecific parts comparatively quick. Either way there is a gap analysis, an implementation period, an internal audit and a management review before an accredited body runs its two-stage audit."}],d=function(e){let{children:t}=e;return(0,i.jsx)(s.Bf,{slug:h.slug,title:h.title,seoTitle:h.seoTitle,category:h.category,excerpt:h.excerpt,publishedAt:h.publishedAt,updatedAt:h.updatedAt,readTime:h.readTime,heroImage:h.heroImage,faqs:c,children:t})};function u(e){let t={a:"a",details:"details",h2:"h2",li:"li",nav:"nav",ol:"ol",p:"p",strong:"strong",summary:"summary",ul:"ul",...(0,n.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)("p",{className:"lede",children:"There is now a certifiable international standard for governing AI, and within a year or two your customers will start asking whether you hold it. For most businesses reading this, the honest answer today should still be no."}),"\n",(0,i.jsxs)("p",{className:"answer",children:[(0,i.jsx)("strong",{children:"In short:"})," ISO/IEC 42001:2023, published on 18 December 2023, is the first international management system standard for artificial intelligence. It certifies that your organisation governs AI properly, not that any particular AI system is safe. It follows the same structure as ISO 27001, with management system clauses 4 to 10 and 38 Annex A controls grouped under nine objectives, and you pick the controls your risk assessment calls for rather than implementing all of them. Certification does not make you compliant with the EU AI Act, though the work overlaps substantially. If you build or sell AI-enabled software, start now. If you simply use Copilot, it is almost certainly not your next move, and this article says what is."]}),"\n",(0,i.jsx)(t.nav,{className:"pageNav pageNav--inline","aria-label":"On this page",children:(0,i.jsxs)(t.details,{className:"pageNav__details",children:[(0,i.jsx)(t.summary,{className:"pageNav__title",children:"On this page"}),(0,i.jsxs)(t.ol,{className:"pageNav__list",children:[(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{className:"pageNav__link",href:"#what-iso-42001-actually-certifies",children:"What ISO 42001 actually certifies"})}),(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{className:"pageNav__link",href:"#who-is-it-actually-for",children:"Who is it actually for?"})}),(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{className:"pageNav__link",href:"#what-certification-actually-involves",children:"What certification actually involves"})}),(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{className:"pageNav__link",href:"#does-it-make-you-compliant-with-the-eu-ai-act",children:"Does it make you compliant with the EU AI Act?"})}),(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{className:"pageNav__link",href:"#if-you-already-hold-iso-27001",children:"If you already hold ISO 27001"})}),(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{className:"pageNav__link",href:"#what-to-do-if-you-are-not-ready-to-certify",children:"What to do if you are not ready to certify"})}),(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{className:"pageNav__link",href:"#when-to-revisit-the-decision",children:"When to revisit the decision"})}),(0,i.jsx)(t.li,{children:(0,i.jsx)(t.a,{className:"pageNav__link",href:"#where-we-can-help",children:"Where we can help"})})]})]})}),(0,i.jsx)(t.h2,{id:"what-iso-42001-actually-certifies",children:"What ISO 42001 actually certifies"}),"\n",(0,i.jsx)(t.p,{children:"The most useful thing to understand first is what it does not do. ISO 42001 does not assess whether a model is accurate, whether its outputs are fair, or whether a particular system is safe to deploy. No standard could, because those questions depend on the system and the context it runs in."}),"\n",(0,i.jsx)(t.p,{children:"What it certifies is that you have a working AI management system: an AIMS, in the same way ISO 27001 certifies an ISMS. That means somebody is accountable, you know what AI you have, you assess the impact of a system before you deploy it, you manage the data going into it, you oversee it while it is running, and you have a mechanism for finding out when something has gone wrong and doing something about it."}),"\n",(0,i.jsx)(s.NT,{children:"It certifies the organisation's competence at governing AI, not the AI."}),"\n",(0,i.jsx)(t.p,{children:"That distinction matters commercially, because it changes what the certificate is worth. A customer asking whether you hold ISO 42001 is not asking whether your product is accurate. They are asking whether you are the kind of organisation that would notice if it stopped being accurate."}),"\n",(0,i.jsx)(t.h2,{id:"who-is-it-actually-for",children:"Who is it actually for?"}),"\n",(0,i.jsx)(t.p,{children:"The standard applies to organisations that develop, provide or use AI systems, which is broad enough to include almost everybody. Scope is not the useful question, though. The useful question is who gets something back for the effort."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"A strong case:"})}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"You build or sell software with AI in it, and your customers do due diligence on suppliers."}),"\n",(0,i.jsx)(t.li,{children:"You are in a supply chain where somebody upstream is already being asked AI governance questions, so the questions will reach you next."}),"\n",(0,i.jsx)(t.li,{children:"You are deploying AI into decisions that affect people, in recruitment, credit, healthcare, education or public services."}),"\n",(0,i.jsx)(t.li,{children:"You already hold ISO 27001 and AI is becoming a material part of what you do."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"A weak case, for now:"})}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"You use Microsoft 365 Copilot and a handful of other vendor tools, and nobody has asked you anything."}),"\n",(0,i.jsx)(t.li,{children:"You have no AI in what you sell, and no AI touching decisions about people."}),"\n",(0,i.jsx)(t.li,{children:"You do not yet have an inventory of what AI is being used across the business, which is a sign the groundwork comes first."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"That last one is worth dwelling on. Certifying a management system for something you cannot yet list is the wrong order, and an auditor will find that out faster than you would like."}),"\n",(0,i.jsx)(t.h2,{id:"what-certification-actually-involves",children:"What certification actually involves"}),"\n",(0,i.jsx)(t.p,{children:"The structure will look familiar to anyone who has been through ISO 27001, deliberately so. Clauses 4 to 10 define the management system itself: context, leadership, planning, support, operation, performance evaluation and improvement."}

1),"\n",(0,i.jsx)(t.p,{children:"Then Annex A provides 38 controls grouped under nine objectives, numbered A.2 to A.10, covering AI policy, internal organisation, resources, impact assessment, the AI life cycle, data, information for interested parties, use of AI systems, and third-party relationships."}),"\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"The point people get wrong:"})," you do not implement all 38. Clause 6.1.3 requires you to determine the controls your own risk treatment needs, then compare that set against Annex A to confirm you have not overlooked anything relevant. Annex A is a check against omission rather than a mandatory list, exactly as it is in ISO 27001."]}),"\n",(0,i.jsx)(r.d,{figure:l.structure}),"\n",(0,i.jsx)(t.p,{children:"The route to a certificate is the standard one. A gap analysis, an implementation period, an internal audit, a management review, and then a two-stage audit by an accredited certification body. In the UK, UKAS has begun accrediting certification bodies for this standard, with BSI the first to be granted it, so accredited certification is available rather than theoretical."}),"\n",(0,i.jsx)(t.h2,{id:"does-it-make-you-compliant-with-the-eu-ai-act",children:"Does it make you compliant with the EU AI Act?"}),"\n",(0,i.jsx)(t.p,{children:"No, and this is where the standard is most often oversold."}),"\n",(0,i.jsx)(t.p,{children:"The two things do different jobs. The AI Act is law: it defines what must be achieved and who is liable for achieving it. ISO 42001 is a voluntary standard describing how to run, evidence and improve a governance programme. Certification to it does not by itself confer legal conformity with the Act."}),"\n",(0,i.jsx)(t.p,{children:"What it does give you is a structure that maps well onto what the Act expects: risk management, data governance, technical documentation, human oversight and post-market monitoring. So the work is largely reusable, and an organisation that has done ISO 42001 properly will be starting the Act's conformity work from a much better place than one that has not."}),"\n",(0,i.jsxs)(t.p,{children:["Treat certification as a way to organise the effort and evidence it to customers, not as a defence you can point at. If you are a UK business selling into the EU, the transparency obligations that ",(0,i.jsx)(t.a,{href:"/blog/eu-ai-act-what-actually-started",children:"became applicable in August 2026"})," are a separate and more immediate question."]}),"\n",(0,i.jsx)(t.h2,{id:"if-you-already-hold-iso-27001",children:"If you already hold ISO 27001"}),"\n",(0,i.jsx)(t.p,{children:"You are in a considerably better position than the effort suggests, because the two standards share the same management system skeleton."}),"\n",(0,i.jsx)(t.p,{children:"The governance you already run transfers: leadership commitment, competence and awareness, documented information, internal audit, management review, corrective action and continual improvement. Those are the parts that take longest to build the first time and they already exist. Many organisations run the two as one integrated management system with combined audits rather than two parallel programmes."}),"\n",(0,i.jsx)(t.p,{children:"What genuinely is new is the AI-specific substance: the impact assessment on people and society rather than only on the organisation, the life cycle controls around how systems are developed and validated, the data governance questions about what a system was trained and grounded on, and the third-party controls covering the AI you have bought rather than built."}),"\n",(0,i.jsx)(t.p,{children:"There is a real trap in that last one. Most organisations' AI risk sits in suppliers rather than in anything they built, and supplier governance is the control set people skim."}),"\n",(0,i.jsx)(t.h2,{id:"what-to-do-if-you-are-not-ready-to-certify",children:"What to do if you are not ready to certify"}),"\n",(0,i.jsx)(t.p,{children:"Which, to be clear, is most businesses reading this. None of the following is wasted if you certify later, because all of it is evidence you would need anyway."}),"\n",(0,i.jsx)(r.d,{figure:l.groundwork}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Build the inventory."})," What AI is actually in use across the business, including the tools people adopted without asking. You cannot govern an unknown set, and this is usually the step that produces the surprises."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Write a usable AI policy."})," Not a document that bans things people will keep doing regardless. ",(0,i.jsx)(t.a,{href:"/blog/ai-use-policy-people-will-follow",children:"One people will actually follow"}),", that says what is allowed with what information."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Name an owner."})," One person accountable for AI decisions, even part time. Diffuse accountability is the failure mode that every governance standard exists to prevent."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Do the permissions work."})," The single largest AI risk in most Microsoft estates is not the model, it is that content was overshared years ago and AI makes it findable. That is ",(0,i.jsx)(t.a,{href:"/services/ai",children:"readiness work you should do anyway"}),"."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Keep a record of decisions."})," When you approved a tool, what you considered, who signed it off. Retrospective reconstruction is the expensive part of any first certification."]}),"\n"]}

1),"\n",(0,i.jsx)(t.p,{children:"Do those five and you will have answered most of what a customer questionnaire asks, at a fraction of the cost of certifying, and you will have the raw material if you decide to."}),"\n",(0,i.jsx)(t.h2,{id:"when-to-revisit-the-decision",children:"When to revisit the decision"}),"\n",(0,i.jsx)(t.p,{children:"The trigger to watch is commercial rather than regulatory. Certification becomes worth it at the point where not holding it costs you something specific: a tender you cannot bid for, a customer questionnaire you keep failing, an insurer asking questions you cannot evidence, or a procurement team that has started requiring it of suppliers."}),"\n",(0,i.jsxs)(t.p,{children:["That point is arriving sooner than most people expect, particularly for anyone selling software or services into regulated sectors and the public sector. The ",(0,i.jsx)(t.a,{href:"/blog/ai-questions-clients-will-ask",children:"questions clients are starting to ask"})," are the leading indicator, and by the time one of them asks about ISO 42001 by name, the gap analysis is a better answer than a promise."]}),"\n",(0,i.jsx)(t.h2,{id:"where-we-can-help",children:"Where we can help"}),"\n",(0,i.jsxs)(t.p,{children:["We are not a certification body, and for ISO 42001 as for ",(0,i.jsx)(t.a,{href:"/services/cyber-essentials",children:"Cyber Essentials"})," we would not want to be, because a supplier who fixes your estate and then certifies it is marking its own homework."]}),"\n",(0,i.jsxs)(t.p,{children:["What we do is the part before the auditor: working out whether certification is worth it for you at all, building the AI inventory, doing the permissions and data governance work that underpins most of the controls, and producing the ",(0,i.jsx)(t.a,{href:"/services/compliance-packs",children:"policies, procedures and evidence"})," an assessor asks to see. If the honest answer is that you are three years away from needing this, we will tell you that and point you at the five things above instead."]})]})}function m(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};return(0,i.jsx)(d,{...e,children:(0,i.jsx)(u,{...e})})}}},function(e){e.O(0,[9707,2728,738,3796,7829,9396,8077,6379,9774,2888,179],function(){return e(e.s=8923)}),_N_E=e.O()}]);