International · international standard
ISO/IEC 42001: what it asks, and the records to keep
The first international management-system standard for AI: it sets requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS). It uses the same clause structure as ISO 27001 and ISO 9001, so organizations can certify AI governance alongside existing management systems.
01 / What it asks
What ISO/IEC 42001 asks
Any organization that provides or uses products or services that use AI systems, regardless of size, type or nature, if it chooses to adopt or certify.
- 01Define the AIMS scope, the organization's role toward AI (e.g. provider, user) and relevant interested parties.
- 02Top management sets an AI policy, AI objectives and assigns roles and responsibilities.
- 03Run AI risk assessments, AI risk treatment and AI system impact assessments, and record a Statement of Applicability.
- 04Plan, operate and control AI processes, applying the Annex A controls selected in risk treatment.
- 05Monitor, measure and evaluate AIMS performance through internal audits and management reviews.
- 06Correct nonconformities and continually improve the AIMS.
02 / AI work
Where it touches AI work
AI-specific. It is a governance system for how an organization develops, provides or uses AI systems, not a technical test of any one model.
03 / Dates
The dates that matter
ISO/IEC 42001:2023, first edition, published
ISO/IEC 42006:2025 sets rules for bodies certifying to 42001
European adoption EN ISO/IEC 42001:2026 published by national bodies
04 / Enforcement
Who enforces it
None; voluntary. Accredited certification bodies audit and certify; customers may require certification by contract.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01AI policy and documented AIMS scope
- 02AI risk assessment, risk treatment plan and Statement of Applicability
- 03AI system impact assessment records
- 04Internal audit reports, management review minutes and certification audit report
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
Is ISO/IEC 42001 certification required for federal AI?+
No. No US federal law, executive order or OMB memorandum found requires ISO/IEC 42001 certification for AI used by or sold to federal agencies; OMB memo M-25-21, which sets agency AI governance and risk practices, does not mention it. ISO/IEC 42001:2023 is a voluntary, certifiable standard for an AI management system, structured like ISO/IEC 27001. An agency or customer can still require it in a specific contract or solicitation. Only an accredited certification body can certify an organization; ISO/IEC 42006 sets the rules for those bodies. Read the full answer
SOURCES
Go back to the source
IEC Webstore (ISO/IEC JTC 1/SC 42)
International Organization for Standardization
International Organization for Standardization
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: ISO/IEC 42001 vs NIST AI RMF · ISO/IEC 42001 vs NIST SP 800-53 Rev. 5 · ISO/IEC 42001 vs EO 14179 · ISO/IEC 42001 vs DoW RAI S&IP · SLSA v1.0 · SCITT · ISO/IEC 42001 · Annex A · GMLP