Question · ISO/IEC 42001

Is ISO/IEC 42001 certification required for federal AI?

The first international management-system standard for AI: it sets requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS).

Start free Open the Console

AboutISO/IEC 42001

Legal forceVoluntary standard; certifiable by accredited bodies

Applies from18 Dec 2023

Checked21 Oct 2026

01 / The answer

The short answer

No. No US federal law, executive order or OMB memorandum found requires ISO/IEC 42001 certification for AI used by or sold to federal agencies; OMB memo M-25-21, which sets agency AI governance and risk practices, does not mention it. ISO/IEC 42001:2023 is a voluntary, certifiable standard for an AI management system, structured like ISO/IEC 27001. An agency or customer can still require it in a specific contract or solicitation. Only an accredited certification body can certify an organization; ISO/IEC 42006 sets the rules for those bodies.
ISO/IEC 42001 · checked 21 Oct 2026

02 / The rule

What ISO/IEC 42001 requires

The first international management-system standard for AI: it sets requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS). It uses the same clause structure as ISO 27001 and ISO 9001, so organizations can certify AI governance alongside existing management systems.

01Define the AIMS scope, the organization's role toward AI (e.g. provider, user) and relevant interested parties.
02Top management sets an AI policy, AI objectives and assigns roles and responsibilities.
03Run AI risk assessments, AI risk treatment and AI system impact assessments, and record a Statement of Applicability.
04Plan, operate and control AI processes, applying the Annex A controls selected in risk treatment.

03 / Records

Records to keep

01AI policy and documented AIMS scope
02AI risk assessment, risk treatment plan and Statement of Applicability
03AI system impact assessment records
04Internal audit reports, management review minutes and certification audit report

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES