ISO 42001 explained: the AI management system for organisations.
ISO/IEC 42001 is the first international standard for an AI management system. It sets out how to organise rules, roles, risks and controls for AI so that an auditor can check them. This guide explains the structure, the 38 Annex A controls, the path to a certificate and how the standard relates to the EU AI Act.
As of 30 October 2026 · not legal advice
Key points
- ISO/IEC 42001 describes an
AI management system (AIMS) : policies, owners, risk assessment, impact assessment, controls and continual improvement for all AI you develop, provide or use. - The standard is
voluntary and meant for organisations of any size. The organisation is certified, not a product. - Annex A contains
38 controls in nine areas . You justify which apply in the Statement of Applicability. - ISO 42001 is
not a harmonised standard under the AI Act. A certificate does not replace legal duties, but it helps you meet them in an orderly way.
What is ISO 42001?
ISO/IEC 42001:2023 is an ISO and IEC standard for an
The standard applies to organisations that
It is built like ISO 27001 or ISO 9001: clauses 4 to 10 hold the requirements an auditor checks. Four annexes follow: Annex A with the controls, Annex B with implementation guidance, Annex C with possible objectives and risk sources, and Annex D on use across sectors.
The 38 Annex A controls in nine areas.
Annex A is where the practical work happens. The controls are grouped by objective. The right-hand column shows the evidence an auditor typically wants to see.
| Area | What it covers | Typical evidence |
|---|---|---|
| A.2 AI policies | An AI policy aligned with other policies and reviewed regularly | Approved AI policy with a date |
| A.3 Internal organisation | Roles, responsibilities, ways to report concerns | Role matrix, reporting process |
| A.4 Resources | Document data, tools, compute and people | Inventory of AI systems and components |
| A.5 Impact assessment | Assess effects on individuals and society | Impact assessment per AI system |
| A.6 Life cycle | Objectives, development, testing, release, operation, monitoring | Release records, test results, operating logs |
| A.7 Data | Data provenance, quality and preparation | Data sources with owners |
| A.8 Information | Inform users and affected people clearly | AI notices, user documentation |
| A.9 Use of AI | Responsible use as intended | Usage rules, training records |
| A.10 Third parties | Suppliers, customers and shared responsibility | Contracts, supplier assessment |
Summary based on ISO/IEC 42001:2023, Annex A. The areas start at A.2. You can buy the full text from ISO or your national standards body.
ISO 42001 and the EU AI Act: what fits together and what does not.
The AI Act is law; ISO 42001 is a voluntary standard. The standard does
The overlap is still worth it: once you build an AI management system, you have an inventory, clear roles, risk assessment and documentation. That is exactly what you need to show you meet the Act's duties.
| Topic | ISO/IEC 42001 | EU AI Act |
|---|---|---|
| Legal nature | Voluntary standard | EU regulation, directly applicable law |
| Applies to | Any organisation that chooses it | Providers, deployers and others, by role and risk |
| Proof | Certificate from an accredited body | Depending on the duty: documentation, conformity assessment, registration |
| AI literacy | Competence and awareness (clause 7) | Art. 4: AI literacy measures |
| Transparency | Information for interested parties (A.8) | Art. 50: notices for chatbots and AI content |
| Consequences | Nonconformity in the audit, in the worst case loss of the certificate | Fines under Art. 99 |
EU AI Act summary →EU AI Act: current status →EU AI Act risk classes →
Five steps to ISO 42001 certification.
The path is similar to other ISO certifications. If you already hold ISO 27001, you can reuse policies, document control, internal audit and management review.
Set the scope
Which AI systems, sites and roles are in scope? Are you a developer, provider or user?
Inventory and risks
List all AI systems, assess risks and run an impact assessment per system.
Implement controls
Work through Annex A, write the Statement of Applicability, close the gaps.
Check internally
Run an internal audit and management review, fix nonconformities.
Get certified
Stage 1 and stage 2 audit by an accredited body, then annual surveillance audits.
Choose an accredited certification body, in Germany for example accredited by DAkkS. ISO/IEC 42006 sets the requirements for bodies that audit AI management systems. ISO/IEC 42005 gives guidance on impact assessment and ISO/IEC 23894 on risk management.
What an AI platform can contribute to the management system.
A management system runs on evidence. Much of it comes from where the AI runs: who changed a model, which sources are connected, when data was deleted, what an answer is based on.
RAGSuite supplies this kind of evidence. The platform is not certified and does not replace a management system, but it makes Annex A easier to evidence.
A source for every answer
Answers point to the passage. That supports transparency (A.8) and monitoring in operation (A.6). In every edition.
Deletion with receipts
Automatic deletion with receipts and a switch that turns storage off. Included in the Community Edition.
Roles and audit log
Organisations, teams, roles and the full audit log with export are Enterprise. The Community Edition shows the last 15 days.
Operation under your control
Self-hosted on your servers or in the RAGSuite Engine with a data centre in Germany. That simplifies supplier assessment (A.10).
Are you ready for ISO 42001?
Tick what is done. Nothing is stored.
Questions about ISO 42001.
What is ISO 42001?
ISO/IEC 42001 is the international standard for an AI management system (AIMS). It describes how an organisation sets, implements and continually improves rules, roles, risk handling and controls for using and developing AI. It was published in December 2023.
Is ISO 42001 mandatory?
No. ISO 42001 is a voluntary standard. What is mandatory are laws such as the EU AI Act and the GDPR. Customers or tenders may still ask for a certificate.
Does ISO 42001 certification satisfy the EU AI Act?
No, not automatically. ISO 42001 is not a harmonised standard under the AI Act and does not create a presumption of conformity. An AI management system does help you meet many duties in an orderly way: inventory, roles, risk assessment, documentation and AI literacy.
How many controls are in Annex A?
Annex A contains 38 controls in nine areas, from AI policies through data and the life cycle to suppliers. You justify which ones you apply in the Statement of Applicability.
How does certification work?
A certification body, ideally accredited, audits in two stages: stage 1 checks documentation and readiness, stage 2 checks how it works in practice. The certificate is valid for three years, with annual surveillance audits. Requirements for certification bodies are set out in ISO/IEC 42006.
How is it different from ISO 27001?
ISO 27001 covers information security; ISO 42001 covers the responsible handling of AI, such as impact assessment, data quality and transparency. Both share the same high-level structure, so they combine well in an integrated management system.
Is RAGSuite certified to ISO 42001?
No. Certification always applies to an organisation and its management system, not to a software product on its own. RAGSuite can supply evidence that feeds into your AI management system, such as the audit log, retention periods and sources for every answer.
Evidence for your AI management system, straight from the platform.
Stefan shows you which evidence RAGSuite supplies and where your management system has to do the work.