ISO 42001, the management system for governing AI.
The first certifiable AI management system. It governs how you build and use AI — policy, risk, impact assessments, lifecycle, and human oversight. We're AI-native and run AI with a human in the loop; 42001 is how you prove it.
A management system for AI — not a model audit.
ISO/IEC 42001:2023 is the first certifiable standard for an AI management system (AIMS). It governs how your organisation develops, provides, and uses AI responsibly — the policies, risk processes, and oversight, not the maths inside a model.
Structurally it's a twin of ISO 27001: clauses 4–10 describe the management system — context, leadership, planning, support, operation, evaluation, improvement — and Annex A lists 38 controls grouped into nine areas, which you select and justify for your AI use.
It certifies the same way: a two-stage audit by an accredited body, then a three-year cycle. It maps cleanly to the NIST AI Risk Management Framework and gives you defensible evidence of governance as the EU AI Act and regulators sharpen expectations.
Plan · Do · Check · Act. For every AI system you run.
42001 runs on the same Plan-Do-Check-Act clock as your ISMS. Cybereen schedules each step, assigns the owner, and keeps the evidence trail.
Policy, risk, impact.
Set your AI policy and objectives, assess AI risk, and run an impact assessment for each AI system in scope.
- AI policy + objectives
- AI risk assessment
- AI system impact assessment
Build & operate.
Apply lifecycle controls — data governance, design, verification, deployment — with human oversight defined and evidenced.
- Lifecycle controls
- Data governance
- Human-in-the-loop records
Monitor & review.
Monitor AI systems in production, run internal audit and management review. Regulators want this happening continuously.
- Performance monitoring
- Internal audit log
- Management review
Improve.
Close nonconformities, retire or retrain models, update risk treatment. Continual improvement is clause 10 — and it's tested.
- NCR register
- Model change control
- Improvement log
38 controls. Nine areas. Four that carry the weight.
Annex A spans AI policy through to third-party use. These four areas are where most of the real work — and the audit scrutiny — lands.
Leadership commitment, an AI policy, roles and responsibilities, and how AI decisions are governed across the org.
The AI system impact assessment — effects on individuals, groups, and society. The control auditors and regulators probe hardest.
Responsible design, development, verification, deployment, and operation — with data governance and human oversight throughout.
Responsible use of AI systems, information for affected parties, and managing AI supplied by — or to — third parties.
Your AI register. Governed, not guessed.
A live inventory of every AI system, its impact assessment, owner, and oversight model — sitting alongside your other frameworks, on one source of truth.
- AI system register — what AI you run, where it touches decisions, who owns it.
- Impact assessments — AISIA template per system, versioned and dated.
- Human-in-the-loop evidence — oversight points defined and logged, not assumed.
- Lifecycle controls — design → deploy → monitor → retire, tracked to closure.
- Cross-framework reuse — your 27001 evidence pre-fills the AIMS controls it shares.
Three places AI governance falls over.
What teams underestimate when they first stand up an AIMS.
Treating it as a model audit.
42001 doesn't test your model's accuracy. It tests whether you govern AI — policy, accountability, impact, oversight. Teams that send engineers to "pass the model" miss what's actually assessed.
Skipping the impact assessment.
The AI system impact assessment is the control auditors and regulators scrutinise most. A generic, one-size template applied to every system is an instant finding.
No live AI inventory.
You can't govern AI you can't see. Shadow AI — a team wiring an LLM into a workflow — is the gap that breaks an AIMS, and it grows weekly.
Questions before you govern AI.
If yours isn't here, the contact form has a free-text field — answers go in the next page revision.
Is ISO 42001 certifiable, like 27001?
How is it different from ISO 27001?
Does it help with the EU AI Act?
What is an AI system impact assessment?
We're AI-native — where do we start?
Govern your AI before a regulator asks you to.
Stand up the register, run the impact assessments, evidence the human oversight — on the same platform as your other frameworks. Book a walk-through and we'll map it to your AI.