- A.2Policies
- A.3Internal organization
- A.4Resources
- A.5Impact assessment
- A.6Life cycle
- A.7Data
- A.8Information for interested parties
- A.9Use of AI
- A.10Third parties and customers
A customer questionnaire or tender asks how you govern the AI you offer.
Organizations that develop AI systems or offer AI-based products and services to others.
Your board asks what AI the company uses, and who oversees it.
Organizations that use AI in their own work, including the AI built into tools from vendors.
You want to extend the management system you already run to cover AI.
Organizations certified to ISO 27001 or ISO 9001, which share the same clause structure.
The audit date becomes the deadline for your scope, controls and evidence.
Teams that have chosen an accredited certification body and set a date for the first audit.
Clause 4
Work out the context you operate in, then set the scope: which AI systems, teams and activities the management system covers.
Clause 5
Top management commits to the system, sets an AI policy and assigns roles and responsibilities, so every part of the work has an owner.
Clause 6.1.2
Identify the risks each AI system could pose, then judge how likely and how serious each one is.
Clause 6.1.3
Choose how you’ll handle each risk and which controls will do it, check your choices against Annex A, then plan the work.
Clause 6.1.4
Beyond the risk to your organization, assess how each AI system could affect people, including those who never use it but live with its results.
Clause 7
Provide the resources the system needs, train the people involved for their part in it, and keep the documents that show how it runs.
Clause 8
Put the plans into operation. Carry out risk assessment, risk treatment and impact assessment as part of normal work, not only in the weeks before an audit.
Clause 9
Measure how the system performs, run internal audits at planned intervals, and have top management review the results and decide what changes.
Clause 10
When you find a nonconformity, correct it, deal with its cause so it doesn’t happen again, and keep improving the system over time.
Annex A
Annex A lists 38 controls, on topics from AI policy and impact assessment to data and third parties. Record which you apply, with the reason for each choice, in a Statement of Applicability.
ISO/IEC 42006:2025
An accredited certification body runs the audits and issues the certificate
ISO/IEC 17021-1
The first audit: stage 1 checks you’re ready, stage 2 how the system runs
ISO/IEC 17021-1
In the years between, surveillance audits check the system still works
ISO/IEC 17021-1
The usual life of a certificate, before a full recertification audit
A certificate covers your management system, not whether an AI system meets the Act. Under Article 40, presumption of conformity comes from harmonized standards cited in the Official Journal, not a 42001 certificate. [5]
You apply the controls your risks call for. The Statement of Applicability records which ones you include and which you exclude, with a reason for each. [1]
The 2026 Omnibus moved only the EU’s high-risk dates, to December 2, 2027 and August 2, 2028. ISO 42001 was never tied to them: it’s voluntary, and you and your certification body set the audit dates. [6]
What is ISO 42001?
ISO/IEC 42001 is the international standard for an AI management system: the policies, roles, processes and controls an organization uses to govern AI. Published in December 2023, it sets requirements for establishing, implementing, maintaining and continually improving that system. It covers organizations that provide or use AI, not only those that develop it.
How is ISO 42001 different from ISO 27001?
ISO 27001 manages information security. ISO 42001 manages AI, including risks and impacts that go beyond security, such as how a system’s results affect people. Both follow the same clause structure, 4 to 10, so scope, policy, internal audit and management review will look familiar. ISO 42001 doesn’t replace 27001, and the two can run as one integrated management system.
Is ISO 42001 mandatory?
No. It’s a voluntary standard, and there are no fines for not following it. Organizations get certified because customers, partners or tenders ask how they govern AI, and a certificate from an accredited body is a clear answer. Once you hold one, the risks are practical: nonconformities found at audit, a certificate you could lose, and buyer reviews you could fail.
How long does ISO 42001 certification last?
A certificate usually runs for three years. In the years between, the certification body returns for surveillance audits, usually once a year, to check the system still works. At the end of the cycle, a recertification audit starts the next one. Your certification body sets the exact schedule, so confirm it with them early, especially if your first audit is already booked.
What is a Statement of Applicability?
It’s the document that lists the Annex A controls, says which ones you apply and gives the reason for including or excluding each one. Annex A has 38 controls, and you don’t have to apply them all. The controls you choose should follow from your risk treatment, so the two documents tell the same story. Keep it current: when your AI systems or risks change, your choices may change too.
Who can certify us for ISO 42001?
An accredited certification body. ISO/IEC 42006, published in 2025, adds requirements for the bodies that certify ISO 42001, on top of ISO/IEC 17021-1. In the UK, UKAS accredited BSI as the first. Software and advisers can help you prepare, but they can’t certify you. Enzai isn’t a certification body: it holds the assessments, owners, evidence and reports your team works from.
Sources · Reviewed Oct 2026
