ISO & IEC / Requirements
ISO/IEC 42001:2023 Govern AI as a management system
ISO/IEC 42001 specifies requirements for managing AI responsibilities, risks and opportunities across an organization. It addresses policies, processes and improvement for organizations that develop, provide or use AI systems.
The place in the system
Where it fits
It is an adjacent AI management-system requirements standard; 27090 narrows in on security threats to AI systems, while 27001 covers information security management.
Practical interpretation
How to use this reference
These are editorial starting points, not copied requirements or an implementation checklist from the standard.
Questions and actions
- Set the scope of AI systems and organizational responsibilities.
- Connect AI impact and risk decisions to development and procurement gates.
- Review incidents, monitoring results and stakeholder feedback for improvement.
Evidence to look for
- AI system register and scope
- AI policy and decision ownership map
- AI risk and review record
Illustrative example
What it could look like
A company uses AI in customer support and internal analysis, with different owners and data flows. It builds one management approach that records decisions about acceptable use, oversight and improvement across both cases.
Boundary to keep clear
A management system certificate does not by itself establish that an individual AI system is safe or that every law governing that system has been met.
Source and edition check
Open the official record
Research checked 2026-10-20. Catalogue status and edition can change; the official publisher record controls. Full standard text is not reproduced here.