ISO 42001 compliance guide: how to achieve compliance?

What is ISO 42001?

ISO 42001 is a management system standard, in the same way that ISO 27001 is for information security. It describes how to govern AI responsibly: policies, objectives, roles, risk and impact management, operational controls and continual improvement.

It is technologically neutral and adapts to any organisation that develops, provides or uses AI systems. Its certification demonstrates, to third parties, a mature and trustworthy AI governance framework.

Its true value is twofold: it internally structures what is often a disorganised AI practice, and it sends a verifiable trust signal externally.

Who is affected?

Any organisation making significant use of AI can pursue ISO 42001, whether as a provider or a user. The standard is particularly relevant for actors whose AI applications touch on sensitive issues.

• AI publishers and integrators seeking to reassure their market.
• Large enterprises and mid-sized companies deploying AI at scale.
• Organisations subject to the AI Act wishing to have a structured organisational framework.
• Service providers responding to tenders that require AI governance guarantees.

What does the standard contain?

ISO 42001 combines a management framework common to ISO standards with elements specific to AI.

• A management structure (clauses 4 to 10) common to ISO standards.
• An AI policy and measurable objectives.
• Risk management and impact assessment of AI systems.
• Controls in Annex A (data, transparency, lifecycle, third parties, security).
• Documentation, competence and awareness requirements.
• An internal audit mechanism, management review and continuous improvement.

ISO 42001, AI Act, ISO 27001, GDPR: how do they fit together?

These frameworks overlap significantly. Building them together avoids duplicating the same governance and documentation work three times over.

What penalties apply in the event of non-compliance?

ISO 42001 is a voluntary standard: there are no fines, but the commercial and regulatory stakes are concrete and often decisive in B2B markets.

How to achieve compliance: the 7-step roadmap

Step 1 — Define the context and scope

Identify the AI systems concerned, the interested parties, and the issues at stake. Delimit the scope of the AIMS, from a single flagship product to the entire organisation.

A well-defined scope makes initial certification achievable; it can be extended afterwards.

• Inventory your AI systems and their use cases.
• Identify legal requirements (including the AI Act) and contractual obligations.
• Delimit a realistic scope for the AIMS.

Step 2 — Engage leadership

Have the AI policy championed by senior management, define roles and responsibilities, and allocate resources. Without top-management commitment, the AIMS cannot hold.

AI governance is a board-level matter, not just a data science concern.

• Have the AI policy validated by senior management.
• Define roles, responsibilities, and resources.
• Embed AI governance into steering bodies.

Step 3 — Assess risks and impacts

Conduct AI risk management and a system impact assessment (on individuals, rights, and society), then plan treatments.

The impact assessment is the standard's defining feature: it looks beyond the organisation, towards the people affected.

• Perform risk management for each system.
• Conduct the AI system impact assessment.
• Plan and track risk treatments.

Step 4 — Deploy Annex A controls

Select and implement the relevant controls: data governance, transparency, lifecycle management, security, third-party management.

Build on your existing ISO 27001 controls: significant overlaps exist.

• Select the relevant Annex A controls.
• Reuse your ISO 27001 controls where possible.
• Document their implementation.

Step 5 — Document and train

Formalise policies, procedures, and records, and develop teams' competence and awareness of responsible AI (AI literacy), in alignment with the AI Act.

Documentation must reflect actual practices, not intentions.

• Formalise policies, procedures, and records.
• Train teams on responsible AI.
• Align AI literacy with the AI Act.

Step 6 — Audit and review

Conduct internal audits, a management review, and address gaps. This is the engine of continual improvement required by the standard.

These reviews also prepare you for the certification audit.

• Schedule regular internal audits.
• Hold a management review.
• Address gaps and track corrective actions.

Step 7 — Achieve certification

Select an accredited certification body, undergo the initial audit (stages 1 and 2), close any nonconformities, and maintain certification through surveillance audits.

Certification is the trust signal that validates all the effort invested.

• Select an accredited certification body.
• Complete the stage 1 (documentary) and stage 2 (implementation) audits.
• Maintain the certificate through surveillance audits.

Common mistakes to avoid

• Treating ISO 42001 as a documentation project without changing actual practices.
• Neglecting the impact assessment of AI systems, which is the distinctive core of the standard.
• Failing to align the AIMS with GDPR and the AI Act to avoid redundancies.
• Underestimating management commitment and team awareness.
• Targeting too broad a scope for the initial certification.
• Ignoring overlaps with ISO 27001 and duplicating work already completed.