CYBER SECURITY COMPLIANCE · ISO 42001
ISO/IEC 42001: 2023
AI Management System Assessment and Certification Readiness
ISO/IEC 42001:2023 is the first international management system standard for artificial intelligence, and it remains the only certifiable one. What changed since it appeared is the infrastructure behind the certificate: ISO/IEC 42006:2025 now governs the bodies that audit and certify AI management systems, which means the accreditation behind a certification body decides what a certificate is worth. Elevate Consult builds the AIMS, runs the assessment, and prepares organizations for a two-stage audit by a body whose accreditation actually covers the standard.
2026 UPDATE
What changed and what it means now
The 2022 edition restructured Annex A from 114 controls in fourteen domains into 93 controls across four themes, with eleven controls new to the edition.
Certification body accreditation is now governed by ISO/IEC 42006:2025
Certification bodies audit under ISO/IEC 17021-1 supplemented by ISO/IEC 42006:2025, which adds AI-specific requirements covering auditor competence and audit duration. The European co-operation for Accreditation voted in November 2025 to make it the mandatory standard for accrediting bodies that certify AI management systems. A certificate from a body without that accreditation will not satisfy the buyers most organizations certify to reach.
Applicant status and pilot participation are not accreditation
Both appear in vendor material as though they were. A body listed on an accreditation body’s applicants page is an applicant. A participant in an accreditation pilot programme is a participant. Verify on the accreditation body’s own register and ask the certification body for its accreditation certificate directly.
The accredited population is still small and growing on a rolling basis
Accreditation grants moved through 2026 across ANAB, UKAS, RvA and several other national bodies, but the pool of accredited certification bodies remains limited. Availability of an accredited body in a given market is a real scheduling constraint, not a formality.
WHAT IT IS
A management system for AI governance, not a model certification
ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. It follows the same harmonized structure as ISO 27001 and ISO 9001, which means organizations already running a certified management system hold most of the scaffolding.
It certifies the system of governance around AI, not any individual model. That distinction produces most early scoping errors: an organization does not certify its recommendation engine, it certifies the AIMS that governs how it develops, procures, deploys and monitors AI within a defined scope. The scope statement appears on the certificate and is usually narrower than the whole organization.
KEY CONTROL AREAS
What the standard actually requires
Annex A carries the AI-specific controls, subject to a statement of applicability in the same way Annex A works under ISO 27001. An organization justifies inclusion or exclusion rather than implementing everything by default.
AI policy and governance
Clause 5 and Annex A
AI policy, organizational roles and responsibilities, decision authority, and the mechanism through which staff raise AI concerns.
Resources and data
Annex A
Data governance for AI systems, resource allocation, competence and the provenance of data used across the lifecycle.
AI system lifecycle
Annex A
Design, development, verification, deployment, operation and decommissioning, with control at each transition.
Impact assessment
Clause 6 and Annex A
Effects on individuals, groups and society. This is the requirement with no direct analogue in ISO 27001 and the one teams most often underestimate.
Use and monitoring
Clauses 8 and 9
Operational control, performance monitoring, drift detection and the thresholds that trigger action.
Third party and customer relationships
Annex A
Obligations that flow to and from suppliers of AI systems and components, and to the customers who rely on outputs.
OUR PROCESS
Assessment, readiness and certification support
Elevate Consult delivers ISO 42001 work as annual assessment, readiness engagement, or full certification support depending on where an organization sits.
Control testing
Test control effectiveness through document review of requested evidence, staff interviews to understand the controls in operation, and process walkthroughs to observe current practice.
Reporting
A report covering observed practice, areas of conformity, identified gaps, and prioritized recommendations with improvement opportunities.
Follow-up and ongoing support
Guidance on implementing recommended changes and preparing for certification or recertification, plus support across the three-year cycle as the AI estate and the regulatory position both move.
Initial review
Examine existing AIMS documentation and processes, and request initial evidence where the assessment requires it.
Gap analysis
Identify discrepancies between current practice and the requirements, with each gap carrying its risk, owner and remediation path.
Certification body verification
Confirm a prospective certification body holds accreditation covering ISO/IEC 42001 on the accreditation body’s own register before an organization signs.
ENGAGEMENT PHASES
How the work runs
WHO THIS IS FOR
Roles Elevate works with on this standard
GET STARTED
Ready to assess your AI management system?
Whether the driver is an enterprise buyer asking for a certificate, an annual assessment cycle, or a first ISO 42001 engagement, Elevate Consult provides the inventory, gap analysis, control testing and certification readiness that gets an AIMS to an accredited audit.
FAQ
Common Questions
Who can issue an ISO 42001 certificate?
Only a certification body accredited to certify AI management systems. Those bodies audit under ISO/IEC 17021-1 supplemented by ISO/IEC 42006:2025 and are accredited by national accreditation bodies such as ANAB, UKAS and RvA. Verify accreditation on the accreditation body’s public register and confirm ISO/IEC 42001 is explicitly within the accredited scope. A body listed as an applicant, or as a pilot participant, is not accredited.
Does ISO 42001 certify an AI model?
No. It certifies the management system governing how an organization develops, procures, deploys and monitors AI within a defined scope. The scope statement appears on the certificate and is usually narrower than the entire organization, so anyone evaluating a certificate should read the scope rather than assuming enterprise-wide coverage.
How does ISO 42001 relate to the EU AI Act and NIST AI RMF?
ISO 42001 is a voluntary, certifiable management system standard. The EU AI Act is binding law with risk-tiered obligations. The NIST AI RMF is voluntary guidance with no certification path. Certification does not satisfy the Act, and complying with the Act does not produce a certificate. An AIMS designed to generate evidence all three regimes recognize avoids running parallel programs.
We already run ISO 27001. How much carries over?
A substantial amount. The Clause 4 to 10 structure, risk register, management review, internal audit programme and policy scaffolding all transfer. What does not transfer is the AI impact assessment, which examines effects on individuals, groups and society rather than on the organization, along with AI-specific risk categories such as bias, drift and explainability.
How long does ISO 42001 certification take?
It depends on AIMS scope, the number and diversity of AI systems in scope, and whether an existing certified management system supplies the governance scaffolding. Two constraints do not compress with budget: internal audit and management review must actually happen before the certification audit, and evidence of control operation accrues on calendar time.
What is the AI impact assessment?
A documented assessment of the effects an AI system may have on individuals, groups and society, distinct from the organizational risk assessment. It is the requirement most specific to this standard and the one teams coming from information security most often underestimate, because its subject is external harm rather than organizational exposure.