ISO/IEC 42001 certification, explained
ISO/IEC 42001 is the first management system standard for artificial intelligence (AI). It helps an organization that develops, provides or uses AI systems govern them responsibly, with attention to risk, impact on people, transparency and oversight. It suits software firms, data and analytics teams and organizations that buy or deploy AI tools. Independent certification bodies audit the management system, not individual AI products.
Updated 5 November 2026
Info. Showing a standard does not mean a partner holds scope for it. How matching works.
Who it may be relevant for
- Companies building or selling AI-enabled products and services
- Organizations deploying third-party AI tools in decisions that affect customers or staff
- Data and analytics teams wanting consistent governance across projects
- Suppliers whose customers ask how AI risks are managed
What it covers
- An AI policy, defined roles and accountability for AI activity
- Risk assessment and assessment of the impact of AI systems on people and society
- Controls across the AI system lifecycle, from design and data to monitoring and retirement
- Managing third-party AI components and suppliers
- Monitoring, internal audit, management review and improvement
What it can help with
- A common governance structure across AI projects instead of project-by-project rules
- Clearer thinking on risks such as bias, transparency, data quality and human oversight
- A documented answer for customers and partners who ask how AI is governed
- A structure that can share work with ISO/IEC 27001 where both are used
What the pathway means
ISO/IEC 42001 is a certifiable management-system standard. An independent certification body audits your AI management system through Stage 1, Stage 2, a decision, surveillance audits and recertification. A certificate is about the organization's management system and scope. It is not a safety, accuracy or fairness rating of a particular AI system and does not mean compliance with any AI law. Scheme and auditor availability for this newer standard should be checked. MIYAAR CONNECT does not audit or certify. We connect your inquiry with independent certification bodies.
Edition. ISO/IEC 42001:2023 is the edition we found as current. National bodies in some regions have published adoptions dated 2026 of the same text. Ask the certification body which text applies.
The typical process
Steps and timing vary by body and scope. This is the usual shape, not a promise.
- You and us
Your inquiry
You describe your needs and share the basics.
- Certification body
Application and contract review
The body reviews your scope, sites and size, then quotes.
- Certification body
Stage 1 audit
A readiness review of your management system documentation.
- Certification body
Stage 2 audit
An evaluation of how the system works in practice.
- This part is theirs
Certification decision
Made by the certification body, never by MIYAAR CONNECT.
- Certification body
Surveillance and recertification
Periodic surveillance audits, then recertification at the end of the cycle.
Where it is typically used
- A software company setting approval and monitoring steps for models released to customers
- A bank or insurer documenting how AI-assisted decisions are reviewed by people
- A service business controlling its use of third-party generative AI tools
What affects cost
- Number of employees
- Number of sites
- Complexity of what you do and its risks
- Number and complexity of AI systems and use cases within the scope
- Whether you build AI, provide it to others or only use third-party tools
- Sensitivity of the affected decisions, which may bring in specialist auditors
- The number of sites and teams involved, and any overlap with an existing security system
What affects timing
- Time to inventory AI systems and decide on the scope
- Building impact and risk assessment practice where none exists
- Evidence that lifecycle controls are used, not only written
- Limited auditor availability for a newer standard in some regions
What to have ready
- A list of AI systems or AI-enabled services you develop, provide or use
- A description of who makes decisions about AI and who reviews them
- Any existing governance, risk or security policies, described not uploaded
- Customer or regulator expectations that mention AI governance
- Do not send model code, training data or customer data at the inquiry stage
Accreditation and recognition
A certificate says something about a management system and its scope. Certification bodies are assessed by accreditation bodies for defined scopes, and accredited schemes for newer standards may not be available everywhere, so verify for your case. Ask for the certificate number and scope, then confirm the body's accreditation with the accreditation body or through the Global Accreditation Cooperation Incorporated (Global ACI) arrangement, which took over from the IAF and ILAC on 1 January 2026. Certification does not mean compliance with AI laws, and buyers decide what to accept.
Common questions
Does it certify that our AI is safe or accurate?
We only use third-party AI tools. Is it relevant?
Is it the same as an AI law?
How does it relate to ISO/IEC 27001?
Related standards
Relevant industries
Useful reading
Sources
- ISO: ISO/IEC 42001:2023 AI management systems (checked 5 November 2026)
- ISO: AI management systems, what businesses need to know (checked 5 November 2026)
Ask about availability for ISO/IEC 42001
We review availability for each inquiry. If no verified certification body fits your request, we will tell you plainly.