ISO/IEC 42001: what the AI management standard is and who it applies to

When a client or partner asks whether your company “complies with ISO 42001,” it helps to know what that standard is before answering. This guide gathers what can be stated from open sources.

A note: the data on the standard comes from the IEC listing and from an article by Estonia’s standards body that cites the IEC (both at the end, consulted in November 2026). The standard’s page on iso.org returned a 403 error and the full text is paid, so we did not review it and do not describe its clauses. What is Cyrrus’s judgment, we say so.

What is ISO/IEC 42001?

According to the IEC listing, ISO/IEC 42001:2023 specifies requirements and gives guidance for establishing, implementing, maintaining and continually improving an AI management system within an organization. It is an international standard, not a law.

Has anyone asked you about ISO/IEC 42001?

We design your organization’s AI Governance framework: what can be automated, what needs human oversight, and who is accountable for each decision.

• Risk map by use case, not a generic policy
• Defined roles between business, IT, and legal

Learn about AI Governance

Who does it apply to?

The IEC listing says it applies to any organization, regardless of size, type and nature, that provides or uses products or services that utilize AI systems. In other words, it is not limited to those who develop AI: it includes those who use it.

Can you be certified?

Estonia’s standards body, citing the IEC, reports that ISO/IEC 42006 defines additional requirements for bodies that audit and certify AI management systems against ISO/IEC 42001, and that it builds on ISO/IEC 17021-1 without replacing it. In other words, a standard exists for those who certify. We did not review which certifiers are accredited in your country or what a certification costs or how long it takes: we have no primary source and give no figures.

Define the scope before thinking about certification

We help your leadership team decide what to delegate, what to supervise, and what to never automate — before adoption outruns control.

• Governance committee with business, IT, legal, and security
• Clear criteria for approving new AI use cases

Schedule a conversation about AI Governance

What we do not state

We do not describe the requirements by clause or the standard’s controls, because we did not read the text. Nor do we state that meeting it equals meeting the EU AI Act or any other law: we found no official equivalence in the sources reviewed. If a vendor or adviser tells you otherwise, ask for the source.

The same goes for its relationship with the NIST framework: they are different documents, one a voluntary risk management framework and the other a management system standard, and any mapping between them would be our own judgment.

What leadership needs to decide

Four questions, from Cyrrus’s judgment. First, who is asking and what they expect: a certificate, or alignment with the standard. Second, which AI systems fall within scope, those you build and those you only use. Third, who will be the owner inside the company. Fourth, who will pay for the audit; any figure should come from a quote, not a rule of thumb.

To see how it fits with other frameworks and with regulations, read what AI governance is and which frameworks to use and what evidence your company should be able to show.