Guide
ISO 42001: the AI management system for SMEs and SaaS companies
ISO/IEC 42001 is the international standard for an AI management system (AIMS). It sets out how an organisation governs the development, provision and use of AI systems, assesses their risks and impacts, and keeps improving all of this in a way it can demonstrate. It applies to any organisation that provides or uses AI-based products or services, regardless of size, and it can be certified by an accredited certification body. For SMEs and SaaS companies it pays off mainly when customers ask for solid evidence of responsible AI, or when an ISO 27001 ISMS is already in place.
- ISO and IEC published ISO/IEC 42001:2023 in December 2023. It is a management system standard, not a product label for a single AI system.
- The requirements sit in clauses 4 to 10. Annex A provides a reference set of controls; you select the ones that apply to you and justify your choices.
- The standard shares its basic structure with ISO 27001, so an existing ISMS can be extended instead of building a second system alongside it.
- An ISO 42001 certificate is not a conformity assessment under the EU AI Act. As of today, ISO/IEC 42001 is not listed as a harmonised standard in the EU Official Journal and therefore does not trigger a presumption of conformity.
- Only an accredited certification body can certify. Consultants prepare you; they do not issue certificates.
What the standard is
Publication, scope, certifiability.
Go to sectionStructure and Annex A
Clauses 4 to 10, nine control areas.
Go to sectionWho it is for
Providers, users and typical triggers.
Go to sectionHow it relates to ISO 27001
Shared structure, integration into your ISMS.
Go to sectionHow it relates to the EU AI Act
Support yes, presumption of conformity no.
Go to sectionImplementation step by step
From AI inventory to internal audit.
Go to sectionCertification
Who certifies and how the cycle works.
Go to sectionTechnical evidence
Why AI systems and agents need testing.
Go to sectionWhat ISO/IEC 42001 is
ISO/IEC 42001:2023 is titled "Information technology – Artificial intelligence – Management system". The first edition was published on 18 December 2023 and was developed by the joint committee ISO/IEC JTC 1/SC 42 (Artificial intelligence). The standard specifies requirements and gives guidance for establishing, implementing, maintaining and continually improving an AI management system within the context of an organisation.
Two points from its scope matter most for SMEs and SaaS companies:
- Providers and users are both covered. The standard is aimed at organisations that provide or use products or services built on AI systems. A SaaS provider with its own AI feature is in scope just as much as a company that wires third-party AI services into its processes.
- Size does not matter. The standard explicitly applies to any organisation, regardless of size, type and nature. The extent of the management system follows your actual use of AI, not a minimum company size.
One point is worth getting right before you aim for a certificate: ISO/IEC 42001 assesses the management system, meaning whether responsibilities, risk assessment, controls and improvement are handled systematically and actually practised. It does not certify that a particular AI model is error-free, fair or secure.
Structure of the standard and Annex A
Like other ISO management system standards, ISO/IEC 42001 consists of introductory clauses (scope, references, terms) followed by requirement clauses 4 to 10. To be certified, you must meet the requirements in these clauses.
Requirement clauses 4 to 10
The clause structure is harmonised across ISO management system standards. The AI-specific content sits mainly in planning and operation.
Three elements set an AI management system clearly apart from other management systems:
- AI risk assessment and risk treatment. Risks arising from developing, providing or using AI are assessed systematically and treated with controls.
- AI system impact assessment. The standard also requires an assessment of the potential impact of an AI system on individuals, groups and society. That goes beyond the organisation's own risk perspective.
- Statement of Applicability. From the catalogue in Annex A you choose the controls your risks require and document why controls are included or excluded. If you know ISO 27001, you know the principle.
Annex A: 38 controls in nine areas
Annex A contains 38 reference controls grouped into nine areas numbered A.2 to A.10. It is not a fixed mandatory list but the basis for your selection. Annex B gives implementation guidance for these controls, Annex C lists potential AI-related organisational objectives and risk sources, and Annex D describes use across domains and sectors.
| Area | Topic | What it means in practice |
|---|---|---|
| A.2 | Policies related to AI | An AI policy, its alignment with other policies and its regular review |
| A.3 | Internal organisation | Roles, responsibilities and a way to report concerns |
| A.4 | Resources for AI systems | Documenting data, tools, computing resources and competences |
| A.5 | Assessing impacts of AI systems | Assessing and recording impacts on individuals, groups and society |
| A.6 | AI system life cycle | Requirements, design, verification and validation, deployment, operation, monitoring, technical documentation |
| A.7 | Data for AI systems | Provenance, quality and preparation of data |
| A.8 | Information for interested parties | Documentation and information for users, reporting of incidents |
| A.9 | Use of AI systems | Responsible use and the intended purpose |
| A.10 | Third-party and customer relationships | Allocating responsibility along the supply chain, suppliers and customers |
The column "What it means in practice" is our summary. The exact wording of each control is only in the licensed text of the standard.
Who ISO 42001 is for
Certification is voluntary. Whether it is worth it depends less on company size than on the role AI plays in your business and on who is asking for evidence.
| Situation | Assessment |
|---|---|
| SaaS provider with AI features in the product, selling to enterprises, financial services, healthcare or the public sector | Strong candidate. A certificate answers AI governance questions in customer questionnaires and tenders with independent evidence. |
| Company with an existing ISO 27001 ISMS | Good candidate. Much of the management system work is already done; ISO 42001 is added as an extension. |
| Provider of AI agents or integrations that act on customer systems on their own | Good candidate. Risk and impact assessment, life cycle and supply chain are not paperwork here but product quality. |
| Company that mainly uses AI tools internally, with no customer requirement | A lean framework is usually enough to start: AI inventory, policy, owners, risk classification. The standard works as a reference without certifying straight away. |
An honest test: if no customer, investor or partner is going to ask for evidence of AI governance in the next twelve months, certification is rarely your most urgent project. Building the foundations the standard describes still makes sense, because you will need them for the EU AI Act as well.
How it relates to ISO 27001
ISO/IEC 42001 and ISO/IEC 27001 both follow the Harmonized Structure, formerly the High Level Structure, that ISO defines for management system standards. It prescribes common clause numbers, clause titles, core text and core terms. That is why the two standards fit together seamlessly at the management system level.
| Element | Can be shared | New with ISO 42001 |
|---|---|---|
| Context and scope | Method, interested parties, document control | Your role as AI provider, AI user or both |
| Leadership and policy | Management commitment, role model | A dedicated AI policy |
| Risk | Risk assessment method, risk register | AI-specific risk sources and the impact assessment for affected people |
| Controls | Statement of Applicability as a principle | Controls from ISO 42001 Annex A, for example on life cycle and data |
| Evaluation and improvement | Internal audit, management review, corrective action | AI-related metrics and audit topics |
In practice, an existing ISMS is extended, not duplicated. A shared risk register, a shared internal audit and a shared management review can cover both standards. Ask your certification body whether it can assess both standards in a combined audit. The reverse also holds: ISO 42001 does not replace information security. Access control, vulnerability management and secure development remain the subject of ISO 27001. For a pragmatic way to build an ISMS in a SaaS company, see our article on ISO 27001 for SaaS startups.
How it relates to the EU AI Act
The EU AI Act, Regulation (EU) 2024/1689, is law. ISO/IEC 42001 is a voluntary standard. They complement each other, but they are not the same thing.
What the standard does
An AI management system builds many of the foundations the AI Act assumes: a complete picture of the AI systems in use, clear responsibilities, a documented risk assessment, control across the life cycle and evidence that is kept up to date. If you implement ISO 42001, you have a solid structure for mapping and working through your AI Act obligations. Which obligations apply to you depends on your role and on the risk class of your systems. Our article on the AI Act and AI governance gives an overview.
What the standard does not do
Under Article 40 of the AI Act, a presumption of conformity only applies to harmonised standards whose references have been published in the Official Journal of the European Union, and only for the requirements those standards cover. The Commission published the first and so far only such reference in Implementing Decision (EU) 2026/2274 of 12 October 2026, which appeared in the Official Journal on 14 October 2026. It lists exactly one standard: EN 18286:2026, a quality management system for EU AI Act regulatory purposes. It addresses the quality management system that providers of high-risk AI systems must put in place under Article 17.
ISO/IEC 42001 is not on that list. As of 28 October 2026, this means:
- No automatic presumption of conformity. An ISO 42001 certificate on its own does not create a presumption that you meet the requirements of the AI Act.
- No conformity assessment. A management system certificate does not replace the conformity assessment procedure the AI Act sets out for high-risk AI systems.
- A good starting point for EN 18286. According to the European standardisation committee CEN-CENELEC JTC 21, EN 18286 contains an informative annex on its relationship with ISO/IEC 42001. If you already run an AI management system, you can build on it.
Further harmonised standards for the AI Act are in progress. Before making any statement to customers or authorities, check the current state of the Official Journal. The legal assessment of your specific case belongs with your legal counsel.
Implementation step by step
An AI management system is not created in a document pack but in day-to-day operation. This order has proven itself:
- Define scope and role. Which products, sites and processes are included? Are you a provider, a user or both? A scope drawn too wide drags the project out; one drawn too narrow makes the certificate meaningless to customers.
- Build an AI inventory. Record every AI system, including embedded features in purchased software, model APIs and AI agents with tool access. What is not in the inventory cannot be assessed.
- Policy and responsibilities. Adopt an AI policy, name owners and set up a way to report concerns. Top management has to stand behind it visibly; the audit checks for that.
- Risk and impact assessment. For each system, assess risks to the organisation and impacts on the people affected. For AI agents this includes technical risks such as prompt injection, overly broad permissions and uncontrolled data leakage.
- Controls and Statement of Applicability. Select controls from Annex A, implement them and justify why others do not apply.
- Operation and evidence. Apply the controls in daily work and document them so that a third party can follow them. An audit checks evidence from operation, not statements of intent.
- Internal audit and management review. Before the certification audit, run a complete check yourself, fix the nonconformities and cover the results in the management review.
Certification
Who certifies
An ISO 42001 certificate is issued by a certification body that a national accreditation body has accredited for this purpose. In Germany that is the Deutsche Akkreditierungsstelle (DAkkS). Since July 2025, bodies that audit and certify AI management systems are also subject to ISO/IEC 42006:2025. It adds AI-specific requirements, for example on auditors' subject-matter knowledge, to the general requirements for management system certification bodies in ISO/IEC 17021-1.
Before you sign, ask the body to show you that its accreditation explicitly covers ISO/IEC 42001. A certificate without accreditation for this standard carries considerably less weight with customers and in tenders.
Consulting and certification are separate roles. CyberSec42 is not a certification body and does not issue certificates. We help you prepare and provide technical test evidence.
How the audit works
| Phase | What happens |
|---|---|
| Stage 1 | The certification body reviews documentation, scope and readiness for the main audit. |
| Stage 2 | The body checks whether the management system is implemented and effective, using interviews and samples from operation. |
| Certificate | Once any nonconformities are resolved, the certificate is issued, typically valid for three years. |
| Surveillance audits | In the years in between, the body checks annually that the system is still effective. |
| Recertification | Before the certificate expires, a recertification audit starts the next cycle. |
How long it takes
There is no honest one-size-fits-all figure. The timeline depends mainly on four things: whether a management system under ISO 27001 or ISO 9001 is already running, how many AI systems are in scope, whether a complete AI inventory exists and how quickly evidence from operation builds up. An audit needs records from an actual period of operation, not just finished documents. Plan in months rather than weeks, and ask your certification body early about its lead time.
Why technical evidence belongs in the picture
Many Annex A controls can be evidenced with policies and processes. For some, that is not enough. Verification and validation across the life cycle, monitoring in operation and your responsibilities towards customers all assume that you know how your AI system actually behaves, including under attack.
This is most obvious with AI agents that call tools, read data or trigger actions through interfaces such as the Model Context Protocol. A policy can state that an agent only uses approved tools and never discloses confidential data. Whether that holds only becomes clear through targeted testing. Typical questions:
- Can manipulated input from a web page, a document or an email push the agent into unintended actions?
- Are the agent's permissions limited to what it needs, or can it do more than its purpose requires?
- Are third-party tools, servers and models integrated so that one compromised component does not open up the whole system?
- Are logging and monitoring set up so that misbehaviour gets noticed?
Read more in our article on AI agent security and on our AI and MCP security page.
The checklist
| Area | Measure |
|---|---|
| Decision | Clear who is asking for evidence and whether a certificate or alignment with the standard is enough |
| Scope | Products, processes and role as provider or user defined |
| Inventory | All AI systems recorded, including embedded features, model APIs and agents |
| Leadership | AI policy adopted, owners named, reporting channel in place |
| Risk | AI risk assessment and impact assessment documented per system |
| Controls | Statement of Applicability with reasons for inclusions and exclusions |
| Technical | Key security claims about AI systems and agents tested technically |
| Supply chain | Providers of models, tools and services assessed, responsibilities set out in contracts |
| Integration | With an existing ISMS: risk register, internal audit and management review run jointly |
| Evaluation | Internal audit done, nonconformities fixed, management review completed |
| Certification | Certification body's accreditation for ISO/IEC 42001 verified |
| AI Act | Own obligations by role and risk class assessed legally, status of harmonised standards checked |
How we help
We prepare you for certification and provide the technical evidence that a documentation-only project cannot produce. The certificate itself is issued by the accredited certification body of your choice. We tailor the scope to your systems and prepare an individual offer. Details are on our compliance readiness page.
ISO 42001 readiness
- Gap analysis against clauses 4 to 10 and Annex A
- AI inventory, risk and impact assessment
- Statement of Applicability, integration into an existing ISMS
- Audit-ready evidence per requirement, audit preparation
Technical testing of AI systems
- Authorised testing of AI applications and agents within the agreed scope
- Prompt injection, permissions, tool integration via MCP
- One proof of concept per finding
- A report that feeds into your management system as evidence
How far along is your AI management system?
In a free initial call we work out whether ISO 42001 is the right step for you, what is already in place and which gaps would need closing before a certification audit.
Book a free callCyberSec42 provides independent technical security testing. It is not an accredited certification body and does not provide legal advice. ISO/IEC 42001 certificates are issued only by an accredited certification body.
Frequently asked questions
What is ISO 42001?
ISO/IEC 42001:2023 is the international standard for AI management systems. It sets out how an organisation governs the development, provision and use of AI systems, assesses risks and impacts, and continually improves the system. ISO and IEC published it in December 2023, and it can be certified.
Is ISO 42001 mandatory?
No. The standard is voluntary. It can become a de facto requirement when customers or tenders ask for evidence. Legal obligations for AI in the EU come from the AI Act, not from the standard.
Does an ISO 42001 certificate mean compliance with the EU AI Act?
Not automatically. A presumption of conformity under Article 40 of the AI Act only exists for harmonised standards whose references are published in the EU Official Journal. ISO/IEC 42001 is currently not listed there. The standard does, however, help you implement and evidence your AI Act obligations in a structured way.
How many controls does Annex A contain?
Annex A contains 38 reference controls in nine areas, numbered A.2 to A.10. You select the controls your risks require and justify exclusions in the Statement of Applicability.
Do I need ISO 27001 first?
No, ISO 42001 can be implemented and certified on its own. An existing ISO 27001 ISMS does make it much easier, because both standards share the same basic structure and risk management, internal audit and management review can be shared.
Who issues the certificate?
A certification body accredited for ISO/IEC 42001, in Germany by DAkkS. Consultancies, CyberSec42 included, prepare you and provide evidence, but they do not certify.
Further reading
- The AI Act and AI governance: what companies need to do now
- ISO 27001 for SaaS startups
- AI agent security
- Service: compliance readiness
- Service: AI and MCP security
Sources
- ISO: ISO/IEC 42001:2023, Information technology – Artificial intelligence – Management system
- IEC Webstore: ISO/IEC 42001:2023, publication and scope
- ISO: ISO/IEC 42006:2025, requirements for bodies providing audit and certification of AI management systems
- ISO: ISO/IEC 27001:2022, information security management systems
- EUR-Lex: Regulation (EU) 2024/1689 (Artificial Intelligence Act)
- EUR-Lex: Implementing Decision (EU) 2026/2274 on harmonised standards for high-risk AI systems
- European Commission: Standardisation of the AI Act
- CEN-CENELEC: EN 18286:2026 published in the Official Journal