Framework
ISO/IEC 42001:2023 — Sistema de Gestión de Inteligencia Artificial
La primera norma internacional que especifica requisitos para establecer, implementar, mantener y mejorar continuamente un sistema de gestión de IA en una organización.
Lectura práctica
La primera norma internacional que especifica requisitos para establecer, implementar, mantener y mejorar continuamente un sistema de gestión de IA en una organización.
ISO/IEC 42001:2023 is the world’s first certifiable AI management system standard. It provides a structured framework for organisations to govern AI throughout its lifecycle — from policy and risk assessment to operational controls and continual improvement. It is suitable for organisations of all sizes and can be integrated with existing ISO management systems (27001, 9001).
Key requirements
| Clause | Focus | What it demands |
|---|---|---|
| Context of the organisation (Clause 4) | External and internal factors, stakeholder needs | Define the scope of the AI management system, identify interested parties, and determine their requirements |
| Leadership (Clause 5) | Policy, roles, responsibilities | Establish an AI policy, assign accountability, and ensure resources and communication |
| Planning (Clause 6) | Risk and opportunity | Conduct AI risk assessment, define objectives, and plan actions to address risks and opportunities |
| Support (Clause 7) | Resources, competence, awareness, documentation | Provide adequate resources, train personnel, maintain documented information |
| Operation (Clause 8) | AI system lifecycle | Implement controls for design, development, deployment, and operation of AI systems |
| Performance evaluation (Clause 9) | Monitoring, audit, management review | Monitor AI system performance, conduct internal audits, and review management system effectiveness |
| Improvement (Clause 10) | Nonconformity and corrective action | Address incidents, implement corrective actions, and continually improve the AI management system |
ATLAS connection
ISO 42001 provides the governance and lifecycle structure that ATLAS operationalises. Where ATLAS identifies specific risk-coordinate pairs (exposure path → control → evidence), ISO 42001 provides the management system wrapper that makes those pairs auditable and certifiable. The Approved AI Tool Register and Data Classification Before AI Use controls directly satisfy ISO 42001 operational requirements.