ISO/IEC 42001:2023 — Artificial Intelligence Management System

ISO/IEC 42001:2023 is the world’s first certifiable AI management system standard. It provides a structured framework for organisations to govern AI throughout its lifecycle — from policy and risk assessment to operational controls and continual improvement. It is suitable for organisations of all sizes and can be integrated with existing ISO management systems (27001, 9001).

Key requirements

Clause	Focus	What it demands
Context of the organisation (Clause 4)	External and internal factors, stakeholder needs	Define the scope of the AI management system, identify interested parties, and determine their requirements
Leadership (Clause 5)	Policy, roles, responsibilities	Establish an AI policy, assign accountability, and ensure resources and communication
Planning (Clause 6)	Risk and opportunity	Conduct AI risk assessment, define objectives, and plan actions to address risks and opportunities
Support (Clause 7)	Resources, competence, awareness, documentation	Provide adequate resources, train personnel, maintain documented information
Operation (Clause 8)	AI system lifecycle	Implement controls for design, development, deployment, and operation of AI systems
Performance evaluation (Clause 9)	Monitoring, audit, management review	Monitor AI system performance, conduct internal audits, and review management system effectiveness
Improvement (Clause 10)	Nonconformity and corrective action	Address incidents, implement corrective actions, and continually improve the AI management system

ATLAS connection

ISO 42001 provides the governance and lifecycle structure that ATLAS operationalises. Where ATLAS identifies specific risk-coordinate pairs (exposure path → control → evidence), ISO 42001 provides the management system wrapper that makes those pairs auditable and certifiable. The Approved AI Tool Register and Data Classification Before AI Use controls directly satisfy ISO 42001 operational requirements.

Official website →