ISO/IEC 42001:2023 — Artificial Intelligence Management System

ISO/IEC 42001:2023 is the first international AI management system standard. It provides a structured framework for organisations to govern AI throughout its lifecycle — from policy and risk assessment to operational controls and continual improvement — and can be integrated with existing ISO management systems such as ISO/IEC 27001 and ISO 9001.

Standard, management system and certification are not the same thing

ATLAS separates three distinct concepts:

• Standard. ISO/IEC 42001:2023 is the published specification. It is a normative document.
• Management system. An AI management system (AIMS) is the organisation’s implementation of the standard: policy, roles, risk assessment, controls and documented information.
• Certification. Certification is granted by an accredited certification body after an audit of the management system. It is a property of the organisation’s system and audit outcome, not of the standard itself.

Saying that ISO/IEC 42001 is “a certifiable standard” is imprecise shorthand; the standard specifies requirements that a management system can be certified against.

Key requirements

Clause	Focus	What it demands
Context of the organisation (Clause 4)	External and internal factors, stakeholder needs	Define the scope of the AI management system, identify interested parties and determine their requirements
Leadership (Clause 5)	Policy, roles, responsibilities	Establish an AI policy, assign accountability and ensure resources and communication
Planning (Clause 6)	Risk and opportunity	Conduct AI risk assessment, define objectives and plan actions to address risks and opportunities
Support (Clause 7)	Resources, competence, awareness, documentation	Provide adequate resources, train personnel, maintain documented information
Operation (Clause 8)	AI system lifecycle	Implement controls for design, development, deployment and operation of AI systems
Performance evaluation (Clause 9)	Monitoring, audit, management review	Monitor AI system performance, conduct internal audits and review management system effectiveness
Improvement (Clause 10)	Nonconformity and corrective action	Address incidents, implement corrective actions and continually improve the AI management system

ATLAS connection

ISO/IEC 42001 provides the governance and lifecycle structure that ATLAS operationalises. Where ATLAS identifies specific risk-coordinate pairs (exposure path → control → evidence), ISO/IEC 42001 provides the management system wrapper that makes those pairs auditable. The Approved AI Tool Register and Data Classification Before AI Use controls support ISO/IEC 42001 operational requirements.

Primary source →