TL;DR
ISO/IEC 42001:2023 'Information technology — Artificial intelligence — Management system' (AIMS), developed by ISO/IEC JTC 1/SC 42 and published on December 18, 2023 (54 pages), is the world's first certifiable AI management system standard. An organization can use it to establish, implement, maintain and continually improve an AI management system and obtain third-party certification.
Standard Overview
| Item | Content |
|---|---|
| Standard number | ISO/IEC 42001:2023 (Edition 1) |
| Title | Information technology — Artificial intelligence — Management system |
| Publisher | ISO and IEC jointly |
| Developer | ISO/IEC JTC 1/SC 42 (Artificial intelligence) |
| Status | Published (International Standard, stage 60.60) |
| Publication date | December 18, 2023 |
| Pages | 54 |
| Certification | Management system standard, certifiable by third parties |
Scope
This document applies to any organization providing or using products or services that utilize AI systems, including developers, providers and users of AI systems. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS), and provides guidance for responsible development and use of AI systems, covering ethics, transparency and continuous learning (per ISO and IEC Webstore official summaries). An organization conforming with the requirements can generate evidence of its responsibility and accountability regarding its role with respect to AI systems (per the foreword of ISO/IEC 42001:2023).
Key Clause Points
| Clause | Content | Affected parties |
|---|---|---|
| Clause 4 Context of the organization | Understand internal/external context and interested parties; define the scope of the AIMS | Organizations establishing an AIMS |
| Clause 5 Leadership | Top management commitment, AI policy and responsibilities | Management |
| Clause 6 Planning | Identify AI-related risks and opportunities; conduct AI system impact assessments; plan actions | AI project owners |
| Clause 7 Support | Resources, competence, awareness, communication | HR and compliance |
| Clause 8 Operation | Operational planning and control across the AI system lifecycle (design, development, deployment, use) | R&D and operations |
| Clause 9 Performance evaluation | Monitoring, measurement, analysis, internal audit, management review | Audit and quality |
| Clause 10 Improvement | Corrective action for nonconformities and continual improvement | All functions |
| Annex A Controls | Reference list of AI control objectives and controls for organizations to select as applicable | Compliance and engineering |
Compliance Advice
- Integrate the AIMS with existing management systems such as ISO/IEC 27001, reusing internal audit and management review mechanisms (per ISO's AI and information security bundle).
- Conduct AI system impact assessments and keep records as evidence of Clause 6 planning requirements.
- Review the Annex A control list item by item and produce the organization's own statement of applicable controls.
- Obtain AIMS certification from a third-party body to demonstrate compliance to regulators and stakeholders (per the IEC blog).
Official Sources
- ISO: ISO/IEC 42001:2023
- IEC Webstore: ISO/IEC 42001 publication
- China National Standards Information Public Service Platform: ISO/IEC 42001:2023 record