One-line summary
Published jointly by ISO and IEC in December 2023, ISO/IEC 42001:2023 is the world's first AI management system (AIMS) standard, requiring organizations to establish an auditable management framework covering the full AI system lifecycle.
Standard Overview
| Item | Details |
|---|---|
| Standard number | ISO/IEC 42001:2023 |
| Standard name | Information technology — Artificial intelligence — Management system |
| Publisher | ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission), developed by ISO/IEC JTC 1/SC 42 |
| Status | Published (International Standard, Edition 1, 51 pages) |
| Publication date | December 2023 |
Scope
ISO/IEC 42001:2023 applies to organizations of any size and industry that provide or use products or services involving AI systems, including AI developers, deployers and procurers. The standard does not mandate specific technical implementations; instead, it requires organizations to establish an auditable management framework covering the entire lifecycle of AI systems — design, development, deployment, use and retirement.
Key Requirements
| Clause | Content | Affected parties |
|---|---|---|
| Clause 4 Context of the organization | Determine internal and external issues, interested party requirements and the scope of the AIMS | All organizations establishing an AIMS |
| Clause 5 Leadership | Top management commitment, AI policy, roles and responsibilities | Top management |
| Clause 6 Planning | AI risk assessment, objectives and planning of changes | Management and risk teams |
| Clause 7 Support | Resources, competence, awareness, communication and documented information | All personnel |
| Clause 8 Operation | Operational planning and control across the AI system lifecycle | AI R&D and operations teams |
| Clause 9 Performance evaluation | Monitoring, measurement, internal audit and management review | Management |
| Clause 10 Improvement | Nonconformity correction and continual improvement | All personnel |
| Annex A | Controls A.1–A.9 (AI policy, AI impact assessment, data management, stakeholder communication, etc.) with implementation guidance | Organizations seeking certification and undergoing audits |
Compliance Recommendations
- Integrate the AIMS with existing management systems such as ISO 9001 (quality) and ISO/IEC 27001 (information security) to reduce duplication.
- Conduct AI impact assessments per Annex A and document potential impacts of AI systems on society, individuals and the environment.
- Align the standard with mandatory regulations such as the EU AI Act and China's Interim Measures for the Management of Generative AI Services to build a "standard + regulation" compliance stack.
- Obtain ISO/IEC 42001 certification through third-party bodies (e.g. Intertek, SGS) as external evidence of compliance.