Clause 4
Context and scope
Your role with respect to AI, the internal and external issues that matter, interested parties, and the boundaries of the AI management system.
ISO/IEC 42001:2023
ISO 42001 compliance
What an AI management system has to contain, the Annex A controls, how certification works, and where it does and does not help with the EU AI Act.
ISO/IEC 42001:2023 is the international, certifiable standard for an AI management system (AIMS) — the policies, roles, processes and controls an organisation uses to develop, provide or use AI responsibly. It follows the same clause structure as ISO 27001: context, leadership, planning, support, operation, performance evaluation and improvement in clauses 4 to 10, with AI-specific requirements for risk assessment, risk treatment and AI system impact assessment. Annex A lists 38 reference controls under nine objectives, selected through a statement of applicability. Certification is voluntary, but it is fast becoming what enterprise buyers ask AI vendors for, and it gives the EU AI Act's governance duties an auditable home.
Key takeaways
- ISO 42001 is a management system standard: it certifies how you govern AI, not that a particular model is safe.
- Clauses 4 to 10 share their structure with ISO 27001, so an existing ISMS gives you the skeleton.
- AI-specific requirements centre on AI risk assessment, risk treatment and AI system impact assessment (clauses 6.1.2 to 6.1.4).
- Annex A holds 38 controls under nine objectives; a statement of applicability records which apply and why.
- It supports EU AI Act readiness but is not a harmonised standard, so certification does not by itself presume conformity.
Scope
Who ISO 42001 applies to
ISO 42001 has no legal scope — you choose to adopt it. Where it earns its keep is predictable.
- AI vendors whose enterprise customers ask how their AI is governed, and want an answer that is certified rather than asserted.
- Organisations already running ISO 27001 who want AI governance inside the same management system, audited by the same kind of body.
- Providers and deployers preparing for the EU AI Act, who need an inventory, risk and impact assessment, and human oversight that operate before the high-risk deadlines.
- Companies using third-party AI in decisions about people — hiring, credit, customer support — that need to show they assessed the impact.
- You set the AIMS scope yourself: which AI systems, which roles (developer, provider, user) and which parts of the organisation are covered.
Requirements
What ISO 42001 requires
The clauses are mandatory for certification; Annex A controls are selected through the statement of applicability.
Clause 5
Leadership and AI policy
Top management commitment, an AI policy aligned with the organisation's objectives, and assigned roles and responsibilities.
Clause 6.1.2–6.1.3
AI risk assessment and treatment
A repeatable process to identify and assess AI risks, choose treatments, and produce a statement of applicability that justifies each Annex A control included or excluded.
Clause 6.1.4
AI system impact assessment
Assessing the potential consequences of AI systems for individuals, groups and society — the requirement with no equivalent in ISO 27001. ISO/IEC 42005 gives guidance on how.
Clauses 7–8
Support and operation
Resources, competence, awareness, communication and documented information, and operational planning and control of AI system processes, including changes.
Clauses 9–10
Performance evaluation and improvement
Monitoring and measurement, internal audit, management review, and corrective action for nonconformities.
Annex A
38 reference controls in nine objectives
Policies, internal organisation, resources, impact assessment, the AI system life cycle, data, information for interested parties, responsible use, and third-party and customer relationships (A.2 to A.10).
Timeline
Milestones and the certification cycle
ISO 42001 has no statutory deadlines. The dates that matter are the ones your certification cycle and your customers set.
- Dec 2023ISO/IEC 42001 published
- Stage 1Documentation and readiness review by the certification body
- Stage 2Certification audit of the AIMS in operation
- Years 1 and 2Surveillance audits after certification
- Year 3Recertification audit
Overlaps
How it fits with other frameworks
ISO 42001 rarely arrives alone. Where it meets the other regimes you probably already run.
ISO 27001
Clauses 4 to 10 share their structure, so leadership, internal audit, management review and documented information can run as one integrated management system.
EU AI Act
ISO 42001 supplies much of the governance the Act assumes — inventory, risk management, impact assessment, oversight. It does not cover conformity assessment, CE marking or the Act's specific technical requirements for high-risk systems.
ISO/IEC 23894
Guidance on AI risk management that can inform how you run the clause 6.1 risk assessment.
GDPR
An AI system impact assessment and a data protection impact assessment often look at the same system. Running them from the same facts saves describing it twice.
On Noru
How Noru runs ISO 42001
The same control library, evidence vault and registers as the rest of your programme — not a separate project.
ISO 42001 as an auditable framework
ISO 42001 is one of the frameworks you switch on in Noru. Its controls go through verification like ISO 27001's, with evidence in the same vault, so one management system serves both.
Clauses cited per AI system
Where an AI system asserts a management-system control, the ISO 42001 clause is recorded against that system and mapped to the control library, beside its EU AI Act findings.
An inventory the auditor can trace
The AI register comes from the repository and CI rather than a spreadsheet, and every classification carries the name of the person who accepted it and when it expires — the kind of record clause 9 internal audit expects.
Is ISO 42001 certification mandatory?
No. It is a voluntary standard. Organisations certify because customers, investors or regulators ask how their AI is governed, and a certificate from an accredited body is a stronger answer than a self-assessment.
Does ISO 42001 make us compliant with the EU AI Act?
No, but it helps. It gives you the inventory, risk management, impact assessment and oversight processes the Act relies on. It is not a harmonised standard under the Act, so certification does not create a presumption of conformity, and it does not cover conformity assessment or CE marking for high-risk systems.
How many controls are in ISO 42001 Annex A?
Thirty-eight, grouped under nine control objectives numbered A.2 to A.10. You select the ones that apply through your statement of applicability and justify any exclusions. Annex B gives implementation guidance for each.
How is ISO 42001 different from ISO 27001?
They share clauses 4 to 10, so the management system mechanics are the same. ISO 27001 protects information; ISO 42001 governs AI systems, with AI risk assessment, AI system impact assessment and AI-specific Annex A controls on data, life cycle and responsible use.
How long does ISO 42001 certification take?
It depends on how much governance already exists. The certification itself is a two-stage audit; most of the time goes into the work before it — building the AI inventory, running risk and impact assessments, and operating the controls long enough to evidence them. An existing ISO 27001 ISMS shortens that considerably.
Primary sources
Regulatory references on this page were last checked on .
See where you stand
A 45-minute walkthrough of ISO 42001 against your own controls, integrations and evidence.