ISO/IEC 42001, the AI management system standard: what it asks, who certifies it in Ireland, and what it does not prove

ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system, was published on 18 December 2023 by ISO and the IEC, through their joint subcommittee on artificial intelligence, ISO/IEC JTC 1/SC 42. As the IEC's listing gives its scope, it specifies the requirements and gives guidance for establishing, implementing, maintaining and continually improving an AI management system within the context of an organisation. It is meant for an organisation that provides or uses products or services that use AI systems, and it applies to any organisation, regardless of size, type and nature.

NSAI, Ireland's national standards body, calls it the global standard for an AI management system (AIMS). It says the standard addresses governance, risk management, transparency, accountability, data quality and life cycle controls, and applies to organisations of any size and sector that develop, deploy or rely heavily on AI systems.

An article on NSAI's site, published on 26 August 2024, describes ten clauses, of which clauses 4 to 10 hold the requirements: the organisation's context and the scope of its system; leadership, including top management's commitment and an AI policy; planning, covering risks and opportunities and AI objectives; support, meaning resources, competence, awareness, communication and documentation; operation, including AI system impact assessments and change management; performance evaluation, including monitoring, internal audit and management review; and improvement, including corrective action.

Four annexes follow. By that article's count, Annex A lists 39 controls; Annex B gives guidance on putting them in place; Annex C covers sources of AI risk and the objectives an organisation may set; and Annex D covers using AI and running the management system in particular sectors.

NSAI's certification page sets out what putting the system in place involves: an AI governance structure with defined roles; AI policies covering responsible AI, risk appetite, transparency, human oversight and escalation; structured risk and impact assessments across the life cycle; controls for data quality, security and privacy, and for the development, testing, deployment and change of AI systems; and then operating, monitoring and improving it.

Both are management system standards, and they are laid out the same way. NSAI's description of ISO/IEC 27001 sets out the same seven parts, from the context of the organisation to improvement, that the article gives for clauses 4 to 10 of ISO/IEC 42001. NSAI says ISO/IEC 42001 is designed to integrate with existing management systems, ISO 9001, ISO 14001, ISO 20000 and ISO 27001 among them, so that audits can be streamlined and duplication reduced.

What differs is the subject. ISO 27001 manages information security risk, with 93 controls in its Annex A by NSAI's count; ISO/IEC 42001 manages the risks and impacts of developing, providing or using AI, with its own 39 by the article's count. Both ask for a defined scope, a risk process, internal audit and management review, so a business that already runs ISO 27001 has those in place. What ISO 27001 asks of a business covers that standard.

NSAI certifies organisations to ISO/IEC 42001. Its page sets out the route: become familiar with the standard, carry out a self-assessment or gap analysis, put the management system in place, then ask NSAI for a quotation and agree dates for two assessments. Stage 1, the readiness assessment, reviews the documents, the scope, management's commitment and the initial design of the Annex A controls. Stage 2, the conformity audit, evaluates whether the system is in place, effective and conforms to the standard. NSAI bases the audit time on the number of staff involved in the AI life cycle, adjusted for factors such as a regulated sector, the complexity of the AI systems, sensitive or high-risk uses and third-party arrangements.

Once certified, an organisation has surveillance audits, typically annual, and is recertified every three years.

When a supplier shows you an ISO/IEC 42001 certificate, check who issued it, which part of the business and which AI systems it covers, and whether the body that issued it holds accreditation for that standard. INAB says it strongly mandates the bodies it accredits to use its accreditation symbol on their certificates. The symbol combines INAB's logo with the body's registration number and accreditation standard, and refers to its scope of accreditation.

The AI Act gives a presumption of conformity to harmonised standards whose references are published in the Official Journal: a high-risk AI system that conforms to one is presumed to meet the requirements that standard covers (Article 40(1)). ISO/IEC 42001 is not among them: on 30 October 2026 the only one published was EN 18286, below.

The European Commission's questions and answers on standardisation of the AI Act, last updated on 10 March 2026, say that although ISO/IEC 42001:2023 helps to set up an AI management system, its goals and definitions are not aligned with the quality management system the AI Act requires, and that this is why the Commission asked for a new standard for a quality management system focused on compliance with the Act.

That standard is EN 18286:2026, Artificial intelligence, Quality management system for EU AI Act regulatory purposes. Commission Implementing Decision (EU) 2026/2274 of 12 October 2026, which appeared in the Official Journal on 14 October 2026, published its reference, and the Commission calls it the first harmonised standard supporting the AI Act. The Commission says providers of high-risk AI systems that implement it benefit from a presumption of conformity with the Article 17 requirements it covers, and that it is designed to be layered on top of existing standards such as ISO/IEC 42001 and ISO 9001, not to replace them. CEN-CENELEC's joint committee for AI, JTC 21, says the standard's informative annexes map it to EN ISO 9001 and EN ISO/IEC 42001, so an organisation certified to either can build on what it has.

Article 17 binds providers of high-risk AI systems. It applies from 2 December 2027 for the uses in Annex III and from 2 August 2028 for AI in products covered by Annex I (Article 113). A business that only uses AI tools has no Article 17 duty. The duties it does have, AI literacy under Article 4 and in some cases transparency under Article 50, are set by the Act itself, and the Commission's standardisation page says that applying standards remains voluntary. Whether the AI Act applies to you works through them.

NSAI presents certification as a signal to customers, regulators and partners that a business's AI systems are governed with care. Whether that is worth an audit depends on three things a business can answer for itself: whether a customer is asking for it, whether the business develops or provides AI systems for others or only uses them, and whether it would be the provider of a high-risk system under the AI Act. For that last case, EN 18286 is the standard the Official Journal cites. When a business that uses AI becomes its provider is set out separately.

Based on the route NSAI sets out: