ISO 42001: what it is, who needs it, and how certification works

What is ISO 42001?

ISO/IEC 42001:2023 is the international standard for an artificial intelligence management system: the policy, risk and impact assessments, lifecycle controls and oversight an organisation runs around the AI it develops, provides or uses. An accredited certification body audits the system and issues the certificate, then returns every year to check it still runs as written.

It was published in December 2023 and is the first edition. It follows the Annex SL structure that ISO 9001 and ISO 27001 share, so a company holding either already knows the shape, and adds the AI-specific requirements: the AI system impact assessment and the Annex A lifecycle controls.

Who needs ISO 42001?

Pharma, biotech and device companies using AI inside GxP processes, whether it drafts quality records or reviews batch data, where the AI's governance belongs with the procedures it touches

Suppliers whose customers ask for the certificate, or ask the questions the certificate answers, before they will buy

The standard becomes urgent when a customer's quality team asks how the AI is governed, when a procurement questionnaire adds an AI section, or when a notified body asks for the AI's risk assessment beside the device file.

What ISO 42001 asks for, clause by clause

Clauses 1 to 3 are scope, references and terms. The requirements the certification body audits are clauses 4 to 10, on the harmonised structure (Annex SL) that ISO's management system standards written since 2012 share, applied to AI. Annex A lists the reference controls the organisation selects from.

Clause 4, context of the organisation

The organisation's role with AI, as developer, provider, user or several at once, the interested parties, and the scope of the management system: which AI systems and which lifecycle stages it covers

Clause 5, leadership

An AI policy, roles and responsibilities assigned, and top management accountable for the system and its outcomes

Clause 6, planning

AI risk assessment and risk treatment, an AI system impact assessment on individuals, groups and society, a Statement of Applicability saying which Annex A controls apply and why, and AI objectives

Clause 7, support

Resources, competence and awareness for the people who build and use the AI, communication, and documented information under control

Clause 8, operation

The risk assessment, risk treatment and impact assessment carried out at planned intervals and whenever an AI system changes, and the Annex A controls in operation across the lifecycle: data for AI systems, lifecycle documentation, information for interested parties, human oversight and the use of AI systems, third-party and customer relationships

Clause 9, performance evaluation

Monitoring and measurement, internal audit of the management system, and management review at planned intervals

Clause 10, improvement

Nonconformity and corrective action, and continual improvement

How ISO 42001 certification works

1. Inventory the AI and scope the system

List the models, AI features and third-party AI that touch product, patients or GxP data, decide which the management system covers, and in which role.

2. Gap assessment

Read your policies, procedures and records against clauses 4 to 10 and Annex A, and list what is missing, unwritten or not followed.

3. Write and approve the AI policy, the risk and impact assessments, the lifecycle procedures and the Statement of Applicability, and train the people who build and use the AI

4. Run the system and keep the records

5. Stage 1 and Stage 2 audits, then surveillance

The certification body reviews the documentation, audits the running system and issues the certificate or a list of nonconformities to close first, then returns every year, with recertification every three years.

ISO 42001 IN QUALIO

Qualio maps the AI policy, risk assessments and lifecycle procedures to the clauses they answer, so the auditor reads the AI's governance from records that are already approved

Qualio breaks ISO 42001 down clause by clause and maps your AI policy, risk and impact assessments, lifecycle procedures and incident events to the clauses they answer. When a record changes, it reassesses the clauses it touches and recommends a fix for any gap. Copilot drafts the procedure update from the recommendation, and your team approves it. When the certification body sends the dates, you export the audit pack by clause, with the evidence and the approvals behind each one.

The AI policy and oversight procedures for clauses 5 and 7 held as controlled documents, with training assigned on the effective date of every revision

AI incidents and concerns raised as quality events for clause 10, each traceable to the corrective action that closed it

Model changes run through change control for clause 8, with the updated risk and impact assessment attached before anyone approves it

Management review run as an event for clause 9, so it reads the monitoring, audit and incident records as they stand

Standards that apply alongside ISO 42001

Management systemsISO 27001: The information security management system standard, built on the same Annex SL clauses, which shares its policy control, internal audit and management review with an AI management system
Management systemsISO 9001: The quality management system standard most software companies certify to first, and the other Annex SL system an AI management system runs alongside
Medical devicesIEC 62304: The software lifecycle for software that is, or is in, a medical device, which the AI's lifecycle controls sit inside when the model ships in a device
Medical devicesISO 14971: The device risk management file an AI system impact assessment is read beside when the AI is in a device
Electronic records21 CFR Part 11: The FDA's rule for the electronic records and signatures the management system's records are kept in

Bond Digital Health

Bond Digital Health achieved ISO 13485 and IEC 62304 accreditation on Qualio: the software-in-a-regulated-product path ISO 42001 extends.

Read the Bond Digital Health story

“Qualio's Design Controls feature has been an important element of our product development and regulatory approval processes. We provide an AI-based medical device that screens mammograms and detects anomalies. Quality and speed are critical because we know delays on our end impact real peoples' lives.”

Kevin HarrisPresident & Co-Founder, CureMetrix

Guides and webinars for ISO 42001

Guide

The Life Sciences Guide to AI in Quality and Compliance

Guide

The Ungoverned AI Gap in Quality and Compliance

Guide

Annex SL: the core of your ISO journey

Questions about ISO 42001

What is ISO 42001?

ISO/IEC 42001:2023 is the international standard for an artificial intelligence management system, the policy, risk and impact assessments, lifecycle controls and oversight an organisation runs around the AI it develops, provides or uses. An accredited certification body audits the system and issues the certificate. It is the first ISO management system standard written for AI.

Is ISO 42001 mandatory?

No. It is a voluntary standard, and no regulator requires the certificate. Customers, procurement teams and notified bodies ask the questions it answers whether or not you hold it. The certificate answers them once, with an accredited body's audit behind it, and the answer holds for every customer who asks.

What is the difference between ISO 42001 and the EU AI Act?

ISO 42001 is a standard a company chooses to certify to. The EU AI Act is a law, with obligations for providers and deployers of AI systems phasing in from 2025 to 2028. A certified management system is evidence toward the Act's obligations and does not discharge them.

Does ISO 42001 apply to SaMD?

Yes, where the software is or contains a model. The device rules govern the product, through ISO 13485, IEC 62304 and ISO 14971. ISO 42001 governs how the organisation manages the AI: how the model is scoped, assessed for risk and impact, documented, monitored and changed.

Is ISO 42001 certifiable?

Yes. Accredited certification bodies audit an artificial intelligence management system against the standard in two stages and issue a certificate for three years, with a surveillance audit each year. ISO/IEC 42006 sets the requirements for the bodies that audit it. Qualio holds ISO 42001 certification.

How does ISO 42001 relate to ISO 27001?

They share the Annex SL structure, so context, leadership, planning, support, operation, performance evaluation and improvement are the same clauses with different content. ISO 27001 manages information security risk and ISO 42001 manages the risks and impacts of AI systems. A company holding 27001 reuses its policy control, internal audit and management review, and adds the AI risk assessment, the impact assessment and the Annex A controls.

Can we add ISO 42001 to the standards we already run in Qualio?

Yes. Add it from the library and Qualio assesses the records you already hold against every clause, so the policy control, training, internal audit and management review that answer ISO 9001 or ISO 27001 count towards 42001 without being re-filed. The first assessment lists the AI-specific gaps on their own.

When is the certification audit?

Bring the date and the procedures behind your AI. We will show you ISO 42001 assessed against them clause by clause, with the gaps listed and the audit pack ready for the auditor.

Book a demo Get the AI in quality and compliance guide

Less time on audit prep. More time on quality.