What is ISO/IEC 42001 and is certification worth it?

ISO/IEC 42001 is the first international standard setting out the requirements for an artificial intelligence management system, the AIMS: the policies, roles, assessments and checks through which an organization governs the AI it builds or uses. It was published by ISO and IEC as a first edition in December 2023 (ISO/IEC 42001:2023), later adopted without changes as UNI CEI EN ISO/IEC 42001:2026: the designation in a questionnaire changes, the requirements do not, and the adoption does not make it a harmonized standard. It belongs to the same family of management system standards as ISO/IEC 27001 (context, objectives, controls, internal audits, management review, continual improvement). Unlike a voluntary framework, ISO/IEC 42001 is certifiable. The certificate does not come from ISO, which writes standards and performs no certification, but from a third-party body accredited by the national accreditation body, Accredia in Italy, which examines the management system in an initial audit and then in periodic surveillance visits.

See also: NIST AI RMF · NIST's voluntary framework for managing AI system risk: it gives structure and vocabulary, not a certification.

Why smaller companies actually certify

The reason a company ends up certifying is almost always commercial rather than risk driven: a large customer puts it in the supplier questionnaire, a public grant scores it, a tender lists it. Companies that start from risk are the minority. So before deciding, check whether a paying customer is asking for it, or might reasonably ask within the year.

What it really costs

The body's fee weighs less than the work the standard presupposes: procedures that describe how the work is genuinely done, keeping the system inventory current, producing the records an auditor asks to see, and sustaining it, because the certificate runs for three years and lives on annual surveillance visits, with a full renewal at expiry. An audit photographs a management system, not the quality of the models. A certified company can run a model that gets things wrong; the audit only establishes that a way exists to notice and intervene. Formalizing that way is the work of AI governance.

A concrete example

A software vendor of forty people receives a questionnaire from a banking client asking for ISO/IEC 42001 by contract renewal. It already has a use case inventory and an internal policy, so one route works: put in writing the procedures it already follows, close the exposed points (impact assessment, model supplier management, incident log), then call the body. The opposite route, buying a management system written by somebody else, produces a manual nobody recognizes, and an audit finds that out. Two constraints the questionnaire does not mention. Whoever writes the procedures cannot then certify them, because the body is bound to impartiality. And if the renewal falls in three months the certificate does not fit, because the audit wants to see the system running and the records it has produced: what gets negotiated then is an analysis of what is missing (a gap analysis), with dates on it.

When certifying is not worth it

If no customer and no tender ask for it, and the use cases are two SaaS tools in the hands of the people doing marketing, certification is an investment with no recipient. The useful work is the subset: a system inventory, risk classification per use case, an owner with a name. It is also the base the NIST AI RMF rests on, which offers no certification at all, and it holds the day the standard becomes a requirement.

Why it matters for decision makers

Certification does not replace compliance with the AI Act, which is law and applies regardless of any certificate: the body certifying 42001 is not the notified body, the authorized assessor the regulation provides for on some high-risk systems, they are two separate routes. The benefit is organizational: much of the evidence the standard asks for is what an authority or a customer needs to see, so the work is not done twice.

This entry is informational and does not constitute legal advice: for decisions on regulatory obligations, involve a DPO or legal counsel.