ISO/IEC 42001 readiness checklist
ISO/IEC 42001 is the management system standard for AI. It does not tell you which model to use; it asks whether your organization knows which AI systems it runs, who answers for them, and how it would notice when one goes wrong.
In short
ISO/IEC 42001 follows the same harmonized structure as ISO 27001: clauses 4 to 10 cover the management system, and Annex A lists 38 controls in 9 areas that you accept or exclude in a Statement of Applicability. What it adds beyond 27001 is the AI system impact assessment: the effect of each system on people and society, not just on the organization. Certification is carried out as a two-stage audit by an accredited body. The fastest way to see where you stand is to answer the seven groups below with evidence, not intentions.
How the standard is structured
| Part | What it is | What it means in practice |
|---|
| Clauses 4 to 10 | Management system requirements | Mandatory. Context, leadership, planning, support, operation, evaluation, improvement |
| Annex A | 38 reference controls in 9 areas | You decide which ones apply and justify any exclusions in the Statement of Applicability |
| Annex B | Implementation guidance for the controls | How to read each control |
| Annex C | Possible objectives and sources of risk | Input to your risk assessment |
| Annex D | Use across domains and sectors | Context, not requirements |
The nine Annex A areas: AI policies, internal organization, resources, impact assessment, AI system life cycle, data, information for interested parties, use of AI systems, and third-party and customer relationships.
The checklist, clause by clause
Clause 4. Context
- A register of AI systems: what each one does, who owns it, and where its data comes from.
- Your role for each system: whether you develop it, provide it, or use one built by someone else.
- The boundary of the management system, documented: which units, products, and systems are in scope.
Clause 5. Leadership
- An approved AI policy that sets out what the organization will and will not do with AI.
- Named roles and responsibilities, including who can stop a system.
- Evidence that management reviews AI risk, not just signs off on the policy.
Clause 6. Planning
- An AI risk assessment method and a risk treatment plan.
- A procedure for AI system impact assessment covering individuals and society.
- A Statement of Applicability for the 38 Annex A controls.
- Measurable AI objectives.
Clause 7. Support
- People with the competence required for their role, and records of it.
- Awareness: staff who use AI know the policy that applies to them.
- Controlled documentation: current versions, owners, review dates.
Clause 8. Operation
- Life cycle controls actually applied: design, data, verification, deployment, monitoring, retirement.
- Impact and risk assessments carried out for real systems, not just as templates.
- Supplier controls for models, APIs, and data you buy.
Clause 9. Performance evaluation
- Metrics for the AI systems and for the management system itself.
- An internal audit programme with at least one completed audit.
- A management review with recorded decisions.
Clause 10. Improvement
- A way to record nonconformities and incidents.
- Corrective actions with owners and evidence of closure.
The question auditors ask most often is not in any clause: show me one AI system and walk me through its record, from the register entry to the latest monitoring review. If that walk-through works for one system, most of the checklist is already true.
How certification works
Certification is carried out by a body accredited for AI management systems. Stage 1 reviews documentation and readiness: is there a management system to audit. Stage 2 checks that it works in practice, on real systems and real records. After certification, there are surveillance audits and a recertification cycle. ISO/IEC 42006 sets the additional requirements for bodies that certify against 42001, which is worth knowing when you choose one.
Alongside ISO 27001
If you already hold ISO 27001, much of the machinery is already in place: document control, internal audit, management review, corrective action. The two systems can share these. What is new is the AI-specific content: the system register, impact assessments, life cycle controls, and data controls for AI. Organizations that try to run 42001 as a separate project usually end up with two audit calendars for one set of people.
Frequently asked questions
What is ISO/IEC 42001?
The international standard for an AI management system: requirements for how an organization governs the AI systems it develops, provides, or uses. It follows the same structure as ISO 27001 and adds AI-specific controls in Annex A, including impact assessment.
How many controls are in ISO 42001 Annex A?
38 controls in 9 areas: AI policies, internal organization, resources, impact assessment, AI system life cycle, data, information for interested parties, use of AI systems, and third-party and customer relationships. You justify which ones apply in a Statement of Applicability.
Do we need ISO 27001 before ISO 42001?
No, but it helps. The two share the same management system structure, so an organization with 27001 can reuse document control, internal audit, and management review, and focus on the AI-specific parts.
Does ISO 42001 make us compliant with the EU AI Act?
Not by itself. They overlap on risk management, documentation, data governance, and oversight, so a working 42001 system covers much of the groundwork, but the AI Act has legal obligations by role and risk class that a management system standard does not replace.
How long does it take to get ready?
It depends on how many AI systems you run and how much of the management system already exists. The checklist above, answered with evidence, shows the gap; the gap shows the time.