An ISO certification is in most cases not a legal requirement, but a voluntary decision. Whether the effort is worthwhile depends on your industry, your customers‘ requirements, and your own level of risk. This article answers the most important questions about ISO obligations, consequences, relevant standards, and the path to certification.<\/p>\n\n\n\n
An ISO certification is only legally mandatory in a few clearly defined areas. In the majority of industries, it is a voluntary measure. Legal obligations arise primarily when regulatory frameworks or industry standards explicitly require demonstrated conformity with a standard.<\/p>\n\n\n\n
Specific exceptions exist, for example, in the medical devices sector, in aviation, or in certain areas of critical infrastructure. Here, laws or regulations require companies to demonstrate that their processes comply with a recognised standard.<\/p>\n\n\n\n
A current and growing example is the field of artificial intelligence: the EU AI Act, which has been in force since 2 February 2025, requires providers of high-risk AI systems to establish an AI risk management system. While the law does not directly mandate an ISO certification, a KIMS certification under ISO 42001 is recognised as proof that such a system has been properly established and controlled. If you develop or operate high-risk AI, you can use a KIMS certification under ISO 42001 to meet regulatory requirements in a structured way.<\/p>\n\n\n\n
Outside of legal requirements, a certification can also become contractually mandatory if clients, customers, or public tenders explicitly require it.<\/p>\n\n\n\n
Working without an ISO certification does not, in most cases, violate any legal requirement. However, the consequences can be significant depending on the context: contracts are lost, trust is lacking, and competitors with certification have a measurable advantage in tenders and customer decisions.<\/p>\n\n\n\n
In the area of AI management, the risk is particularly concrete. Companies that use or develop AI systems without being able to demonstrate a structured AI management system risk:<\/p>\n\n\n\n
Especially in areas where AI decisions have a direct impact on people, the absence of a demonstrable framework can quickly become a problem. Internally, too, the lack of certification often means there is no structured approach to continuous improvement.<\/p>\n\n\n\n
The most relevant ISO standards for companies depend on their industry and area of focus. Among the most widely used are ISO 9001 (quality management), ISO 27001 (information security), and, increasingly since 2023, ISO\/IEC 42001 (AI management systems). The latter is gaining considerable importance given the growing use of AI in organisations.<\/p>\n\n\n\n
ISO\/IEC 42001 is the first internationally recognised standard for the introduction and operation of AI management systems. It is aimed at organisations of all types and sizes that develop, provide, or use AI. The standard sets out requirements for guidelines, processes, responsibilities, and the continuous improvement of AI use. It is complemented by ISO\/IEC 42006, which defines requirements for certification bodies that conduct audits under this standard.<\/p>\n\n\n\n
ISO 27001 remains relevant for virtually every company that works with sensitive data. The standard describes the requirements for an information security management system (ISMS) and forms the basis for protecting digital assets. In light of increasing cyberattacks and legal requirements such as the NIS-2 Directive, it is more important than ever in 2026.<\/p>\n\n\n\n
ISO conformity means that an organisation meets the requirements of a standard internally, without having this verified by an external body. ISO certification goes one step further: an independent, accredited certification body officially verifies and confirms this conformity through an audit.<\/p>\n\n\n\n
The difference has practical consequences:<\/p>\n\n\n\n
For many companies, it makes sense to first establish internal conformity and then pursue certification as the next step. In the area of AI management under ISO\/IEC 42001, KIMS certification under ISO 42001 is carried out by certification bodies that must fulfil both ISO\/IEC 17021-1 and ISO\/IEC 42006. The process takes place via a so-called third-party audit, meaning an independent external review.<\/p>\n\n\n\n
The path to ISO certification follows a structured process that typically begins with a stocktaking exercise, leads through the introduction or adaptation of the management system, and concludes with an external certification audit. The duration depends on the maturity of the organisation and the chosen standard.<\/p>\n\n\n\n
For a KIMS certification under ISO\/IEC 42001, the process in practice looks like this:<\/p>\n\n\n\n
It is important to note that exclusions from the requirements of ISO\/IEC 42001 (Chapters 4 to 10) are not permissible when conformity with the standard is claimed. The system must be fully and consistently implemented. An internal ISO 42001 audit<\/a> carried out in advance helps to identify weaknesses early and address them in a targeted way.<\/p>\n\n\n\n Training and personal certifications accelerate the ISO process because they ensure that the employees involved understand the standard’s requirements, implement them correctly, and can communicate them internally. A lack of knowledge is one of the most common reasons for delayed or failed certification projects.<\/p>\n\n\n\n Specifically, training helps in the following areas:<\/p>\n\n\n\n This is especially true for ISO\/IEC 42001: since the standard is relatively new, many organisations still lack the necessary expertise. Those who invest early in targeted training<\/a> can significantly shorten the path to certification and avoid costly rework after the external audit.<\/p>\n\n\n\n We at mITSM guide companies and professionals in a structured way on the path to ISO certification, with a clear focus on AI management under ISO\/IEC 42001. Our offering includes:<\/p>\n\n\n\nHow can training and certifications accelerate the ISO process?<\/h2>\n\n\n\n
\n
How mITSM supports you on the path to ISO certification<\/h2>\n\n\n\n