Was ist die ISO 42001 und was regelt sie?

ISO/IEC 42001 is the first international standard for AI management systems. It defines how organisations should responsibly develop, deploy, and monitor artificial intelligence. The standard was published in 2023 and applies to any organisation that operates or develops AI systems. The following sections answer the most important questions about requirements, certification, and the relationship with the EU AI Act.

What requirements does ISO 42001 place on organisations?

ISO 42001 requires the establishment, operation, and continual improvement of an AI management system (AIMS). Organisations must define AI policies, assign responsibilities, systematically assess risks, and document and implement concrete measures for the responsible use of AI.

The standard follows the High-Level Structure typical of ISO standards and is divided into several core areas:

Organisational context (Clause 4): Internal and external factors, relevant stakeholder groups, and the scope of the AIMS must be determined.
Leadership and management responsibility (Clause 5): Senior management must actively support the AIMS, adopt an AI policy, and assign clear responsibilities.
Planning and risk management (Clause 6): Risks and opportunities arising from AI systems must be identified and addressed with appropriate measures.
Operation (Clause 8): The entire lifecycle of AI systems must be managed, including development, data governance, and monitoring.
Performance evaluation and improvement (Clauses 9 and 10): Internal audits, management reviews, and corrective actions ensure the continual development of the system.

The standard structure is complemented by normative Annex A, which contains 38 concrete controls across nine topic areas, including AI policies, internal organisation, resources, impact assessment, lifecycle management, and data governance. Annex B provides informative implementation guidance. The controls in Annex A are not exhaustive: organisations may introduce additional controls where their own risk context requires it.

Who does ISO 42001 affect — and who does it not?

ISO 42001 applies in principle to any organisation that develops, provides, or uses AI systems, regardless of industry, size, or legal form. Explicitly excluded are individuals who use AI purely for private purposes without an organisational context.

In practice, the standard is particularly relevant for:

Companies that develop or offer their own AI systems
Organisations that use AI applications from third parties in their business processes
Providers of high-risk AI systems within the meaning of the EU AI Act
Public institutions and authorities with AI-supported decision-making processes
Companies that need to demonstrate trustworthiness to customers, partners, or supervisory authorities

The standard is less relevant for organisations that do not use or develop any AI systems at all. Companies that use AI exclusively through ready-made standard software, without any own control or customisation, are also affected to a lesser degree. Nevertheless, a review of one’s own AI usage is worthwhile, as the term „AI system“ is broadly defined in both the standard and the EU AI Act.

What is the difference between ISO 42001 and ISO 27001?

ISO 27001 governs information security management systems and protects data from unauthorised access, loss, and misuse. ISO 42001, on the other hand, specifically addresses the governance and management of AI systems — covering questions of responsibility, transparency, fairness, and risk management in AI deployment. The two standards complement each other but do not replace one another.

A direct comparison highlights the differences:

Subject of protection: ISO 27001 protects information assets. ISO 42001 governs the responsible handling of AI systems.
Types of risk: ISO 27001 focuses on confidentiality, integrity, and availability. ISO 42001 addresses AI-specific risks such as algorithmic bias, lack of transparency, and uncontrolled decision-making.
Lifecycle: ISO 42001 contains explicit requirements covering the entire AI lifecycle, from development through operation to decommissioning.
Data governance: ISO 42001 sets its own requirements for data quality and data management for AI systems, going beyond classic information security.

Organisations that are already certified to ISO 27001 benefit from a strong starting position. The shared High-Level Structure of both standards considerably facilitates integrated implementation. Annex D of ISO 42001 contains concrete guidance on integration with other management systems.

How does the ISO 42001 certification process work?

ISO 42001 certification is carried out by an accredited certification body, which assesses the organisation’s AI management system for conformity and effectiveness in a multi-stage audit. The certificate confirms that the AIMS meets the minimum requirements of the standard.

The typical ISO 42001 certification process is structured into the following phases:

Gap analysis: Determining the current state compared to the standard’s requirements. Gaps are identified and prioritised.
Building the AIMS: Development and documentation of all required policies, processes, controls, and responsibilities in accordance with ISO 42001.
Internal audit: Review of the AIMS by internal or commissioned auditors to assess conformity and the degree of implementation.
Stage 1 audit (document review): The external certification body checks whether all necessary documents exist, are complete, and are up to date.
Stage 2 audit (main audit): On-site examination of the actual implementation, awareness of requirements, and effectiveness of controls. The commitment of senior management and the practice of management reviews are also assessed.
Certificate issuance: Upon successful completion, the ISO 42001 certificate is issued, which is generally valid for three years and requires annual surveillance audits.

Certification bodies for ISO 42001 must fulfil not only the general standard ISO/IEC 17021-1 but also the specific requirements of ISO/IEC 42006, published in 2025, which sets out supplementary competence and process requirements for AI audits.

What are the benefits of ISO 42001 certification?

ISO 42001 certification strengthens the trust of customers, partners, and supervisory authorities in an organisation’s responsible use of AI. At the same time, it creates internal structures that reduce risks, increase efficiency, and make it systematically possible to meet regulatory requirements.

The key benefits can be grouped into several categories:

Trust and competitive advantage

The certificate serves as a demonstrable quality indicator for business partners and customers. A structured AI governance system is increasingly expected in tenders and supply chains. Certified organisations can clearly differentiate themselves from the competition.

Regulatory compliance

An AIMS built in accordance with ISO 42001 considerably facilitates the fulfilment of legal obligations, particularly with regard to the EU AI Act. For providers of high-risk AI systems who must demonstrate a quality management system, the standard provides a recognised foundation.

Operational efficiency and risk reduction

Systematic AI management through clear processes, responsibilities, and data governance reduces operational risks and prevents costly errors. A structured impact assessment of AI systems protects against unintended consequences and strengthens decision-making quality.

How does ISO 42001 relate to the EU AI Act?

ISO 42001 and the EU AI Act pursue the same overarching goal: responsible, safe, and transparent handling of AI. The EU AI Act has been in force since 2 February 2025 and sets legally binding requirements, while ISO 42001 is a voluntary, internationally recognised standard that supports the implementation of these legal obligations.

The relationship between the two is close and practically significant:

Providers of high-risk AI systems are required under the EU AI Act to establish a quality and risk management system. ISO 42001 provides a recognised structural framework for this purpose.
The AI impact assessment required by ISO 42001 corresponds conceptually to the risk assessment obligations of the EU AI Act.
AI governance structures as required by ISO 42001 align with the governance requirements of the EU AI Act for high-risk systems.
An AIMS based on ISO 42001 documents processes, controls, and responsibilities in a way that can be used directly in conformity assessments under the EU AI Act.

In addition, the draft standard DIN EN 18286:2025 has been developed to specifically facilitate the establishment of a quality management system for high-risk AI systems under Article 17 of the EU AI Act. Building an AIMS in accordance with ISO 42001 therefore simultaneously creates a solid foundation for AI compliance under the EU AI Act.

How mITSM supports you in building AI governance in accordance with ISO 42001

As a specialised training provider with over 20 years of experience in IT education, we offer targeted training and certifications covering ISO 42001 and AI governance. Our trainers are certified experts who draw on practical experience and deliver content in a hands-on way.

Our offering at a glance:

ISO 42001 AI Officer: Comprehensive training with certification via ICO-Cert, which concretely increases your market value in the job market
AI governance and AI management: Training on AI management systems, Annexes A and B of ISO 42001, and the EU AI Act
In-person, online live, and in-house: Our courses are available as in-person training, online live sessions, and as an in-house format directly at your location
ISO 42001 audit: Professional support in preparing for an ISO 42001 certification with a transparent report and a concrete action plan

Whether you are an individual seeking a recognised certification or an organisation looking to introduce an AI management system: we are here to support you on your path to ISO 42001 certification. Take a look at our training offering or contact us directly for a no-obligation initial consultation.

Dieser Inhalt wurde mithilfe von KI erstellt und kann Fehler enthalten.