What is ISO 42001? Understanding AI Management System Certification

ISO/IEC 42001:2023 is the international standard that sets out requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS).

It provides a framework for organisations to manage the risks and opportunities associated with AI, while supporting its responsible development and use.

The standard is relevant to organisations that develop AI technology, as well as those that use AI systems supplied by third parties.

An AI Management System helps organisations establish clear processes for:

• Identifying and managing risks associated with AI

• Defining responsibilities for AI governance and oversight

• Assessing how AI systems may affect individuals, customers and other stakeholders

• Establishing controls for the responsible development and use of AI

• Monitoring AI systems and improving how they are managed

• Demonstrating accountability and building confidence among customers and stakeholders

Importantly, ISO 42001 is not just for technology companies or AI developers. It can apply to organisations of different sizes and industries that use AI as part of their business operations.

Why consider ISO 42001 certification?

As AI adoption increases, so do expectations around how organisations manage the technology.

Customers, business partners and regulators are increasingly interested in how AI systems are used, what information they access and what controls are in place to manage potential risks.

ISO 42001 certification provides independent assurance that an organisation has established a management system to govern its AI activities in line with an internationally recognised standard.

For businesses, the benefits can include:

• Greater customer confidence: Demonstrate that AI is being managed through a structured, independently audited framework.
• Improved risk management: Identify potential issues before they affect customers, employees or business operations.
• Clearer accountability: Establish who is responsible for AI-related decisions, oversight and performance.
• Competitive advantage: Provide evidence of responsible AI governance when responding to tenders or customer requirements.
• Continual improvement: Establish processes to monitor and improve AI governance as technology and business needs change.

Certification does not guarantee that an AI system will never make a mistake. It demonstrates that the organisation has a structured approach to managing AI-related risks and responsibilities.

Already certified to ISO 27001? You're part of the way there.

For organisations that already hold ISO/IEC 27001 certification, the transition towards ISO 42001 certification may be less complex than starting from scratch.

Both standards follow a harmonised management system structure, with common requirements covering leadership, planning, support, operations, performance evaluation and improvement.

This means organisations with an established Information Security Management System (ISMS) will already be familiar with many of the processes required for an AI Management System.

For example:

Rather than building an entirely separate management system, organisations may be able to extend their existing framework to incorporate AI governance.

However, ISO 42001 introduces additional requirements that go beyond information security.

What does ISO 42001 cover that ISO 27001 doesn't?

While ISO 27001 focuses on managing information security risks, ISO 42001 takes a broader view of the potential impacts of artificial intelligence.

For example, an AI system might be secure from unauthorised access but still produce biased, inaccurate or inappropriate outcomes.

ISO 42001 addresses areas such as:

• AI system impact assessments: Considering how AI systems may affect individuals, groups and society.
• Transparency and explainability: Establishing appropriate processes for communicating how AI systems are used and how their outcomes can be understood.
• Human oversight: Defining when and how people should review or intervene in AI-related decisions.
• AI system lifecycle management: Managing AI systems from design and development through to deployment, monitoring and retirement, where relevant.
• Responsible AI use: Considering fairness, reliability, accountability and other relevant AI-related risks.

These requirements need to be addressed according to the organisation's role in the AI lifecycle, the systems it uses and the risks involved.

For organisations already certified to ISO 27001, the task is therefore not to replace their existing management system, but to build on it with the additional processes and controls needed to manage AI responsibly.

Can ISO 27001 and ISO 42001 be integrated?

Yes. ISO 27001 and ISO 42001 can be managed through an Integrated Management System (IMS).

By integrating the two standards, organisations can use common management system processes rather than maintaining separate systems for information security and AI governance.

This can reduce duplication across policies, audits, management reviews, reporting and improvement activities.

There may also be opportunities to coordinate certification audits, potentially reducing the overall audit time and cost compared with conducting completely separate audits. Any reduction will depend on the organisation's scope, level of integration and applicable certification requirements.

For organisations already maintaining an effective ISO 27001 management system, this makes ISO 42001 a logical next step as AI becomes a more important part of their operations.

Getting started with ISO 42001 certification

The first step is to understand how AI is currently being used across your organisation.

This includes identifying AI systems, the information they process, their intended purposes and the people responsible for overseeing them.

From there, organisations can assess their existing management system against ISO 42001 requirements to identify any gaps.

For ISO 27001-certified organisations, this gap assessment can help determine which existing processes can be extended and where new AI-specific controls are required.

Once the management system has been implemented and reviewed, the organisation can proceed towards an independent certification audit.

Build confidence in your organisation's use of AI

AI offers significant opportunities for businesses, but its adoption needs to be supported by appropriate governance and oversight.

ISO 42001 provides a recognised framework for managing these responsibilities and demonstrating a commitment to responsible AI use.

For organisations already certified to ISO 27001, much of the management system foundation may already be in place.

Southpac Certifications can help your organisation understand the ISO 42001 certification process and explore opportunities to integrate AI management with your existing ISO 27001 certification.

Contact our team to discuss our unaccredited ISO 42001 certification option for your organisation.