ISO/IEC 42001:2023 AI management system standard published

ISO/IEC 42001:2023 is the international standard for running an artificial intelligence management system, and ISO records its first edition as published on 18 December 2023. It sets requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS) inside an organization.

What it is

ISO describes 42001 as the first global standard for how to operate an AI management system. The responsible body is ISO/IEC JTC 1/SC 42, the joint ISO and IEC subcommittee for artificial intelligence, and the published text runs to 51 pages.

It is a management system standard, not a technical specification for particular AI applications. ISO says it suits organizations of any size that develop, provide or use AI-based products or services.

What it requires

According to ISO, the requirements span leadership and organizational context, AI policy and objectives, risk management for AI systems, data governance and life-cycle controls, transparency, performance evaluation and continual improvement. ISO says the aim is to move organizations from ad hoc AI use to structured, accountable management.

Certification is optional, and ISO certifies no one itself; independent certification bodies, which may hold national accreditation, perform it. ISO also stresses that conformity with the standard does not replace compliance with laws or regulations.

What security leaders should do

• If you already run an ISO/IEC 27001 program, reuse its machinery (scoping, internal audit, management review) for AI rather than building a parallel structure.
• Start with an inventory of where AI is used, including AI embedded in purchased services, because that list defines the scope of the management system.
• Decide deliberately whether third-party certification is a goal or whether adopting the requirements internally is enough.
• Present certification to the board as evidence of process discipline, not as proof of legal compliance.