ISO/IEC 42001:2023 is the international standard for an artificial intelligence management system, usually shortened to AIMS. An AIMS is the set of policies, objectives, roles and processes an organisation uses to develop, provide or use AI responsibly across each system's life, from design and purchase to retirement. The standard was published on 18 December 2023 and is the first AI standard an organisation can be independently certified against.
It is a management standard, not a technical one. It does not prescribe which models to use or what accuracy to reach. It requires the organisation to know what AI it runs, decide the risks it accepts, put controls around them, check those controls work and improve them over time. It follows the same plan, do, check, act structure as ISO/IEC 27001 for information security, so the two sit together in one management system.
Certification means an accredited certification body has audited the AIMS and confirmed it meets the standard. The certificate states the scope it covers and is valid for three years, subject to annual surveillance audits.
No law requires ISO/IEC 42001 certification. Organisations seek it because buyers, partners and regulators ask how AI is governed, and a certificate answers that question with an independent audit rather than a self-description.
If a client or counterparty has asked for the certificate, the decision is made and only timing remains. If nobody has asked, the useful test is how the firm would answer a detailed AI governance questionnaire today. That answer needs an inventory, named owners, documented controls and evidence, which is most of the work certification requires.
The standard has two parts: the management system clauses, which every certified organisation must meet in full, and Annex A, a set of reference controls the organisation selects from based on its risk assessment.
| Clause | What it requires |
|---|---|
| 4 Context | The organisation's role (developer, provider or user of AI), interested parties and the scope of the AIMS |
| 5 Leadership | Top management commitment, an AI policy and assigned roles and responsibilities |
| 6 Planning | AI risk assessment, risk treatment, AI system impact assessment and AI objectives |
| 7 Support | Resources, competence, awareness, communication and documented information |
| 8 Operation | Operating the planned controls, risk treatment and impact assessments in practice |
| 9 Performance evaluation | Monitoring and measurement, internal audit and management review |
| 10 Improvement | Corrective action and continual improvement |
Annex A contains 38 controls grouped under nine control objectives. The organisation records which controls apply, and why any are excluded, in a statement of applicability.
| Annex A objective | What it covers |
|---|---|
| A.2 Policies related to AI | The AI policy and its alignment with other policies |
| A.3 Internal organisation | Roles, responsibilities and reporting of concerns |
| A.4 Resources for AI systems | Data, tooling, computing and people resources, documented |
| A.5 Assessing impacts of AI systems | Impact assessment on individuals, groups and society |
| A.6 AI system life cycle | Design, development, verification, deployment, operation and monitoring |
| A.7 Data for AI systems | Data quality, provenance and preparation |
| A.8 Information for interested parties | Documentation and information for users and affected people |
| A.9 Use of AI systems | Responsible use, intended use and human oversight |
| A.10 Third-party and customer relationships | Suppliers, bought AI and responsibilities to customers |
Annexes B to D give implementation guidance for each control, examples of AI risk sources and objectives, and notes on use across sectors.
Fix the commercial reason and the date it must be met: a client tender, a contract renewal or a partner programme. That date sets the plan, because the certification body's calendar and the evidence period both work backwards from it.
Scope sets which parts of the organisation, which products and which AI systems are covered, and it is printed on the certificate. Too broad, and the organisation pays to control systems nobody asked about. Too narrow, and clients ask about the systems outside it. Scope is the most consequential decision in the project and is made at the start.
Assess the current position against each clause and each Annex A control. Grade each gap and separate what must exist before the Stage 1 audit from what can follow. Expect the AI inventory to surface systems nobody had catalogued, often AI features a supplier switched on inside a bought platform, and expect evidence gaps to be larger than control gaps: most firms do more than they can show.
Write the documents that close the gaps: the AI policy, procedures, roles, the risk and impact assessment method, the statement of applicability and a mapping from each requirement to an internal control. Documents must describe what the organisation actually does. A template adopted unedited sets a standard the auditor will measure against.
Put the controls into operation and make sure people use them, through training, communication and follow-up. Auditors interview the people who operate controls, so a control that exists only on paper will not satisfy the Stage 2 audit. Most certification bodies expect the system to have run for long enough to produce records, typically around three months, before Stage 2.
The standard requires an internal audit of the AIMS and a management review by top management before certification, and at planned intervals after it. The internal auditor must be competent in the standard and independent of the work audited, and cannot be the certification body. The person who built the system is usually the one best placed to explain it and the one who may not audit it, so internal audit is commonly outsourced as a recurring commitment.
The certification body reviews the scope, the documented AIMS, the risk approach and the statement of applicability to confirm the organisation is ready. It usually takes a few days, much of it document review and discussion. The organisation receives any areas of concern and addresses them before Stage 2.
Stage 2 tests whether the system operates in practice. The auditor examines evidence, interviews control owners and checks that documents match reality. Findings are graded as major nonconformities, which must be corrected before a certificate is issued, minor nonconformities, which need an accepted corrective action plan, and opportunities for improvement.
Once findings are closed, the certification body issues a certificate valid for three years. Surveillance audits in years one and two confirm the system still operates, focusing on changes, risk management and improvement. A recertification audit before the end of year three starts the next cycle.
The standard sets no timeline, and the total depends on scope, the number of AI systems and what already exists. The planning ranges below reflect a focused scope in an organisation with a working risk framework.
| Phase | Typical duration |
|---|---|
| Scope and gap analysis | 2–4 weeks |
| Design of the management system | 1–3 months |
| Operation to build evidence, internal audit and management review | About 3 months |
| Stage 1 audit and closing its points | 2–6 weeks |
| Stage 2 audit and closing findings | 2–6 weeks |
| Total to certificate | 6–9 months |
An organisation already certified to ISO/IEC 27001 can often run design and operation in parallel with its existing cycle and reach certification sooner. Certification body availability can set the date, so booking the audits early in the project is part of the plan.
Certification bodies do not publish standard prices, because audit time is set by the scope, the number of sites and people, and the number and complexity of AI systems. Any figure quoted without the scope is an estimate. The structure of the cost is consistent, and it has three parts.
The variables that move the total are the number of AI systems in scope, whether they are built or bought, whether the organisation already holds a management system certificate, and how firm the deadline is.
An organisation certified to ISO/IEC 27001 is well along the path. The two standards share their structure, so they should be run as one management system with one internal audit programme and one management review, not as two projects in sequence.
| Element | Position for a 27001-certified firm |
|---|---|
| Governance, document control, competence, internal audit, management review | Carries over; extend to AI |
| Risk method | Carries over; add AI risk sources and the AI impact assessment |
| Certification route | Same: accredited body, two-stage audit, three-year cycle |
| AI inventory and classification | New |
| Data governance for AI, human oversight, life cycle controls | New |
| Third-party and bought AI | Partly new; extends supplier controls |
An organisation with neither certificate should build one management system and certify against both, which costs less than two separate programmes.
ISO/IEC 42001 is not a harmonised standard under the EU AI Act, so certification does not by itself give a legal presumption that a system conforms with the Act. The European standards bodies are preparing the harmonised standards, and their delay is one reason the Digital Omnibus on AI moved the high-risk dates to 2 December 2027 and 2 August 2028. Certification does supply much of the evidence the Act asks for: risk management, data governance, documentation, human oversight and post-deployment monitoring.
The standard also maps closely to the NIST AI Risk Management Framework used by US firms and to the governance expectations of financial supervisors. In financial services, supervisors look for the same inventory, ownership, testing and evidence that an AIMS produces, and firms deploying AI agents in payments meet further questions set out in the firm's guide to AI agents and payments regulation in 2026. EU financial firms can align the AIMS supplier controls with their DORA ICT third-party requirements, since most AI is bought from technology providers.
Use a certification body accredited for ISO/IEC 42001 by a national accreditation body, such as UKAS in the UK. UKAS granted its first AIMS accreditation, to BSI, in January 2026, and further bodies have followed. An unaccredited certificate carries little weight with the buyers and partners who ask for it.
The certificate depends on the system continuing to operate. The most common reason for findings at surveillance audits is documentation that has not kept pace with change: a model replaced, a new supplier, a new use case or a change in regulation.
The firm's AI governance service covers gap analysis, implementation, internal audit, certification support and responses to client AI due diligence, alongside EU AI Act readiness.
For firms that want this evidence held in one place, Hael, an AI governance platform from the founders of Buckingham Capital Consulting, records the AI inventory, risk assessments, controls and evidence that ISO/IEC 42001 and the EU AI Act call for.
No. No law requires it. Organisations seek it because clients, partners and supervisors ask for independent evidence of how AI is governed.
A focused scope typically takes 6 to 9 months from gap analysis to certificate, including about 3 months of operating evidence before the Stage 2 audit. Firms already certified to ISO/IEC 27001 can often move faster.
Annex A contains 38 controls grouped under nine control objectives. The organisation selects the applicable controls through its risk assessment and records them in a statement of applicability.
Three years, with surveillance audits in years one and two and a recertification audit before the end of year three.
No. It is not a harmonised standard under the Act, so it does not give a presumption of conformity, but it produces much of the governance evidence the Act requires.
No. The certification body must stay independent of the system it certifies, so implementation support comes from the organisation's own team or an adviser.
ISO/IEC 27001 covers information security; ISO/IEC 42001 covers the management of AI. They share the same management system structure and are best run as one system.
Buckingham Capital Consulting has worked with regulated financial firms on authorisation, governance and regulator engagement since 2013. It supports organisations through ISO/IEC 42001 gap analysis, implementation, internal audit and certification, alongside EU AI Act readiness and client AI due diligence.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.