What ISO 42001 is
ISO/IEC 42001, published at the end of 2023, sets requirements for an AI management system: the policies, roles, risk processes and controls an organisation uses to develop, provide or use AI responsibly. It follows the same structure as ISO 27001 and can be certified by an accredited body. Its Annex A lists controls for AI policy, internal organisation, resources, impact assessment, the AI system life cycle, data for AI systems, information for the people affected, the use of AI systems and relationships with third parties.
What customers ask
A customer who mentions ISO 42001 is usually not asking for a certificate first. The questions follow the standard's themes:
- Whether you have an AI policy, who approved it, and who is accountable for AI in the company.
- How you assess the risks and impact of each AI feature before it is released, including on the people its output affects.
- Where the data used to build, tune or test the feature comes from, and whether customer data is part of it.
- How you test the output, what you monitor in production, and how a fault or a complaint is handled.
- What users are told about the AI and its limits, and how a person can review or override the output.
- Which model providers you rely on and how you assess them.
Answering with a certificate
Attach the certificate and quote its scope exactly, because a reviewer will check that the AI features they are buying are inside it. Then answer each theme from your statement of applicability, just as for ISO 27001.
Answering without one
Answer each row on its merits: what you do, who owns it, and where it is written down. Two documents carry most of the answers. One is an AI policy of a page or two. The other is an inventory of your AI features, with the model each one uses, the data it sees, how it is tested and who reviews its output. If certification is planned, say when. A clear inventory and an honest plan read better than vague claims of alignment.
In Responsemate
The AI policy, the inventory and any certificate sit in the knowledge base as evidence with review dates, next to the approved answers drafted from them. Responsemate's own answers to these questions, from the model choice to the person who approves each answer, are on the security page.
Questions people ask
Is ISO 42001 required by the EU AI Act?
No. ISO 42001 is voluntary. It helps show that AI is governed in an organised way, and some customers ask for it as a sign of maturity, but the AI Act does not require a certificate.
Can we be certified to ISO 42001 if we only use AI models from other providers?
Yes. The standard covers organisations that develop, provide or use AI systems. A vendor that builds features on another company's model is in scope for the way it designs, tests, deploys and monitors those features.
We have ISO 27001. How much of ISO 42001 do we already have?
The management system parts are the same shape: scope, policy, risk assessment, internal audit, management review. What is new are the AI-specific controls, such as impact assessment, data for AI systems and the AI system life cycle.