Artificial Intelligence Management System
Govern AI systems — manage risk, and demonstrate transparency, ethics and responsible use.
Who it is for: Organisations that develop, provide or use AI systems and need to show they govern them.
- Standard
- ISO/IEC 42001
- Edition
- 2023
- Abbreviation
- AIMS
- Discipline
- Information, privacy & AI
- Certification cycle
- 3 years
What ISO/IEC 42001 is actually made of
Like the other standards here, ISO/IEC 42001 follows Annex SL, the common high-level structure. Clause 8 is where it becomes specific to ai management; the rest is the spine you would build for any of them.
- 4Context of the organisationIssues, interested parties, scope, and the system itself.
- 5LeadershipCommitment, policy, and assigned roles and authorities.
- 6PlanningRisks and opportunities, objectives, and planning for change.
- 7SupportResources, competence, awareness, communication, documented information.
- 8OperationFor ISO/IEC 42001: AI risk assessment and treatment, AI system impact assessment, and life-cycle controls.
- 9Performance evaluationMonitoring, internal audit, management review.
- 10ImprovementNon-conformity, corrective action, continual improvement.
Four stages to ISO/IEC 42001:2023
Each stage has one defined output. You always know what has been produced and what is next.
- 1Findings report
Gap analysis
Every clause assessed against how you work today, delivered as a written finding list with owners and effort.
- 2Documented system
Documentation
Manual, procedures, forms and records written around your operation. Auditors sample records, not documents.
- 3Audit evidence
Implementation and training
Staff trained, controls in use, the internal audit run and the management review held.
- Certificate issued
Certification audit
Stage 1 and Stage 2 with the registrar, and support closing any non-conformities they raise.
Notice: WCA Global is a consultancy and advisory firm. We prepare your organisation for certification against ISO/IEC 42001:2023; the certificate is issued independently by an accredited third-party registrar.
ISO/IEC 42001, answered
The questions we are asked most before an engagement starts.
Ask something elseHow long does ISO/IEC 42001 certification take?
For a single site, typically eight to twenty weeks from gap analysis to Stage 2, depending on the package and your size. The variable is almost never us. It is how quickly your team can produce the records the standard requires, because several clauses need evidence accumulated over weeks.
Do you issue the certificate?
No, and no consultancy should. WCA Global prepares your organisation; an accredited third-party registrar audits it and issues the certificate. Anyone offering to consult and certify is offering a certificate that a serious customer will not accept.
Which edition applies? Is 2023 current?
ISO/IEC 42001:2023 is the edition we implement against. Where a newer edition is published mid-engagement there is normally a transition period, and the documented system is built so the change is a revision rather than a rewrite.
What happens after the certificate?
The certificate runs on a three-year cycle: surveillance audits in years one and two, recertification in year three. A system that stops being used between audits fails surveillance, which is why the retainer exists.
Can we certify against more than one standard at once?
Yes, and it is usually cheaper than doing them in sequence. The shared clauses reuse the context, leadership, planning, support and evaluation work already done. We quote additional standards at 55% for that reason.
Usually certified alongside
Information Security Management Systems
Protect the confidentiality, integrity and availability of data through controls, policy and secure practice.
Privacy Information Management System
Extends ISO/IEC 27001 and 27002 with requirements for managing privacy information.
Quality Management Systems
Improve customer satisfaction, ensure consistency, and drive continuous process improvement across the organisation.
Get a figure for ISO/IEC 42001.
The quote builder uses our published multipliers: package, headcount, sites and deadline. Additional standards are priced at 55%.