ISO 42001 for healthcare: prove how you control AI

The question usually arrives in a supplier questionnaire from a hospital's purchasing department or an insurer's vendor management. Which AI systems do you use or deliver? Who is responsible for them? How do you test them, and what happens when one gives a wrong result? Without a management system behind it, every answer has to be written from scratch.

Tenders in healthcare increasingly ask for evidence of structured AI governance. A certificate against ISO 42001 gives the buyer a standard reference instead of a free-text reply. The QR code on the PDF leads to a public verification page, so the purchasing team can check the certificate without writing to you.

The standard matters for two kinds of company. Providers of health software with AI features are asked by their customers. Clinics, laboratories, practice groups and care organisations that use AI tools are asked by insurers, partners and sometimes their own board.

• ISO 42001 certificate

The standard does not care whether an AI system is large or small. It asks where AI touches your processes and what could go wrong for the people affected. In healthcare, those people are patients, and the consequences of an error are different from those in a webshop.

These terms appear throughout the standard. Each is shown here with an example from the sector.

AI system

Any software that derives results from data using machine learning or similar methods. Examples: an image analysis tool that flags suspicious findings on scans, a speech-to-text tool that drafts consultation notes, a model that suggests billing codes.

AI provider and AI user

Your role decides which requirements weigh most. A company that builds a triage assistant is a provider. A clinic that buys and runs it is a user. Many organisations are both.

AI risk

A possible harm from the system or its data. Examples: a model trained mostly on adult patients performs worse for children, a summary tool omits an allergy, a scheduling tool systematically delays certain patient groups.

AI system impact assessment

A written review of how a system affects the people it concerns. For a symptom checker, this covers what patients may understand from its output and when a human must take over.

Statement of Applicability

The list of Annex A controls you apply, with the reason for each and the ones you exclude. A health software vendor will, for instance, document its controls for training data quality and for monitoring after release.

The requirements follow the usual structure of ISO management standards: context, leadership, planning, support, operation, performance evaluation and improvement. What differs is the content. The table shows what each core requirement can look like in practice.

• All standards

Most of the work is writing down what already happens. These steps cover the groundwork before you open the self-assessment.

1. 01

   List every AI system

   Include tools bought by individual departments, such as dictation software in radiology or a recruiting tool in HR. Shadow use counts.

2. 02

   Decide your role per system

   Mark each one as provided, produced or used. This determines which controls you need to document.

3. 03

   Name an owner

   One person per system, with authority to pause it. Management approves the AI policy in writing.

4. 04

   Rate the risks

   Start with systems that influence diagnosis, treatment or access to care. Note the measures you already have, such as human review.

5. 05

   Document the impact on patients

   A short paragraph per system is enough to begin: who is affected, what could go wrong, who reviews.

6. 06

   Take the self-assessment

   The questions will show where documents are still missing.

• ISO for small and medium businesses

You answer 40 yes/no questions online. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 27, at least 18 must be yes. No account is needed to start or to buy.

The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before issue. After you pass and pay, the PDF arrives within 4 hours. There is no on-site audit; the classic route with an on-site audit by a certification body is a separate option, compared in our guide.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. The subscription renews automatically and can be cancelled at any time in your customer account, effective at the end of the paid year. Swiss VAT of 8.1% is included for customers in Switzerland and Liechtenstein. If you certify several standards, a 20% discount applies for two and 30% for three or more, also on the yearly fee.

• Start the free self-assessment
• See pricing
• Compare certification routes