ISO 42001 requirements: what the standard asks of your business

ISO/IEC 42001:2023 is a management system standard for artificial intelligence. It does not test a single model or product. It asks whether your organisation handles AI in a controlled and documented way: who is responsible, which risks you have assessed, which controls apply and how you check that they work.

The standard follows the same high level structure as ISO 9001 and ISO 27001. The requirements are in clauses 4 to 10. Annex A adds AI-specific controls, which you select and justify in a Statement of Applicability. If you already run another management system, much of the structure will look familiar.

Each clause asks for a few concrete things. The list below says what they mean for a business owner and which documents usually back them up.

Clause 4, Context

You describe which internal and external issues affect your use of AI and who has expectations of you: customers, regulators, employees, people affected by your systems. You set the scope of the AI management system and state your role. Typically documented: scope statement, list of interested parties and their requirements.

Clause 5, Leadership

Top management takes ownership. It approves an AI policy, assigns roles and responsibilities and provides the resources. Typically documented: the signed AI policy, role descriptions, a named person responsible for the system.

Clause 6, Planning

You identify risks and opportunities, assess AI risks, decide how to treat them and assess the impact of each AI system on the people it affects. You set AI objectives and prepare the Statement of Applicability. Typically documented: risk method, risk register, treatment plan, impact assessments, objectives.

Clause 7, Support

People need the competence for their AI tasks, they need to know the policy, and documents need to be controlled. Typically documented: training records, competence overview, document control rules.

Clause 8, Operation

You run the processes you planned. Risk assessments and impact assessments are repeated at planned intervals or when a system changes, and the treatments are carried out. Typically documented: life cycle procedures, assessment results, operating records.

Clause 9, Performance evaluation

You measure whether the system works. Internal audits and a management review are mandatory. Typically documented: audit programme and report, management review minutes, monitoring results.

Clause 10, Improvement

When something goes wrong or a control fails, you correct it, find the cause and prevent a repeat. Typically documented: a log of nonconformities and corrective actions.

The first decision in the system is your role. A software vendor that builds an AI feature into its product carries different obligations from a company that buys an AI tool for screening applications. One business can hold several roles at once, and the role determines which Annex A controls matter to you.

A short inventory is enough to start. It also becomes the basis for your scope statement.

1. 01

   List your AI systems

   Include tools you build, tools you sell and tools you only use, such as a chatbot, a scoring model or a CV screening service.

2. 02

   Note your role for each

   Mark whether you develop, provide or use the system.

3. 03

   Name who is affected

   Customers, applicants, patients, employees. This feeds the impact assessment.

4. 04

   Assign an owner

   One person per system who answers for it.

The risk assessment looks at what could go wrong for your organisation. The AI system impact assessment looks at what could go wrong for other people: an applicant rejected by a ranking tool, a customer given a wrong credit indication. The standard asks for both.

Annex A groups its controls by topic, for example policies, resources, impact assessment, life cycle, data, use of AI systems and third-party relationships. You go through them, mark which ones apply, justify any you leave out and record the result in the Statement of Applicability. A supplier questionnaire or a customer audit will often ask to see exactly this document.

The Zertify self-assessment has 40 yes/no questions for this standard. 13 of them are mandatory requirements of the standard and must all be answered yes. Among the other 27 questions you need at least 18 yes answers to pass. The questions follow the clauses above, so answering them also shows where your documentation has gaps.

There is no on-site audit. SICE reviews every assessment, and G6 Agency AG issues the certificate under licence from SICE within 4 hours after you have passed and paid. Every certificate can be checked publicly by number and QR code, which is what a purchasing department usually wants to see.

The certificate costs CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. It is valid for 3 years.

• ISO 42001 certificate at Zertify
• Pricing
• Start the free self-assessment

Collect the documents from the table above, even if some exist only as drafts. A one-page AI policy, a list of your AI systems and a simple risk register cover many of the mandatory questions. Smaller companies do not need long manuals. The documentation should match the size and the AI use of the business.

If you are unsure whether an on-site audit or an online route suits you better, the comparison of certification routes sets them side by side.

• Compare the certification routes
• ISO for small and medium businesses