What is ISO 42001?
ISO/IEC 42001, published in December 2023, is the first international management system standard for artificial intelligence. It helps organizations govern how they develop and use AI: risk assessment, impact assessment, data quality, transparency and human oversight. It organizes 38 AI controls in nine Annex A areas, from AI policy and impact assessment to the AI life cycle, data and third-party relationships. It is structured like ISO 27001, so companies that already run an ISMS can reuse much of their work.
Who needs it
- AI startups selling to enterprises that ask how AI risk is governed
- Companies preparing for the EU AI Act
What usually triggers it
- An enterprise customer’s AI or risk team sends a governance questionnaire
- You want a recognized credential ahead of EU AI Act obligations
How the process works
- Define the scope of your AI management system
- Assess AI risks and impacts
- Implement controls and policies
- Internal audit and management review
- Certification audit by an accredited body
How Holam helps
We work out whether ISO 42001 is what your customers actually need, and in what order alongside other frameworks. We then introduce you to a compliance platform and specialists that fit your stage, and stay involved until the result is in your hands. Holam receives a referral fee from providers we introduce when you engage them. You pay the provider directly, we add nothing to their price, and you remain free to choose another provider.
Frequently asked questions
Does ISO 42001 make us EU AI Act compliant?
Not by itself, but it builds much of the governance the AI Act expects and is a strong foundation.