ISO/IEC 42001:2023 is the world’s first international standard for AI management systems. Published in December 2023, it sets out how organisations should govern, manage and continually improve the way they develop, provide or use artificial intelligence.
Who it’s for?
If your organisation builds AI products, embeds AI into your operations, or relies on AI-driven services from third parties, ISO/IEC 42001 gives you a practical framework for managing the risks that come with it.
What it covers
At its core, the standard requires an AI Management System (AIMS): a structured set of policies, objectives and processes for responsible AI. In practice, that means:
- Governance — defined roles, responsibilities and accountability for AI decisions
- Risk management — identifying, assessing and treating risks across the AI lifecycle
- Fairness and transparency — controls to keep AI systems explainable and mitigate bias
- Compliance — processes to keep pace with evolving AI regulation
- Continuous improvement — ongoing monitoring and refinement as your AI use matures
How it relates to ISO/IEC 27001
Both standards share the same management system structure, so if you already hold ISO/IEC 27001 the foundations are in place. The difference is subject matter: 27001 protects information, 42001 governs how AI is developed and used. For most organisations an AIMS extends the existing ISMS rather than duplicating it.
Where Australia Sits
There is no Australian AI Act today, but in July 2026 the Government announced it will legislate national AI standards, with laws expected before Parliament early next year, indicating that Australian regulatory posture is shifting.
How it relates to the EU AI Act
ISO/IEC 42001 and the EU AI Act work at different levels. The standard is a management system, it governs how your organisation manages AI risk, rather than certifying any individual AI system.
Why it matters
AI regulation is tightening globally, and stakeholders expect proof that AI is being managed responsibly, not just assurances.
Certification against ISO/IEC 42001 gives customers, partners and regulators independent evidence that your AI risk management holds up to scrutiny.
0 Comments