Automate ISO 42001 readiness with adaptive compliance

ISO/IEC 42001 is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), and developed by ISO/IEC JTC 1/SC 42 — the joint subcommittee for artificial intelligence.

ISO doesn't certify anyone. Certification is issued by independent certification bodies, which are in turn accredited by national accreditation bodies such as ANAB in the United States and UKAS in the United Kingdom.

Whether you actually run an AI management system, not whether your AI is “good”.

Explained further, ISO 42001 doesn't assess model accuracy, benchmark performance, or certify any individual AI system. It evaluates governance: whether you've defined the scope of your AI activity, assessed the risks and the impacts on affected people, assigned accountability, and built a system that reviews and improves itself.

Often, yes. The standard explicitly covers organizations in three roles: AI Producers (those that produce AI), AI Providers (those that develop or provide it), and AI Subjects (those that use it).

In practice, most companies asked for ISO 42001 by a customer are in the third category. If your teams run AI tools against customer data, your buyer's concern is the same whether you trained the model or subscribed to it.

No. This is the single most common misconception, and it's inherited from the same misconception about ISO 27001.

Annex A is a reference set. You determine the controls your risk treatment actually needs, then compare that set against Annex A to confirm nothing necessary was inadvertently left out. You document the result — what applies, why, and your justification for anything excluded — in a Statement of Applicability.

They're complementary, and neither substitutes for the other.

ISO 27001 governs information security. ISO 42001 governs AI. They share the same harmonized management system structure: leadership, risk assessment, internal audit, management review. This means that if you already run an ISO 27001 management system, the machinery will be familiar and some of it is reusable. What isn't reusable is the substance: AI impact assessment, data governance for AI systems, transparency, and human oversight have no ISO 27001 equivalent.

Most organizations pursuing both run them as one integrated management system. Certification bodies often run combined ISO 27001 + ISO 42001 audits, unlocking savings for your business. 

ISO 42001 is not a harmonized standard under the AI Act and does not confer presumption of conformity with it. It's useful supporting evidence of governance maturity, and the two are often discussed together — but they are separate instruments, and anyone telling you certification makes you AI Act compliant is overselling.

Initial certification runs in two stages, both performed by an accredited certification body.

• Stage 1 reviews your management system on paper — scope, AI risk and impact assessments, Statement of Applicability, and whether you're ready to be audited properly.
• Stage 2 tests whether the system is genuinely operating: evidence sampling, interviews, and a look at whether your documented governance matches what your teams actually do.

A certificate issued by the certification body, plus an audit report.

The certificate names your scope — which parts of your organization and which AI activity it covers. As with ISO 27001, a scope covering one product line is not a scope covering your company, and sophisticated buyers read it.

Clause 4.3 requires you to determine the boundaries and applicability of the ISMS, taking account of internal and external issues, interested-party requirements, and the interfaces and dependencies between what you do and what other organisations do on your behalf. The scope has to exist as documented information.

In practice the scope statement names five things:

1. What it protects: the products, services, or business activities the ISMS covers.

2. Which part of the organisation: the legal entity, and whether it's the whole entity or specific divisions, teams, or functions.

3. Where: physical locations. Offices, data centres, and increasingly a statement about remote working.

4. Which systems: the technology boundary. Networks, infrastructure, applications, and which cloud services are inside it.

5. What's excluded, and why: anything carved out needs justification you can defend to an auditor.

By convention the statement also references your Statement of Applicability by version and date, which ties the scope to the specific set of controls you declared applicable at the time.

This matters because the scope statement is printed on the certificate, and it's chosen by you. A certificate covering one product line, one office, or one subsidiary is entirely legitimate — and it isn't a certificate covering your company. Sophisticated buyers read it before they read the badge, which is why it's worth writing a scope you'd be comfortable having quoted back at you rather than the narrowest one you can certify.

ISO 42001 has to account for your role: whether you develop AI, provide it, or use it. This will impact the scope statement, as well as your controls. 

No standards body publishes a timeline, so treat any specific number — including this one — as an estimate rather than a fact.

For a first-time certification, plan for six to twelve months from decision to certificate. That's longer than a comparable ISO 27001 engagement, for two reasons specific to this standard.

You can't certify a management system that started last week. Before Stage 2, you need to have actually run the AIMS — completed at least one internal audit and one management review, and accumulated records showing your controls operating over a period. That's a floor on the timeline no amount of implementation speed removes.

Finding an accredited certification body can be the constraint. ISO/IEC 42006 — the standard governing bodies that audit and certify AI management systems — was only published in July 2025. ANAB opened its accreditation program in January 2024 and reports that only a handful of certification bodies are nearing the end of initial accreditation. Booking an accredited auditor is a live scheduling question right now in a way it isn't for older standards.

One accelerator: if you already run an ISO 27001 management system, the machinery transfers. Both use the same harmonized structure, so leadership, risk assessment, internal audit, and management review are familiar processes rather than new ones. What doesn't transfer is the substance — AI impact assessment, data governance for AI systems, transparency, and human oversight have no ISO 27001 equivalent.

There's no graded opinion for ISO 42001 the way there is with SOC 2. Findings are recorded as nonconformities.

A major nonconformity (a systemic failure or a missing required element) must be corrected and verified before certification can be granted or maintained. A minor nonconformity is typically handled through a corrective action plan without blocking certification. Auditors may also raise observations, which carry no obligation.

So you can straightforwardly fail to achieve certification, and an existing certificate can be suspended or withdrawn if major nonconformities go unresolved.

An ISO 42001 is valid for three years.

Surveillance audits happen at least annually, and a full recertification audit takes place before the three years expire.

No. It's a voluntary international standard and no law requires it.

Where it shows up is commercial: enterprise security reviews and vendor questionnaires increasingly ask what governs your AI, and a certificate answers that faster than a policy document does.

No compliance software can issue an ISO 42001 certificate. Certification must come from an independent certification body, accredited by a recognized accreditation body — that independence is the entire basis of the certificate's value.

What Iru does is everything up to that point: mapping your AI footprint, generating and maintaining controls, keeping your Statement of Applicability current, and collecting the evidence your auditor will sample. If you would like to work with one of the certification bodies we partner with, please book a demo to explore the compliance solution. Existing customers can reach out to their rep for info about our audit partners.