Guide
ISO/IEC 42001 — in brief
ISO/IEC 42001 is the first international standard for artificial intelligence management systems. It helps organisations that develop, provide or use AI systems to do so responsibly — with risk and impact assessment, clear roles, control of data and transparency towards users.
The current version is ISO/IEC 42001:2023. The standard follows the common structure of ISO management system standards, and Annex A contains 38 controls in 9 objectives. It is also a useful framework for preparing for the requirements of the EU Artificial Intelligence Act — Regulation (EU) 2024/1689.
The certificate is issued by an independent certification body after an audit. Baltov Consult is a consultant — we prepare your system and your team for that audit.
Who is ISO/IEC 42001 for
The standard is useful for any organisation that works with artificial intelligence:
- Developers of AI products and services
- Companies introducing AI into their processes
- Cloud and IT service providers
- Banks, insurers and financial institutions
- Healthcare and education organisations
- Public administrations
What ISO/IEC 42001 requires
The standard requires an AI policy, clear roles and responsibilities, an assessment of the risks of AI systems and an assessment of their impact on people and society. The organisation manages the entire life cycle of each system — from design and data to deployment, monitoring and retirement.
The Annex A controls cover policies, internal organisation, resources, impact assessment, the system life cycle, data, information for interested parties, responsible use and relationships with third parties. The organisation selects the applicable controls and justifies any exclusions.
The benefits
Clients, partners and regulators increasingly ask how artificial intelligence is used and who is responsible for it. An ISO/IEC 42001 certificate gives a clear and verifiable answer.
The system reduces risks — wrong decisions, bias, data leaks, infringed rights — and prepares the organisation for its obligations under the AI Act, which for high-risk systems apply in stages until 2028.
The AI Act places uses of AI in four risk levels: prohibited practices (for example social scoring or manipulation of behaviour); high risk, with strict requirements for risk management, data, documentation, human oversight and quality; transparency requirements, where people must know they are interacting with AI or that content is generated; and minimal risk, with no special obligations. The exact classification depends on the specific use, which is why we determine it during the assessment.
How implementation works
- Inventory of AI systemsWhich systems are developed or used, for what purpose and with what data.
- Risk and impact assessmentRisks to the organisation and the impact on people and society.
- Policy and rolesAn AI policy, responsibilities and rules for responsible use.
- ControlsSelecting and applying the Annex A controls — with a Statement of Applicability.
- Training and internal auditWe train your teams and check the system in operation.
- Certification auditWe prepare the organisation for the audit by an independent certification body.
What you get
- Inventory of AI systems
- Artificial intelligence policy
- Risk and impact assessment
- Statement of Applicability for the controls
- Rules for data and the system life cycle
- Map of your obligations under the AI Act
- Trained teams and internal auditors
- Preparation for the certification audit