¿Qué es ISO/IEC 42001:2023 y para qué sirve?

ISO/IEC 42001:2023 es la primera norma internacional que define requisitos para establecer, implementar, mantener y mejorar continuamente un sistema de gestión de inteligencia artificial (AIMS). Aplica a organizaciones que desarrollan, proveen o usan IA. Lo que certifica es la madurez del sistema con que la organización vigila sus modelos; el desempeño técnico del modelo se demuestra por otra vía.

¿Cuál es la diferencia entre ISO 42001, EU AI Act y NIST AI RMF?

No compiten: cada uno responde una pregunta distinta. ISO/IEC 42001 ordena el sistema de gestión interno y es certificable. El EU AI Act impone obligaciones a los actores comprendidos por su ámbito de aplicación. El NIST AI RMF es un marco voluntario que aporta vocabulario y prácticas de riesgo técnico. Una organización puede necesitar combinarlos según sus roles, casos de uso, contratos y jurisdicciones; la aplicabilidad se determina por separado.

¿Por qué la auditoría anual no alcanza para sistemas de IA?

Porque los modelos en producción se actualizan por semanas — la cadencia varía por proveedor y se verifica en sus notas de versión públicas — y una auditoría que revisa el sistema una vez al año describe un estado que ya no existe. La auditoría continua complementa el ciclo anual con telemetría auditable, revisiones independientes de frecuencia variable y verificación disparada por eventos relevantes del sistema, no por calendario.

Algorithmic governance in Latin America · Report

The state of algorithmic governance in Latin America

Artificial intelligence models in production are updated on a weekly basis; the human committees that should govern them deliberate on a quarterly basis. The asymmetry is measurable: providers' public release notes versus committee minutes. The report structures the field and compares the three frameworks under which that asymmetry becomes governable — ISO/IEC 42001, EU AI Act, NIST AI RMF.

Latin American organisations already operate artificial intelligence at a speed their own governance cannot match. The ISO/IEC 42001:2023 standard, published in December 2023, established the first international framework for AI management systems (ISO, 2023). This report structures the state of the field with a declared evidence cut-off — May 2026, updated with the final adoption of the Digital Omnibus by the Council of the EU on 29 June 2026 — and explains the three frameworks that every board will encounter.

Data from the field

Three simultaneous processes broke the traditional model of technology governance.

Constant updates

Models in production consume ongoing updates · new foundation models, fine-tuning, updated datasets. The exact cadence varies by provider and by quarter — it is verified in each provider's public release notes, without third-party statistics. A system certified in January may be operationally unrecognisable in April.

Automatic deployment

Providers deploy changes without customer intervention. What runs in production today is the system that was audited plus the drift accumulated since the last review — and that drift bears no one's signature within the organisation.

The invisible chain

The technology supply chain introduces vectors of change that the organisation inherits without seeing them. The provider's provider's provider changes something, and the audited organisation takes on that change unknowingly.

The record of harm runs alongside the three signals: the public artificial intelligence incident database added 346 entries in 2025 and has accumulated more than 1.360 since its creation (AI Incident Database, 2026).

Annual certification still made sense when reality waited for the auditor. Today, reality does not wait. It moves.

The three frameworks. The table that structures the field

Three frameworks coexist in practice, and each answers a different question. The most common misreading in the field is to treat them as substitutes. ISO/IEC 42001 structures the management system; the EU AI Act regulates systems within its scope of application; the NIST AI RMF provides a technical risk vocabulary. An organisation may need to combine them depending on its roles, use cases, contracts and jurisdictions; none becomes mandatory merely because the others exist.

Framework	Nature	Scope	Status	Who it binds
ISO/IEC 42001:2023	International management system standard · certifiable by accredited bodies	The management system that oversees the models (AIMS) · context, leadership, risks, controls, improvement	Published in December 2023 · verifiable certification body accreditations in operation	Voluntary · binding on those who adopt it or undertake to comply with it by contract
EU AI Act · Regulation (EU) 2024/1689	European regulation whose scope includes certain situations outside the EU	Systems and actors covered by the regulation, classified by role and risk level	Phased · timeline subject to the applicable text and the entry into force of the Digital Omnibus (see timeline)	Providers, deployers and other actors only when they fall within its scope of application
NIST AI RMF	Voluntary risk management framework	Technical risk vocabulary and practices throughout the system lifecycle	Version 1.0 published in 2023 (NIST, 2023) · North American technical reference	No one by law · binding through contract or internal adoption

The European regulatory clock · post-Omnibus timeline

On 29 June 2026, the Council of the EU gave the final green light to the Digital Omnibus on AI. The adopted text sets new dates for the transparency of generated content and for high-risk systems. The official press release itself stated that the act would subsequently be published in the Official Journal and enter into force on the third day following that publication. A compliance decision must therefore verify the published text and its effective date, rather than rely solely on the announcement.

Obligation	Date	Status as of July 2026
Absolute prohibitions	February 2025	In force and applicable
General-purpose models (GPAI)	August 2025	In force and applicable
Transparency of generated content	2 December 2026	Date of the adopted text · verify publication and entry into force
High risk · Annex III	2 December 2027	Date of the adopted text · verify publication and entry into force
High risk · Annex I	2 August 2028	Date of the adopted text · verify publication and entry into force

An auditor's reading of the timeline fits into one sentence: the world's most ambitious AI law had to slow down before being applied, while the public record of incidents continues to grow. The gap between the pace of the system and the pace of governance also reaches regulators.

The accreditation chain has already reached AI

ISO/IEC 42001 shares the harmonised structure of ISO 9001, ISO/IEC 27001 and ISO 14001, allowing it to be integrated with existing management systems. The chain that makes certification verifiable is also in operation: ANAB publishes the corresponding accreditation programme, and in March 2026 BSI reported accreditations from ANAB, UKAS and RvA to certify under ISO/IEC 42001. Estimates of the worldwide number of certificates issued circulate without a consolidated primary source; this report refrains from citing them. What can be verified today are the scopes of accreditation and the regional adoption data that piece 17 organises with declared sources.

Two mistakes recur in organisations starting the process. First · confusing certification with the model's technical compliance. ISO 42001 certifies the management system that oversees the model; the model's performance is demonstrated through other means. Second · transferring the information security audit team directly to AI without specific training. The conceptual overlap is real; technical equivalence is not there yet.

What changes for the auditor

Audit practice needs three components that the traditional model lacked · auditable telemetry, independent reviews at variable intervals and change-based, rather than calendar-based, verification. The full temporal pathology — why the annual visit no longer captures operations and what evidence each component generates — has its own piece: report 04 in this series, which applies Criterion 09.

What remains is the profession's longstanding question. How what is declared is demonstrated. What evidence supports each technical claim. Who signs off on each critical decision.

A certificate issued without underlying auditable telemetry is a certificate that has expired on the day it is signed.

About this report.

What is ISO/IEC 42001:2023 and what is it for?

ISO/IEC 42001:2023 is the first international standard to define requirements for establishing, implementing, maintaining and continually improving an artificial intelligence management system (AIMS). It applies to organisations that develop, provide or use AI. What it certifies is the maturity of the system through which the organisation oversees its models; the model's technical performance is demonstrated through other means.

What is the difference between ISO 42001, the EU AI Act and the NIST AI RMF?

They do not compete: each answers a different question. ISO/IEC 42001 structures the internal management system and is certifiable. The EU AI Act imposes obligations on actors within its scope. The NIST AI RMF is a voluntary framework that provides terminology and technical risk practices. An organisation may need to combine them depending on its roles, use cases, contracts and jurisdictions; applicability is determined separately.

Why is an annual audit not enough for AI systems?

Because models in production are updated on a weekly timescale — the cadence varies by provider and can be verified in their public release notes — and an audit that reviews the system once a year describes a state that no longer exists. Continuous auditing complements the annual cycle with auditable telemetry, independent reviews at variable intervals and verification triggered by relevant system events, rather than by the calendar.