AI uses and system boundaries
Map each use, purpose and accountable owner before examining the system.
ISO/IEC 42001 · Artificial intelligence
AI governance has to be visible in the decisions.
ISO/IEC 42001:2023 establishes requirements for an artificial intelligence management system. It provides a framework for organisations to manage AI within a defined scope, with policies, responsibilities, risk management and improvement. The useful question is how the organisation can demonstrate that those arrangements operate when AI influences an actual decision. A policy is a starting point; an inventory, an accountable owner and records of oversight let an auditor examine what happens in practice.
Discuss ISO/IEC 42001
What to examine in the system
From intent to evidence.
Accountability and human oversight
Make authority to approve, intervene and stop a system visible in practice.
Risks, impacts and changes
Review impacts, changes and results with records that can be traced.
Begin with the actual uses of AI
Map where the organisation develops, provides or uses AI, including services acquired from third parties. Identify affected processes and people. Clear boundaries make it possible to distinguish what the management system governs, who has authority and which dependencies require scrutiny. The inventory should reflect operational use rather than only officially announced projects.
Examine the oversight
When a person is expected to supervise an AI-supported decision, examine the information they receive and their ability to intervene. Records should help reconstruct what was accepted, challenged, stopped or corrected. Monitoring, incident handling and change reviews make accountability observable over time. These are professional questions for evaluating evidence, not additional requirements invented by this website.
Connect the standards with the right route
ISO/IEC 42001 concerns the organisation's AI management system. ISO/IEC 42006 addresses bodies auditing and certifying AI management systems. The EU AI Act is legislation with its own scope and obligations. These references serve different purposes. Use the source documents to determine what applies; confirm any certification body's current offering and scope directly with that institution.
Evidence worth collecting
- An inventory of AI uses linked to a defined management system scope.
- Named owners, approval responsibilities and records of decisions.
- Risk and impact assessments connected with the organisation's context.
- Records of human oversight, intervention, monitoring and incident handling.
- Supplier, data and change controls with evidence of review.
AI, security and quality connect
AI data, access and suppliers connect this system with ISO/IEC 27001. When outputs enter a process, monitoring and improvement also connect with ISO 9001. Each standard retains its own scope.
A first review
Where should you start?
Select the areas you can already support with records. You will get a list of review priorities.
Questions that matter
Does ISO/IEC 42001 certify an AI model?
It concerns an AI management system within a defined scope. Certification of that system does not itself establish that every model, output or decision is safe or appropriate.
Where should an organisation begin?
Identify its AI uses, responsibilities, affected people, data, providers and decisions. Then examine the evidence already available and the gaps that matter to the intended scope.
Does ISO/IEC 42001 replace the EU AI Act?
No. A management system standard and a legal framework have different functions. Applicable legal obligations require a separate assessment for the organisation and its AI activities.
Can I request ISO/IEC 42001 certification here?
You can send an institutional enquiry to G-CERTI to confirm current availability and applicable scope. This page offers a technical reading of the standard and does not assert an unverified certification capability.
Sources to verify
ISO/IEC 42001 · Página oficial de ISO Sistemas de gestión de inteligencia artificial · ISOSources reviewed on 12 October 2026.
A conversation, a next step
Let’s discuss what matters.
Let’s talkMedia and other inquiries: contact@fernandoarrieta.org