Back to ISO
Standard · 2023
ISO/IEC 42001
AI management. 38 controls in nine groups. A Statement of Applicability, and an AI system impact assessment.
Record
The AI management system
The standard
ISO/IEC 42001:2023
Where it is used
On the clause register
What it does
- The control register covers the nine groups.
- The Statement of Applicability is built from inclusion, exclusion, and justification.
- An AI system impact assessment is a record, not a paragraph in a policy.
On the record
- Turn the standard on only if you hold it, or you are working towards it.
- A clause is compliant, partial, a gap, or not applicable. Evidence is linked.
- An AI draft does not count toward readiness until a named person signs it.
The standard
ISO/IEC 42001:2023
AI management systems. The SoA and the impact assessment are part of the pack.
Also in Standard
All- ISO 45001Occupational health and safety. Worker consultation, the hierarchy of controls, and incidents as nonconformities.
- ISO/IEC 27001Information security. 93 Annex A controls in four themes. A Statement of Applicability is required.
- ISO 9001Quality. The operational records sit with the process. A later edition can be added as an update.
- ISO 14001Environment. Published April 2026. New planning clauses, and the management review split. Transition runs to May 2029.
- ISO 50001Energy. The energy review, significant energy uses, the energy performance indicators, the baseline, and the data collection plan.
- ISO 39001Road traffic safety. The numbering does not follow the usual Annex SL pattern. Crash investigation, internal audit, and management review are included.
- ISO 22301Business continuity. The business impact analysis and the risk assessment, the strategies, the plans, and the exercise programme.
- ISO 31000Risk management. It is not a certifiable standard. The record is a maturity self-assessment, not an audit.