ISO/IEC 42001 Certification for AI Management Systems

ISO/IEC 42001 is the first management system standard for artificial intelligence, and itmad audits AI management systems against it for organisations in all industries. itmad operates across the Middle East, Asia and Europe, using local auditors and a travelling team. Certification follows a two-stage audit and results in a certificate valid for three years, kept current by annual surveillance audits. Last reviewed: October 2026.

ISO 42001 in brief

The standard specifies how an organisation governs the AI that it builds, buys or deploys: the policies, risk controls, oversight and lifecycle management that keep an AI system accountable instead of opaque. A certificate is independent confirmation that the AI governance exists and operates.

Who the standard is for

Customers and supplier programmes increasingly ask for independent proof of AI governance. ISO/IEC 42001 applies to any organisation that develops AI products, embeds AI in its services or deploys third-party AI at scale, and to any organisation whose clients ask how its AI is governed. The standard is written to apply whatever the sector or the specific technology, so it fits a bank's credit-scoring model as readily as a health provider's diagnostic tool or a public body's chatbot for citizens.

What auditors examine

• AI policy and objectivesA stated position on how AI is used, aligned with organisational purpose and with legal and ethical obligations.
• AI risk assessmentThe risks that an AI system poses to individuals, groups and the organisation, identified and treated in proportion.
• AI system impact assessmentThe consequences for the people an AI system affects, including fairness, safety and rights.
• Data governanceControl over the data used to train, test and run AI systems, including its quality, provenance and appropriate use.
• Lifecycle managementDefined controls across design, development, verification, deployment, operation and retirement.
• Transparency and accountabilityRoles, responsibilities and records that make it possible to explain the behaviour of a system and to answer for it.
• Human oversightMechanisms that keep meaningful human control over AI decisions wherever the stakes require it.
• Third-party and supplier controlManagement of AI components, models and services obtained from others, in proportion to their effect on outcomes.

How an itmad audit runs

Stage 1 reviews the AI management system documentation, confirms the scope of AI systems covered and establishes readiness, raising gaps early enough to be closed. Stage 2 tests the system in operation: whether governance runs as documented, whether risk and impact assessments are real and current, whether data controls hold in practice, and whether human oversight works where the system needs it.

The certificate cycle

An ISO 42001 certificate from itmad is valid for three years, with surveillance audits in each of the two intervening years and full recertification before it expires. The certificate states its scope, including the AI systems covered.

With other management system standards

ISO/IEC 42001 uses the same high-level management system structure as ISO 9001 and ISO/IEC 27001. An organisation already certified to ISO/IEC 27001 will find the context, leadership, planning and evaluation clauses familiar, and an integrated audit covers those common elements once. Information security and AI governance make a natural pair, because AI risk is closely tied to the data behind the AI.

Independence

Independence is what gives the certificate its value to the customer who asked for it. ISO/IEC 17021-1 bars itmad from designing, implementing or consulting on the system being certified, so the role of itmad is limited to the audit, the certification decision and, on request, a pre-assessment that identifies gaps against ISO 42001 without prescribing the fix.

What itmad delivers

• Readiness gaps reported after Stage 1, before the main audit begins
• A Stage 2 audit report with every finding backed by objective evidence
• Nonconformities graded by severity, each with a stated response time
• A certificate of registration naming the scope and locations certified
• Use of the certification mark under itmad's mark and seal policy
• Surveillance audits and reports in each year of the three-year cycle

Frequently asked questions

What is ISO/IEC 42001?

ISO/IEC 42001 is the first management system standard for artificial intelligence. It specifies how an organisation governs the AI that it builds, buys or deploys.

What does ISO 42001 require?

It requires an AI policy and objectives, AI risk and impact assessment, data governance, lifecycle management, transparency and accountability, human oversight, and control of third-party AI. These sit in the same high-level structure as ISO 9001 and ISO/IEC 27001.

Does ISO 42001 apply to AI bought from suppliers?

Yes. The standard requires control of AI components, models and services obtained from others, in proportion to their effect on outcomes. It is written to apply whatever the sector or the specific technology.

How does an ISO 42001 audit work?

itmad audits in two stages. Stage 1 reviews the documentation and confirms the scope of AI systems covered. Stage 2 tests whether governance runs as documented, whether assessments are real and current, and whether human oversight works where required.

Which organisations need ISO 42001?

Organisations that develop AI products, embed AI in their services or deploy third-party AI at scale, and organisations whose clients ask how their AI is governed. The standard is not limited to any sector.

How long does an ISO 42001 certificate last?

An ISO 42001 certificate from itmad is valid for three years, with surveillance audits in each of the two intervening years. Recertification is completed before expiry.