ISO/IEC 42001

Published in 2023, the standard follows the same high-level structure as other ISO management system standards such as ISO 27001, which makes it easy to combine with them. It asks the organisation to understand its context, set an AI policy, assign responsibilities, assess risks and impacts, plan and control the AI lifecycle, manage data and suppliers, monitor performance, audit itself and keep improving. An annex lists controls, for example on data quality, transparency and human oversight. The standard does not prescribe technical tests and does not by itself prove legal compliance. Independent certification bodies audit organisations against it and issue a certificate, kept valid through periodic surveillance audits. Procurement teams ask for the certificate in tenders, but read it as proof of a management process and not of any one model's quality.

A tech firm selling an AI scheduling product wants to reassure corporate clients. It writes an AI policy, names an accountable executive, adds an impact assessment step to product approval, and sets up internal audits of its AI features. After a certification body reviews the documents and interviews staff, the firm is certified, with a surveillance audit each year.