Devon Asante, deputy CIO at a large county, had a binder problem. His agency had run eleven separate AI projects in two years: a chatbot, a fraud-detection model, a translation tool, document summarizers. Each one had its own ad hoc review, its own risk memo, its own well-meaning team improvising governance from scratch. When the county auditor asked a simple question, "Show me how you manage AI across the organization," Devon had eleven binders and no system. The auditor's follow-up stung: "So who is accountable when something goes wrong, and how would you even know?" Devon could not answer cleanly. He had governance in pockets, not governance as a practice.

What he needed was not another policy document but an operating system for managing AI across every project, present and future. That operating system has a name and an international standard behind it: ISO/IEC 42001. This lesson is for senior managers and program directors who must move from scattered, project-by-project AI oversight to a repeatable, auditable management system. We will follow Devon's binder problem through what the standard actually is, how its clauses and controls are structured, how it relates to the frameworks you already work under, what implementation and certification really involve, and how to run a gap analysis that turns the standard into a roadmap rather than a stack of paperwork.

What ISO/IEC 42001 actually is

ISO/IEC 42001:2023, titled Information technology, Artificial intelligence, Management system, is the first certifiable international standard for an artificial intelligence management system, usually abbreviated AIMS. It was published jointly by ISO and IEC through the subcommittee on artificial intelligence, ISO/IEC JTC 1/SC 42, on 18 December 2023, and it follows the Annex SL high-level structure common to all modern ISO management system standards. If you have encountered ISO standards for information security or quality, this is the same family applied to AI. The key word is system. It is not a checklist for one project; it is a framework for managing all of them.

The standard is technology-neutral and sector-neutral. It applies to any organization that develops, provides or uses AI systems, which includes federal agencies, federal contractors, state and local governments, and private-sector vendors alike. It is also auditable in a specific sense: a conforming organization can obtain certification from an accredited certification body, providing third-party assurance that it has implemented a systematic approach to managing AI-specific risks and opportunities. That distinction is what separates it from the NIST AI Risk Management Framework, which is voluntary, non-binding guidance and is not certifiable. The two are complements rather than competitors, and ISO 42001 exists in part to create a marketplace in which trustworthiness claims can be checked by someone other than the party making them.

What that gave Devon was the thing his eleven binders lacked: a single backbone every AI project plugs into, so governance is built once and inherited by each project rather than reinvented each time. Eleven binders is not a governance system. It is eleven chances to forget something.

The ten clauses and the improvement loop

ISO 42001 follows the Plan-Do-Check-Act cycle through ten clauses, and the structure is deliberately identical to ISO 27001, ISO 9001, ISO 14001 and ISO 22301 so that organizations can run integrated management systems rather than parallel ones. Clause 1 sets scope. Clause 2 lists normative references. Clause 3 aligns terms and definitions with the ISO/IEC 22989 AI terminology standard. Clause 4, Context of the organization, requires you to understand the organization and its stakeholders' expectations, determine the scope of the AIMS, and establish the AIMS itself.

Clause 5, Leadership, requires top-management commitment, an AI policy, and assigned roles, responsibilities and authorities including a role equivalent to a Chief AI Officer. Clause 6, Planning, addresses AI risks and opportunities, AI objectives, and how you will achieve them; this is where the companion risk management standard integrates. Clause 7, Support, covers resources, competence, awareness, communication and documented information. Clause 8, Operation, addresses operational planning and control, AI risk assessment and treatment, and the AI system life cycle. Clause 9, Performance evaluation, covers monitoring, measurement, analysis, evaluation, internal audit and management review. Clause 10, Improvement, addresses nonconformity, corrective action and continual improvement.

Read as a loop rather than a list, that is simply: decide what you are governing and who owns it, plan against your risks, resource the work, run it across the AI life cycle, measure whether it is working, and fix what is not. Every clause maps onto a question an auditor or a legislator is eventually going to ask you out loud, which is the most useful way to memorise them. Clause 4 answers what is in scope. Clause 5 answers who is accountable. Clause 6 answers what you were worried about. Clause 8 answers what you did about it. Clause 9 answers how you know it worked, and Clause 10 answers what happened when it did not.

Annex A: the controls, in plain terms

Annex A contains 38 reference controls organized into nine control categories, parallel to but distinct from the Annex A of the information security standard. Category A.2 covers policies for AI, including an AI policy aligned with organizational strategy. A.3 covers internal organization: governance structures and responsibilities. A.4 covers AI resources, meaning documented data, tooling, computing and system components. A.5 covers assessing impacts of AI systems, including impact assessments for individuals and society.

A.6 covers the AI system life cycle: objectives, design, verification and validation, deployment, operation, monitoring, logging and end of life. A.7 covers data for AI systems: quality, provenance and preparation. A.8 covers information for interested parties, including end users and the subjects of AI decisions, spanning documentation, system information, usage notifications, reporting channels and external reporting. A.9 covers use of AI systems: operational responsibilities and intended use. A.10 covers third-party and customer relationships, allocating responsibilities across supplier agreements and customer obligations.

You do not need to memorize the numbering, and no auditor expects a program director to recite it. You do need to recognize the themes well enough to know which one a given problem belongs to, because that is how a control set stops being a compliance artifact and starts being a way of thinking about a system. Read the six themes below with a government eye and you will notice that none of them are foreign. They are the same concerns already present in the NIST AI Risk Management Framework, in OMB guidance on federal AI, and in the privacy assessments agencies have performed for years, organised into one operable system with controls you can assign, implement and audit:

• Leadership and accountability. A named senior owner is accountable for AI, with a stated policy and objectives. This is the direct answer to the auditor's "who is accountable?"
• Risk and impact assessment. Every AI system is assessed for risks to people, including a dedicated assessment of impact on individuals, a natural fit with the privacy and rights reviews government already does.
• Data governance. Controls over the data that feeds AI, its quality, provenance and appropriate use, because in AI the data is the system.
• Lifecycle management. Defined practices from design through deployment to retirement, including testing, documentation and monitoring over time.
• Transparency and human oversight. Telling affected people when AI is used and keeping humans in control of consequential decisions.
• Supplier and third-party management. Governing the AI you buy, not just the AI you build, since most government AI is procured.

Two structural points matter more than the control list itself. First, not every control is required for every organization. A Statement of Applicability documents which controls apply, why, and how, in the same way the information security standard uses one. Second, certification is to the management system as a whole, and the auditor samples controls across the declared scope rather than testing all of them everywhere. That is a strength for feasibility and a limit on what a certificate proves, and both halves of that sentence matter.

Where it sits among the other standards

ISO 42001 does not stand alone, and knowing its neighbours saves you from buying the same work twice. ISO/IEC 23894:2023 on AI risk management guidance provides the methodology that feeds Clause 6 planning and Clause 8 operation. ISO/IEC 38507:2022 on the governance implications of organizational AI use informs Clause 5 leadership. ISO/IEC 22989:2022 supplies concepts and terminology. ISO/IEC 5338:2023 elaborates the AI system life cycle processes behind Annex A.6. The ISO/IEC 5259 series addresses data quality for analytics and machine learning, feeding A.7, and ISO/IEC 25059 provides an AI quality model that feeds evaluation criteria. Two technical reports, ISO/IEC TR 24028 on trustworthiness and ISO/IEC TR 24027 on bias, are informational but useful.

On the management system side, ISO/IEC 27001:2022 for information security integrates tightly, since AI systems need security regardless, and many organizations run 27001 and 42001 as a single integrated system. ISO/IEC 27701:2019 for privacy information management complements it wherever AI processes personal information. ISO 9001 for quality and ISO 22301 for business continuity complete the picture for organizations already carrying multiple certifications. Outside ISO, the NIST AI Risk Management Framework aligns philosophically and crosswalks usefully, and the EU AI Act, in force since August 2024, references harmonized standards being developed by CEN-CENELEC JTC 21, work that draws heavily on ISO 42001 and ISO 23894. For US federal work the surrounding stack is OMB M-24-10, the NIST framework, FedRAMP and FISMA.

Running it alongside what you already have

Most agencies encountering this standard already operate at least one management system, and the practical question is not whether to adopt ISO 42001 but how to avoid running a second bureaucracy beside the first. The Annex SL structure exists precisely to prevent that. Because Clauses 4 through 10 are structurally identical across the ISO management system standards, the context analysis, leadership commitment, competence and awareness arrangements, documented information controls, internal audit programme and management review can be single processes that cover several standards at once.

In practice that means one internal audit schedule that samples security, privacy and AI controls in the same cycle, one management review agenda with a standing AI section, one document control regime, and one corrective action process. What stays distinct is the risk and impact work, because the objects of concern differ. Information security risk asks what could happen to the organization's information; AI impact assessment asks what could happen to the individuals and communities a system acts on. Those are not the same question and merging them is a common way to lose the second one.

The privacy management standard is the natural third member wherever AI processes personal information, since it supplies the privacy control structure that AI data governance depends on. Quality and business continuity management complete the set for organizations already carrying multiple certifications. The integration is not free, and it takes a deliberate mapping exercise to establish which existing artifact evidences which clause. But the alternative, a standalone AI management system with its own parallel audit calendar and its own document library, tends to be abandoned within two cycles because nobody has the capacity to run two of everything.

Crosswalking with the NIST AI Risk Management Framework

NIST published a crosswalk between AI RMF 1.0 and ISO/IEC 42001:2023 in 2024 so that organizations could implement both without duplicating effort. As that crosswalk summarises the relationship, the GOVERN function maps to Clauses 4 and 5 and Annex A.2 and A.3; MAP maps to Clauses 4 and 8 and Annex A.4 and A.5; MEASURE maps to Clause 9 and Annex A.6 through A.8; and MANAGE maps to Clauses 6, 8 and 10 and Annex A.9 and A.10. Treat that as the mapping the source states rather than as a definitive control-by-control equivalence, and verify against the published crosswalk before you rely on it in an audit response.

The alignment is deliberate, because the subcommittee behind the standard and NIST collaborated extensively. The practical implication for federal agencies and contractors is that a management system implementation can reuse existing framework deliverables as evidence during certification, and certification artifacts can serve framework work in return. The same logic extends outward: the EU AI Act's quality management system requirement for high-risk systems under Article 17 corresponds heavily to ISO 42001, and the European harmonized standards in preparation are likely to reference or incorporate it. One body of evidence, several regimes.

Why the standard suits public-sector work

Public agencies are adopting AI faster than they are governing it, and the gap does not announce itself. It accumulates quietly as project-by-project oversight, each instance defensible on its own, until the aggregate is real risk with no system behind it. Devon found three reasons this standard fits government especially well. First, government is held to account by auditors, inspectors general, legislators and the public, and this standard is built to be audited. It produces documented evidence of how AI is managed, which is precisely the kind of evidence those overseers ask for. Be careful about what that evidence covers, though: it demonstrates that a management system exists and operates, not that any particular AI system produced a correct or fair outcome.

Second, it complements rather than replaces the frameworks already in play. The US risk framework tells you what good AI risk practice looks like; ISO 42001 gives you the management structure to run that practice consistently and prove you did. Third, it scales. A county with eleven projects and a department with two hundred can use the same backbone, with controls applied proportionately to each system's risk, because the Statement of Applicability lets you scope deliberately rather than uniformly.

The implementation path, in six phases

An agency or contractor standing up a management system typically moves through six phases, and the sequence matters considerably more than the speed. Organizations that start with controls before scope, or with certification before implementation, generally spend the first year producing artifacts that later have to be redone against a scope they had not yet defined. The phases below are ordered so that each one produces the input the next one needs, which is also why skipping ahead tends to cost more time than it saves.

1. Initiation. Secure executive sponsorship, define scope across which AI systems, which organizational units and which locations, appoint an AIMS lead who is often the Chief AI Officer or a designee, and run a gap analysis against Clauses 4 through 10 and Annex A.
2. Policy and governance. Establish the AI policy, assign roles and responsibilities, and produce the Statement of Applicability recording which controls apply and why.
3. Risk and impact. Conduct AI risk assessments using the companion risk management standard and AI impact assessments under Annex A.5, aligned with the categorization required by federal AI policy.
4. Lifecycle controls. Implement the Annex A.6 through A.8 controls across the AI life cycle: data quality, design, verification, validation, deployment, monitoring and decommissioning.
5. Operation and improvement. Run the system, collect metrics, perform internal audits, hold management reviews and address nonconformities.
6. Certification, which is optional. Engage an accredited certification body for a stage-1 documentation review and a stage-2 on-site assessment, followed by surveillance audits annually and full recertification every three years.

For an organization already certified to ISO 27001, the incremental effort to add 42001 is typically smaller than a greenfield implementation, because the governance, risk and audit infrastructure already exists and only the AI-specific controls are genuinely new. Accreditation bodies such as the ANSI National Accreditation Board accredit the certification bodies themselves, and it is worth verifying an accreditation scope before you engage anyone.

What the audit actually looks like

The single most useful preparation habit is also the least exciting: generate evidence as a by-product of doing the work rather than assembling it in the weeks before an audit. An impact assessment completed at the time a system was designed, with a date and an author, is evidence. The same assessment written retrospectively from memory is a document. Auditors can tell the difference, and so can an inspector general. Keep the artifacts in one repository, linked to the controls they evidence, so that producing an audit pack is a matter of retrieval rather than reconstruction.

A stage-1 audit reviews documentation: the AI policy, the Statement of Applicability, the risk assessment methodology and its outputs, impact assessments, system lifecycle documentation, internal audit results and management review minutes. The auditor identifies gaps that must be closed before stage 2. A stage-2 audit verifies implementation. Expect interviews with the AIMS lead, system owners, data stewards and operations staff; review of records covering change management, incident response, monitoring outputs, supplier assessments and training; and spot checks of specific AI systems inside the scope.

Findings are graded. A major non-conformity is a fundamental failure and must be closed before certification is granted. A minor non-conformity is an isolated gap and requires a corrective action plan. The non-conformities that recur among early adopters are worth reading as a pre-audit checklist: insufficient evidence of AI risk treatment tracking, weak third-party and supplier controls, undocumented data provenance, impact assessments with no follow-through, and gaps in end-user notification. The preparation habits that prevent them are equally consistent: maintain living evidence rather than assembling it before the audit, keep a single artifact repository linked to controls, run internal audits semiannually, and run tabletop exercises for incident response.

On cost, the source guidance for this lesson gives a range for a mid-size organization that already holds ISO 27001: roughly 6 to 12 months of preparation and $50,000 to $250,000 in audit and consulting fees, excluding internal labour. Treat that as an order of magnitude for budgeting rather than a quote, and note what it excludes, because internal labour is usually the larger number and the one that gets left out of the business case.

Federal applicability and what a certificate means in procurement

ISO 42001 is voluntary for federal agencies. Neither OMB M-24-10 nor any current statute mandates it. Several use patterns are nevertheless emerging. Agencies are including certification as a proposal evaluation factor for AI procurements, particularly for rights-impacting and safety-impacting systems. Some are pursuing internal certification of their AI centres of excellence as a signal of governance maturity to Congress and the public. Vendors seeking federal business are certifying pre-emptively. Cross-border procurement increasingly expects aligned frameworks, and the standard serves as a common language. And the EU AI Act's Article 17 quality management system requirement for high-risk providers points in the same direction.

If you evaluate a certificate, evaluate it properly. Check the accreditation of the certification body, the scope stated on the certificate, its age, and any conditions attached. A certificate covers the scope its holder declared, which may be one product line rather than the company, and it reflects a sample taken at a point in time. Above all, hold the distinction the source states plainly: certification is not a guarantee that AI failures will not occur. It is an indicator of systematic governance. A certified management system is evidence of a conforming process, not proof that any given AI system is safe, lawful or fit for your use, and a procurement that treats it as the latter has substituted a badge for an evaluation.

The same caution applies to private certification schemes. Several exist, and they are not equivalent, because they lack the international accreditation infrastructure that stands behind ISO certification. Where you are requesting certification-based assurance, prefer the accredited international scheme and say so in the solicitation.

A 42001 gap analysis you can run this month

Devon's first move was not to adopt the whole standard overnight, and neither should yours be. It was a gap analysis: for each control theme, assess where you stand today and decide what to do next. Score each theme as Absent, Ad hoc, Defined or Managed. Absent means nothing exists; Ad hoc means it happens when someone remembers; Defined means it is written down and expected; Managed means it is written down, performed, evidenced and reviewed. The distribution of those four scores across the themes is your roadmap, and it usually takes an afternoon to produce.

1. Leadership and accountability. Is there a named, senior, accountable owner for AI with a written policy? (Devon: Ad hoc.)
2. AI inventory. Do we maintain a current list of every AI system in use, built or bought? (Devon: Absent, the eleven-binder problem.)
3. Risk and impact assessment. Is every AI system assessed for risk and impact on individuals before deployment, using a standard method?
4. Data governance. Are there controls over the quality, source and use of data feeding our AI?
5. Lifecycle controls. Do we have defined testing, documentation and ongoing monitoring across each system's life?
6. Transparency and human oversight. Are people told when AI is used, and can a human override consequential decisions?
7. Supplier management. Do our contracts hold AI vendors to our governance requirements?
8. Continual improvement. Do we review the whole system periodically and improve it, rather than only reacting to incidents?

The rule of thumb: tackle Absent and Ad hoc items first, starting with the AI inventory and the named owner, because nothing else can be managed until you know what you have and who is responsible. Devon did not chase formal certification on day one. He ran the gap analysis, stood up an inventory, named an accountable owner, and rolled out one shared risk-and-impact assessment that every project, old and new, had to pass. Within a quarter, eleven binders had become one living system, and the auditor's question had a clean, documented answer.

Devon's first quarter, mapped to the standard

It helps to see how a modest, realistic set of moves maps onto the clauses, because the standard reads as far more onerous than a competent first quarter actually is. Reading the ten clauses cold, a small agency reasonably concludes that conformance is out of reach without a dedicated team. Watching what one deputy CIO actually did in three months suggests otherwise. Devon did four things. Each one satisfied a specific part of the structure while also solving a problem he already had, which is the test worth applying to any governance work: if a control only serves the auditor, it will not survive the first budget cycle.

He named an accountable senior owner for AI and wrote a short AI policy stating the county's objectives and the boundaries it would not cross. That is Clause 5 leadership, and it is also the direct answer to the auditor's first question. He stood up an inventory of every AI system in use, built or bought, with an owner, a purpose and a risk categorization for each. That is the foundation of Clause 4 scoping and of the resource control under Annex A.4, and it is the artifact without which no other control can be applied consistently, because you cannot govern what you have not listed.

He rolled out one shared risk-and-impact assessment that every project, old and new, had to pass before or after deployment. That covers Clause 6 planning, Clause 8 operation and the Annex A.5 impact assessment controls in a single instrument, and it converted eleven different improvised risk memos into one comparable set of records. Finally, he set a review cadence: the AI inventory refreshed quarterly, the assessments revisited when a system changed materially, and a standing item on the governance board agenda. That is Clause 9 performance evaluation and Clause 10 improvement, which are the two clauses organizations most often defer and most often get graded on.

None of that required certification, a consultant or new headcount. It required deciding that AI governance was a standing function rather than a series of favours. Within a quarter the eleven binders had become one living system, and when the auditor returned the question of who is accountable and how you would know if something went wrong had a clean, documented answer. The certificate remains optional. The operating system was never optional; the county just had not built it yet.

Anti-Patterns

• Reading a certificate as proof the AI is safe. Certification attests that a management system conformed to the standard across a declared scope, on the basis of a sample the auditor selected at a point in time. It does not test every control everywhere, it does not evaluate any particular model's accuracy or fairness, and it cannot establish that a given decision was lawful. Treat it as evidence of a conforming process and keep your own evaluation obligations exactly where they were.
• Relying on a vendor's certificate instead of your own governance. A vendor's certificate covers the vendor's management system, not your implementation of their product, your data, your use case or your oversight. This is the most common substitution in AI procurement and the easiest to catch: ask what the certificate's scope statement actually says, and then ask which of your obligations it discharges. The answer is usually none of them.
• Paperwork-only implementation. Policies exist, are formatted well, and are not operationalized. Auditors identify this quickly and grade it as a major non-conformity, because the evidence trail stops at the document. If a control has no records showing it running, it is not implemented, regardless of how thoroughly it is described.
• Scope creep at the first certificate. Trying to bring every AI system in the organization into the initial certification scope turns a nine-month project into an indefinite one. Start with a defined scope you can genuinely evidence, certify that, and expand at surveillance audits. A narrow, honest certificate is worth more than a broad, aspirational programme that never completes.
• Risk-register theatre. Identifying risks without treatment, ownership or follow-through produces a document that looks like diligence and functions as a liability. Auditors require evidence of treatment and of effectiveness, which means dated actions, named owners and a record of whether the treatment worked.
• Supplier assessment by checkbox. A completed vendor questionnaire is not supplier governance. Without contract terms, evidence requirements, and a mechanism to verify what the vendor asserted, third-party controls exist only in the sense that a form was filled in. This is a recurring early-adopter non-conformity and a recurring cause of real incidents.
• Data provenance gaps. Inability to trace training data origin, permission and quality undermines Annex A.7, every impact assessment that depends on it, and any defence you would mount if a decision is challenged. Provenance cannot be reconstructed convincingly after the fact; it is either captured as data moves or it is not captured.
• Deploying without notification or an appeal route. Systems that affect individuals without clear notice, a reporting channel and a way to contest a decision fail the information-for-interested-parties controls and, more importantly, fail the people affected. Notification is not a communications afterthought; it is a control with an owner.
• Treating certification as a one-time project. Surveillance audits are annual and recertification comes every three years, and a system that reverts to ad hoc practice after the certificate arrives risks losing it. The improvement clause is not decorative. Budget for the operating cost, not just the implementation cost.
• Confusing this standard with the information security standard. Security controls are necessary and nowhere near sufficient. An organization can hold an impeccable ISO 27001 certificate while having no impact assessment practice, no data provenance, no human oversight design and no transparency to affected people. Those are the AI-specific gaps 42001 exists to close.
• Deploying and never observing. Systems that go live with no monitoring and no incident response are the failure mode behind most of the others, because without observation none of the remaining controls can be shown to be working. Monitoring is what converts a management system from a description into evidence.

Practice Prompts

1. Run the eight-theme gap analysis. Score your organization Absent, Ad hoc, Defined or Managed on each of the eight themes above, with a one-line justification and a named person who could confirm each score. Then order the Absent and Ad hoc items by how much other work they unblock, rather than by how easy they are.
2. Draft the scope statement. Write the scope you would declare if you certified next year: which AI systems, which organizational units, which locations. Then write what you deliberately excluded and why. Show it to someone who would have to defend it and see whether the exclusions survive.
3. Build a one-page Statement of Applicability. Take the nine Annex A control categories, decide for each whether it applies to your declared scope, and write one sentence on how it is implemented or why it is excluded. The gaps in that page are your implementation backlog.
4. Test a certificate. Obtain a real ISO 42001 certificate from a vendor or published source and check four things: the accreditation of the certification body, the exact scope statement, the issue date, and any conditions. Then write what the certificate does and does not tell you about the product your agency would be buying.
5. Map one existing artifact both ways. Take a document your agency already produces, such as a privacy impact assessment or an AI use case inventory entry, and identify which ISO 42001 clause or Annex A control it could evidence and which NIST framework function it already serves. Do this for five artifacts and you will have the beginning of a reuse map.

Reflection

If your auditor asked today who is accountable for AI in your organization, whose name would you say, and would that person agree? How many AI systems are in use right now, and how confident are you in that number? Which of the eight gap-analysis themes would score Absent if you were honest rather than diplomatic? Think about the last AI project your organization approved: was its governance inherited from a standing system, or improvised by the team? If a vendor handed you a certificate tomorrow, what would you actually check before treating it as assurance? And what would change in your work if AI governance were something you operated rather than something you assembled each time you were asked for it?

Glossary

• AI management system (AIMS). The organization-wide set of policies, roles, processes and controls for governing how AI is developed, procured and used, run as a single system rather than per project.
• ISO/IEC 42001:2023. The first certifiable international standard for an AI management system, published on 18 December 2023 through ISO/IEC JTC 1/SC 42.
• Annex SL. The common high-level structure shared by modern ISO management system standards, which is why 42001, 27001, 9001, 14001 and 22301 can be run as one integrated system.
• Plan-Do-Check-Act. The improvement loop the ten clauses implement: set policy and objectives, implement controls, evaluate whether they work, and improve.
• Annex A. The standard's set of 38 reference controls in nine categories, covering policies, internal organization, resources, impact assessment, life cycle, data, information for interested parties, use, and third-party relationships.
• Statement of Applicability. The document recording which Annex A controls apply to your declared scope, why, and how they are implemented. It is what makes proportionate scoping legitimate rather than convenient.
• Scope. The declared boundary of the management system: which AI systems, organizational units and locations are covered. A certificate means nothing until you have read the scope it was issued against.
• Certification body. The independent organization that audits and certifies a management system. Its own competence is established by an accreditation body.
• Accreditation body. The organization that accredits certification bodies, such as the ANSI National Accreditation Board. Verifying accreditation scope is part of evaluating a certificate.
• Stage-1 audit. The documentation review that checks whether the policy, Statement of Applicability, risk methodology, assessments, internal audits and management reviews exist and cohere.
• Stage-2 audit. The implementation audit: interviews, record review and spot checks of specific AI systems within the declared scope.
• Major non-conformity. A fundamental failure of the management system. It must be closed before certification is granted.
• Minor non-conformity. An isolated gap. It requires a corrective action plan rather than blocking certification.
• Surveillance audit. The annual check that the certified system is still operating, with full recertification every three years.
• AI impact assessment. The Annex A.5 assessment of an AI system's effects on individuals and society, distinct from a risk assessment focused on the organization.

Related Lessons

This lesson connects the international standards world to the federal one. International Standards: EU AI Act and OECD covers the regulatory regimes that make an AI management system commercially and diplomatically useful, and Contributing to Standards Bodies (NIST, ISO, IEEE, OECD) covers how the standards themselves get made. For the frameworks this crosswalks against, see NIST AI RMF: The GOVERN Function and NIST AI RMF: MAP, MEASURE, MANAGE, and for the federal policy the implementation must align with, OMB M-24-10 Deep Dive: Full Implementation and AI Use Case Inventory and Documentation (OMB M-24-10). The governance machinery the standard formalises is built in Establishing an AI Governance Board and Your Agency's AI Governance Structure, the impact assessment practice in Algorithmic Impact Assessments, the supplier controls in Third-Party AI Risk Management, and the audit posture in AI Audit Preparation and GAO AI Accountability: Four Principles in Practice.

Closing

Public agencies are adopting AI faster than they are governing it, and project-by-project oversight quietly accumulates into the binder problem: real risk, no system, and no clean answer when an overseer asks who is accountable. ISO 42001 offers a way out that fits how government actually operates. It is auditable, it complements rather than displaces the federal frameworks, and it scales from a handful of projects to hundreds through deliberate scoping. It does not replace the NIST AI Risk Management Framework or OMB guidance. It gives you the management spine to execute them consistently and to prove that you did.

Keep two things in proportion as you go. Implementation, not certification, is where the value sits; an agency that runs the gap analysis, stands up an inventory, names an owner and enforces one shared impact assessment has captured most of the benefit before any auditor arrives. And a certificate, whether yours or a vendor's, describes a process rather than an outcome. Devon's eleven improvisations became one operating system he could actually run. That was the point. The certificate, if it ever comes, is only the receipt.

Key Takeaways

• It is a system, not a checklist. ISO/IEC 42001:2023 is the first certifiable international standard for an AI management system, governing all your AI consistently rather than project by project.
• Ten clauses, 38 controls, nine categories. The clauses follow Plan-Do-Check-Act on the Annex SL structure shared with ISO 27001 and ISO 9001; Annex A supplies the reference controls, scoped through a Statement of Applicability.
• It answers "who is accountable?" The standard centres on a named senior owner, a written policy and documented evidence, which is exactly what auditors and overseers ask for.
• Certification is evidence of process, not proof of safety. An auditor samples controls across a declared scope at a point in time. It does not establish that any particular AI system is accurate, fair or lawful.
• A vendor's certificate is not your governance. It covers their management system, not your use of their product, your data or your oversight obligations.
• It complements the federal frameworks. The NIST framework is voluntary and non-certifiable and tells you what good looks like; 42001 gives you the structure to run it repeatably, and NIST published a crosswalk in 2024 so the evidence can serve both.
• Voluntary, but increasingly a procurement signal. Neither OMB M-24-10 nor any current statute mandates it, yet agencies are using certification as an evaluation factor, particularly for rights-impacting and safety-impacting systems.
• Start with an inventory and an owner. You cannot manage AI you cannot list or assign, so the AI inventory and the accountable owner come first.
• Use a gap analysis as a roadmap. Score each theme from Absent to Managed and fix the weakest areas first, proportionate to risk.
• Budget for the operating cost. Preparation for a mid-size organization already holding ISO 27001 runs months rather than weeks, surveillance audits are annual, recertification is every three years, and internal labour is excluded from most quoted figures.

Frequently Asked Questions

Do we need to certify, or is implementing enough? For most public agencies, implementing is enough and certification is optional. The value of the standard is the operating system it gives you: an inventory, a named owner, one impact assessment every project passes, defined lifecycle controls and a review cycle. That value arrives during implementation. Certification adds independent third-party assurance, which matters when you need to signal governance maturity externally, to Congress, to the public or to a partner government. Decide what the certificate is for before you budget for it, because the answer determines the scope you should declare.

How does this relate to the NIST AI Risk Management Framework? Do we have to choose? No, and choosing would be a mistake. The NIST framework is voluntary, non-binding guidance describing what good AI risk practice looks like across GOVERN, MAP, MEASURE and MANAGE. ISO 42001 is a certifiable management system standard describing how to run that practice consistently and prove it. NIST published a crosswalk between the two in 2024 precisely so that organizations could implement both without duplicating effort, which means your framework artifacts can serve as certification evidence and vice versa. Most agencies will already be doing framework work; the standard organises it.

A vendor has shown us their ISO 42001 certificate. What does that actually tell us? It tells you that a certification body assessed the vendor's own management system against the standard, within a scope the vendor declared, and found it conforming on the evidence sampled at that time. Check the accreditation of the certification body, read the scope statement to see which products or units it covers, note the issue date, and look for attached conditions. What it does not tell you is whether the specific product you are buying is accurate, fair or suitable, or whether your deployment of it will be governed. Those remain your obligations, and your own management system still has to cover them.

We already hold ISO 27001. How much extra work is this? Less than a greenfield implementation, because the governance, risk assessment and internal audit infrastructure already exists and the clause structure is identical. The genuinely new work is the AI-specific material: impact assessments on individuals and society, data provenance and quality for AI, life cycle controls covering model development and monitoring, transparency and notification to affected people, and AI-specific supplier terms. The source guidance puts the incremental effort for a mid-size organization in that position at roughly 6 to 12 months of preparation and $50,000 to $250,000 in audit and consulting fees, excluding internal labour.

We have eleven projects and two people. Is this realistic for a small agency? Yes, if you scope it honestly. The standard is designed to be applied proportionately, and the Statement of Applicability is the mechanism for that: you record which controls apply to your declared scope and why. A small agency can get most of the benefit from four moves, none of which require a consultant: maintain a current AI inventory, name an accountable owner with a written policy, run one shared risk-and-impact assessment that every project must pass, and review the whole thing on a fixed schedule. Certification can wait, possibly indefinitely.

Should we require ISO 42001 certification from AI vendors in solicitations? It is defensible as an evaluation factor, particularly for rights-impacting and safety-impacting systems, and several agencies are doing exactly that. Two cautions. First, requiring it as a mandatory qualification can narrow your competitive field, so weigh what you gain against who you exclude. Second, be explicit in the solicitation about what you want the certificate to evidence, and pair it with the evaluation evidence you actually need about the product itself. Where you are asking for certification-based assurance, prefer the accredited international scheme over private schemes, which lack equivalent accreditation infrastructure.