Is ISO 42001 certification required by law?

No. Certification is voluntary unless a contract requires it. Check your legal AI duties separately.

Does ISO 42001 replace the EU AI Act?

No. The EU AI Act is the law. ISO 42001 can support how you manage AI, but it does not replace the legal duties.

Can it cover AI tools we buy from suppliers?

Yes. Your own use of bought tools can be included. You need to check suppliers, agree their duties, monitor results and review changes.

Who issues an ISO 42001 certificate?

An independent certification body issues it after its audit. Guardera builds the management system with your team and gets you ready.

Can a person be ISO 42001 certified?

Not in the same way. Courses such as Lead Auditor or Lead Implementer show what a person knows. The ISO 42001 certificate covers an organisation’s AI management system.

International AI standard

ISO 42001: a management system for responsible AI

ISO 42001 is the international standard for AI management systems. An AI management system is how you set responsibilities, rules and checks for the AI you build or use. Certification is voluntary and comes from an independent certification body.

Plan ISO 42001 preparation See how we prepare AI rules

Type: International AI management standard
Current version: ISO/IEC 42001:2023, published December 2023
Organisation size: Any size
Certification: Available for an AI management system

Who it applies to

Teams seeking consistent AI decisions

Organisations building AI products or providing AI services.
Companies buying AI tools and using them in business processes.
Teams seeking certification to show customers how AI responsibilities and checks work.

You decide which AI services and parts of your company the management system covers.

What it asks of you

Set rules for all your AI work

Set AI goals and ownership
Define what AI should achieve, which services to include and who approves decisions.
Assess risks and human impact
Review how AI could affect people and your business, then decide how to address those risks.
Check tools throughout their use
Set rules for choosing data, building or buying tools, monitoring results and retiring systems.
Manage suppliers and staff skills
Record supplier responsibilities and plan training for the people who choose, use and check AI tools.
Review performance and make corrections
Carry out internal audits and management reviews to assess how the management system works, then address the findings.

How we help

Build your company’s AI management routines

We prepare AI policies, assign decision owners and set up risk reviews. We help your team keep a record of AI decisions and prepare for independent certification if required.

AI GovernancePut AI governance into practice: clear responsibilities, controlled use and support with applicable EU AI Act requirements. Cybersecurity Audit & Risk AssessmentAn independent assessment of security and compliance, with risk-based findings and practical recommendations. Secure AI & AutomationWe build AI agents and automate workflows with appropriate safeguards, or assess and improve the security of AI already in use.

Common questions

Related regulations and standards

EU AI Act
The EU law that sets stricter rules for AI uses that could cause more harm to people. ISO 42001 can organise much of the work, but the law decides your duties, so they need their own check.
ISO 27001
The international standard for managing information security. Companies that hold it can build their AI management system on the same routines, such as risk reviews, internal audits and management reviews.

Free 30-minute call

Define your ISO 42001 starting point

Use a free 30-minute call with a senior specialist to discuss your AI tools, responsibilities and reasons for seeking certification.

Plan ISO 42001 preparation hello@guardera.tech