A management system, not a one-off review
ISO/IEC 42001 is the first international standard for an AI Management System. The distinction that matters is between a management system and a one-off checklist: a checklist gets completed once, a management system runs continuously, with a Plan-Do-Check-Act cycle, ownership, documented information and internal audit built in.
Context and leadership come before controls
Clause 4 asks an organisation to understand its own context: internal and external issues, interested parties including affected people, regulators and suppliers, and the actual scope of the AI Management System. Clauses 5 and 6 ask for leadership commitment, a real AI policy, clear roles and authorities, and risk-based planning, including AI risk assessment and AI impact assessment.
Operation, evaluation and improvement
Clause 7 covers the resources, competence and awareness needed to run the system. Clause 8 covers operational controls across the AI lifecycle, including supplier controls and change control when a model is updated. Clause 9 covers monitoring, internal audit and management review. Clause 10 covers corrective action and continual improvement when something does not work.
Annex A gives the control themes
Annex A groups controls under themes including AI policies, resources for AI systems, AI impact assessments, the AI system lifecycle, data for AI systems, and third-party and customer relationships. Selecting and evidencing the relevant controls, rather than adopting all of them regardless of fit, is part of the standard's own logic.
Certification is optional, the discipline is not
An organisation does not need to pursue formal ISO/IEC 42001 certification to benefit from the structure it describes. The discipline of documented scope, real ownership and continual improvement is useful on its own, well before any certification conversation starts.
ISO/IEC 42001 is covered clause by clause, alongside ISO/IEC 22989 and ISO/IEC 42005, in the AI Governance, Risk & Compliance Practitioner programme.