Customers and procurement
Enterprise buyers and public sector tenders now ask how suppliers govern AI. A credible route to ISO/IEC 42001 is a clear, recognisable answer.
ISO 42001 readiness
ISO 42001 Certification Readiness: Is Your Organisation Ready for an AI Management System?
Customers, regulators and investors increasingly want evidence that AI is governed, not just a policy. ISO/IEC 42001 sets out what that evidence looks like. Most organisations do not yet know how far they are from it, or what closing the gap would take.
Correct as of 27 September 2026. Regulation and guidance change. If you are reading this later, check for updates before relying on it.
The AI governance path: step 5 of 5
Start here if: Clients, tenders or insurers are asking for independent proof.
See the whole path →What is ISO 42001?
The international standard for managing AI responsibly
ISO/IEC 42001:2023 is the international standard for an AI management system: the policies, roles, risk processes, controls and records an organisation uses to govern how it builds, buys and uses AI. It follows the same management system structure as ISO 27001 for information security and ISO 9001 for quality, so it fits alongside systems many organisations already run.
It applies to any organisation that develops, provides or uses AI, in any sector and of any size. Organisations can be certified against it by an independent certification body. A readiness assessment comes before that: it tells you how close you are, what is missing and what to do first.
ISO/IEC 42001 sits well with the NIST AI Risk Management Framework (NIST AI RMF) and supports, but does not replace, obligations under laws such as the EU AI Act.
Why the board should care
AI governance is becoming something you have to prove
Board accountability
Directors are expected to oversee material risk. AI now sits in hiring, pricing, credit, customer service and operations, often inside vendor software nobody has reviewed.
Regulation and assurance
An AI management system gives you one structure for the EU AI Act, sector regulators, auditors and insurers, instead of answering each one from scratch.
Who this is for
- Boards, audit and risk committees that want an independent view of AI governance
- Organisations whose customers or tenders ask for evidence of responsible AI
- Companies that already hold ISO 27001 or ISO 9001 and want to extend their management system to AI
- Businesses that build AI into products or services, or rely on AI from third parties
- Leadership teams deciding whether, and when, to pursue ISO/IEC 42001 certification
What it solves
- No clear picture of how far current AI governance is from the standard
- Policies written but not evidenced in how AI is actually selected, built and monitored
- No reliable inventory of AI systems, including AI inside vendor platforms
- Uncertainty about the cost, effort and timeline of certification
- Risk that a certification audit is booked before the organisation is ready
What an AI management system includes
The building blocks of ISO/IEC 42001
An AI management system is not a single document. It is a working set of decisions, processes and evidence that together show AI is under control.
Scope and leadership
A defined scope, an AI policy approved at the top, and named roles with the authority to act.
AI risk and impact assessment
A repeatable way to identify AI risks, assess the impact of AI systems on people and the organisation, and decide how each risk is treated.
Controls and applicability
A set of controls chosen for your AI systems, with a clear record of which apply and why.
AI system lifecycle
Governance from design or purchase through testing, deployment, monitoring and retirement, with an up-to-date inventory.
Data and third parties
Oversight of data quality and provenance, intended use, and the suppliers and partners whose AI you rely on.
Performance and improvement
Measures, internal audit, management review and corrective action, so the system gets better rather than going stale.
Common readiness gaps
Where organisations usually fall short
- No complete inventory of AI systems, particularly AI embedded in HR, finance and customer platforms
- An AI policy exists, but nobody owns it and it is not reflected in day-to-day decisions
- AI risk assessed once, at launch, rather than through a repeatable process with clear risk owners
- No AI system impact assessment covering effects on customers, employees and the public
- Supplier contracts that say nothing about how third-party AI is built, tested or changed
- Monitoring, logging and incident handling for AI that are informal or missing
- Documents that describe intent but little evidence that controls operate in practice
- No internal audit or management review of AI, so the board cannot see whether governance is working
What AIPEX assesses
Six domains, scored against the standard
The assessment covers the full scope of ISO/IEC 42001 in six domains and places each on a six-level maturity scale, from Absent to Leading. We look for evidence, not just intent.
Context and leadership
Your role in relation to AI, the scope of the management system, board oversight, AI policy and accountable roles.
Planning and AI risk
AI risk assessment and treatment, control applicability, AI system impact assessment, objectives and the regulatory horizon.
Support
Resources, competence and AI literacy, awareness and concern reporting, communication and documented information.
AI system lifecycle
Inventory, responsible design, verification and validation, deployment, monitoring and technical documentation.
Data, use and third parties
Data quality and provenance, intended use, supplier and third-party AI, and communication with customers when things go wrong.
Performance and audit readiness
Measures, internal audit, management review, corrective action and readiness for an external certification audit.
What you get
A clear verdict on your readiness and a plan to close the gaps
- An overall ISO 42001 Readiness Score, with a maturity rating for each of the six domains
- An audit readiness verdict: not ready, ready for gap closure, or ready to plan a certification audit
- The specific gaps that would stop a first-stage certification audit, and the risks to watch at the second stage
- An Evidence Confidence rating, showing how far the findings rest on documented evidence rather than opinion
- A prioritised gap closure roadmap with owners, effort and sequencing
- A short board paper, and a view of how ISO/IEC 42001 lines up with the EU AI Act and the NIST AI RMF for your organisation
How it works
-
Scope
Agree the organisation, AI systems and sites in scope, and your role as a developer, provider or user of AI.
-
Assess
Structured interviews with leadership, risk, technology and data owners, plus a review of existing policies, registers and evidence.
-
Score
Each domain rated against the standard, with gaps ranked by audit risk and commercial impact.
-
Report
Findings presented to the board or committee, with a readiness verdict and a roadmap it can govern against.
Not ready for a full review yet? Take the free AIPEX Score check for a quick view of your wider AI readiness, then book an ISO 42001 readiness review when you are.
Free board download
ISO 42001 vs ISO 27001: Which ISO Standard Does Your AI Need? Board Selector
A 10-minute board selector: 15 yes or no questions that show which ISO standards fit your AI, from ISO/IEC 42001 and 27001 to 27701, 42005, 23894 and 38507, and whether to certify or align.
- 15 questions on who asks for evidence, what you do with AI, your data and what you already hold
- A result for each standard: Certify, Align or Not needed now
- Your route: one standard, or which combination and in what order
FAQ
Frequently asked questions
What is an AI management system (AIMS)?
An AI management system, or AIMS, is the set of policies, roles, processes and controls an organisation uses to govern how it develops, provides or uses AI responsibly. ISO/IEC 42001 is the international standard for an AIMS: it sets out what the system must cover, from AI risk and impact assessment to monitoring and continual improvement, and it is the standard organisations are certified against.
What is an ISO 42001 readiness assessment?
An independent review of how close your organisation is to operating an AI management system aligned with ISO/IEC 42001:2023. It scores your governance across six domains, identifies the gaps that would matter at a certification audit, and gives you a prioritised plan to close them.
Does AIPEX certify organisations to ISO 42001?
No. Certification is carried out by an independent certification body. AIPEX assesses readiness before that audit, so you know where you stand, what to fix and when it makes sense to book one.
Do we need ISO 42001 if we only use AI rather than build it?
The standard applies to organisations that use AI as well as those that develop it. Many of the biggest risks sit in AI bought from vendors, so the controls on suppliers, intended use and monitoring still apply.
How does ISO 42001 relate to the EU AI Act?
They are different things. The EU AI Act is law. ISO/IEC 42001 is a voluntary standard for managing AI. A well-run AI management system gives you much of the structure, evidence and oversight the Act expects, but it does not on its own make you compliant.
We already have ISO 27001. How much extra work is ISO 42001?
Less than starting from scratch. Both follow the same management system structure, so leadership, document control, internal audit and management review can be extended. The new work is in AI risk and impact assessment, the AI system lifecycle, data and third-party AI.
What should come before ISO 42001?
Most organisations need the basics first. AI Governance Foundations puts in place the AI register, risk assessment, AI use policy and training, and EU AI Act Implementation builds on it to the December 2027 deadline. Both sit before ISO/IEC 42001 and carry straight into it. See the AI governance path.
How long does ISO 42001 readiness take?
The assessment itself takes a few weeks, depending on scope. How long it then takes to become ready for a certification audit depends on the gaps it finds. The roadmap sets that out, with owners and sequencing.
Next step
Book an ISO 42001 Readiness Review
Tell us how you use AI and where you are with governance today. We will reply personally with how the readiness assessment would work for your organisation.
Correct as of 27 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 27 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.
AIPEX assesses readiness for ISO/IEC 42001:2023. AIPEX is not a certification body and does not certify organisations; certification is carried out by an independent certification body. This page summarises the standard in our own words and is not legal advice.