ISO/IEC 42001 as a management system, not a control list

ISO/IEC 42001:2023 is an AI management system standard. The words "management system" carry the whole meaning and most of the cost, and they are the part that gets skipped in favour of the annex of controls that circulates in slide decks.

A note on method before anything else. This course does not reproduce ISO clause text, control titles or annex headings. The standards are paywalled, we have not read them, and the paraphrases circulating online disagree with one another. What follows is about how a management system standard works and what adopting one costs, which can be described accurately without quoting text we have not seen.

What a management system standard requires of an organisation

The pattern is familiar to anyone who has run an information security or quality management system. You define a scope. You establish a policy and objectives. You assign responsibilities. You operate a documented set of processes. You measure whether they work. You audit yourself. Management reviews the results. You correct what is not working, and you record all of it.

The obligation created is a continuing one. A management system is not a state you reach; it is a loop you run, and the evidence that it is running is the artefact. Firms that treat certification as a project with an end date discover this at the first surveillance audit, when the auditor asks not whether the controls exist but what the last twelve months of operating them produced.

The Statement of Applicability

The central document of a management system certification is the Statement of Applicability: for each control in the standard's control set, whether you have included or excluded it, and why. Inclusions carry an implementation status and the evidence supporting it. Exclusions carry a justification.

That document is where a certification either becomes meaningful or becomes decorative. A Statement of Applicability with a broad scope, few exclusions and specific evidence per control tells a reader something. One with a scope drawn around a single product line, and exclusions covering everything inconvenient, tells a reader something different, which is why the scope statement is the first thing to read on any certificate presented to you by a vendor.

Worth knowing as a buyer: of seventeen AI governance platforms examined in our own vendor research, none was found to produce a Statement of Applicability, despite it being the central document of the management system they are sold as supporting. If you are buying a platform to carry a 42001 programme, ask to see one generated before you sign.

How it relates to the AI Act

There is a genuine overlap and it is worth being precise about its limits. The Act's Article 17 requires providers of high-risk systems to operate a quality management system documented as written policies, procedures and instructions, covering the compliance strategy, design control, development and quality assurance, examination and testing, data management, post-market monitoring, incident reporting, record-keeping, resource management and an accountability framework, proportionate to the size of the organisation. A firm running a mature AI management system has built much of the machinery that provision describes.

What it has not done is discharge the Act. 42001 certification is not conformity assessment, does not produce a declaration of conformity, does not classify your systems against Annex III, and does not create the Article 11 technical documentation. It is evidence of a capability, offered voluntarily, that makes the statutory work cheaper and more credible. It is not a substitute for it, and any vendor or consultant presenting it as one is selling you a misunderstanding.

Worked example: scoping a certification honestly

A reinsurer decides to certify. The first proposal from the project team is a scope covering the AI Centre of Excellence: the eight models the central data science team built and runs. It is achievable within the budget and the timeline.

The risk committee asks one question: what does the certificate then say to a client who asks whether the reinsurer governs its AI? It says that eight central models are governed. It says nothing about the thirty-one AI features in purchased software across underwriting, claims and finance, which is where most of the firm's actual AI exposure sits and where the last two incidents came from.

The committee widens the scope to all AI systems in the register regardless of origin, accepts a longer timeline, and requires the Statement of Applicability to be reviewed by internal audit before the certification body sees it. That decision costs a year.

It also means that when a client's due diligence questionnaire asks what the certificate covers, the answer is a sentence rather than a negotiation. A narrow certificate is not dishonest, but it transfers the interpretive work to whoever reads it, and in a regulated market that work usually gets done by someone less favourable to you than you would be.

As of 24 September 2026.