ISO/IEC 42001 the certifiable one

An AI management system is not a document - it is a running system with named parts. ISO/IEC 42001 asks you to put these in place:

• An AI policy and objectives - a signed statement of how the organisation intends to develop and use AI, and what it is trying to achieve.
• Roles and responsibilities - who owns AI governance, who owns each system, who reviews and signs off.
• An AI risk assessment - the standard risk lens: what could go wrong, how likely, how bad.
• An AI system impact assessment - a distinct step that looks at effects on individuals, groups, and society, not just on the business.
• Controls from Annex A - a reference set of controls you select from and justify.
• Continual improvement - the Check and Act half of the loop: audits, monitoring, management review, corrective action.

• AI risk assessment asks "what could hurt us, and how do we treat it?" - the familiar likelihood-times-consequence view aimed at the organisation and its objectives.
• AI system impact assessment asks "who does this system affect, and how?" - the effects on individuals, groups, and society. This is the step teams from a pure security background tend to skip.
• Why both: a system can be low-risk to the business and high-impact on the people it touches. A hiring tool is a clean example - reliable for the company, life-shaping for the candidate.

ISO/IEC 42001 borrows ISO 27001's Harmonized Structure on purpose. If your organisation already holds ISO 27001, the plumbing is shared: the same clause layout, the same "Statement of Applicability" idea for controls, the same audit rhythm, often the same internal team. You are not learning a new discipline - you are pointing an existing one at AI. That reuse is one of the strongest practical arguments for choosing 42001 over standing up a bespoke governance programme from scratch.

• Independently auditable. Certification runs as a two-stage audit by an accredited body - stage 1 reviews your documentation, stage 2 tests whether the system actually runs the way the documents say.
• Certifiable. Pass, and you hold a certificate a third party trusts. This is the practical line between ISO/IEC 42001 and a voluntary framework: NIST gives you a method, 42001 gives you proof.
• Evidence, not assertion. When a customer or regulator asks "show me your AI is governed", a certificate answers in a way a slide deck cannot.

Annex A gives you a reference set of controls to select from and justify - grouped under a handful of control objectives spanning policy, resources, the AI lifecycle, data, information for interested parties, and use of AI systems.

You do not implement every control blindly. As in ISO 27001, you decide which apply to your context, justify inclusions and exclusions, and record that reasoning - the "why we chose these" is part of the evidence.

ISO/IEC 42001 is not the EU AI Act and does not replace it. The Act is mandatory law; 42001 is a voluntary management-system standard. But a strong AIMS is a natural way to produce and organise the evidence the Act expects - risk work, documentation, roles, monitoring. The pattern to remember for b8: build to the legal floor, and use a standard like 42001 to make your compliance auditable and repeatable rather than heroic and one-off.