ISO 42001 for AI-first teams,explained without the jargon.

What ISO 42001 certifies

Like ISO 27001, ISO 42001 certifies a management system rather than a product. Certification bodies look for defined AI scope, leadership accountability, an AI risk methodology, documented controls over the model lifecycle, internal audit and management review. The difference is what sits inside scope: models, training data, prompts, third-party AI services and the humans who oversee them.

• AI policy and named accountability for AI decisions
• Inventory of every AI system, model and AI vendor in use
• AI risk assessment plus an AI system impact assessment
• Human oversight defined for each use case

Annex A controls in plain language

The Annex A controls group into objectives covering policy, internal organisation, resources, impact assessment, lifecycle, data, information for interested parties, use of AI systems and third-party relationships.

• Data: provenance, quality, labelling and retention for training data
• Lifecycle: documented design, testing, release and retirement of models
• Transparency: what users are told about AI involvement and limitations
• Third parties: due diligence on foundation-model and AI tooling vendors
• Monitoring: drift, incidents, evaluation results and corrective action

How it relates to ISO 27001, SOC 2 and the EU AI Act

ISO 42001 assumes a working security baseline, so teams already holding ISO 27001 or SOC 2 reuse a large share of governance, access, change and supplier controls. It is also the most practical way to demonstrate diligence for EU AI Act obligations, which regulators expect but do not certify.

Where AI startups usually fail

Findings cluster in documentation nobody owns rather than in the models themselves.

• No complete inventory of AI systems, including shadow AI tools
• Impact assessments written once and never revisited
• No evidence of human review for high-impact outputs
• Training-data sources and licences undocumented
• Model evaluations run but never retained as evidence