Providers and developers of AI
Builders of models or AI products who want a certifiable governance system customers can rely on. Annex A covers lifecycle, data and third parties.
WHO IT APPLIES TO
Who adopts ISO/IEC 42001
Nobody has to adopt it. These are the organisations already being asked the question it answers.
Deployers with a portfolio
Companies using several AI systems across functions, where the inventory, impact-assessment method and review cycle need an owner.
Organisations already on ISO 27001
Both share the Annex SL clause structure, so your ISMS already answers context, leadership, support and evaluation. One management system, two scopes.
KEY DATES · STATUS
The dates that matter
Voluntary. The certificate comes from an accredited certification body, never from Veritome (ISO/IEC 17021-1 §5.2.5 keeps the consultant and the certifier apart).
| Date | Event | What it means |
|---|---|---|
| 18.12.2023 | Published | First edition, and the first certifiable AI management system standard. |
| 01.08.2024 | EU AI Act in force | Regulation (EU) 2024/1689 entered into force. CEN-CENELEC drafts its harmonised standards separately. |
| 02.12.2027 | EU AI Act Annex III | Most Annex III high-risk duties apply. An AI management system organises the work; it gives no presumption of conformity today. |
WHAT IT ASKS
65 requirements, in the shape the framework gives them
The Annex SL clauses of every modern ISO management system, plus an AI risk assessment, an AI system impact assessment and Annex A controls. Veritome paraphrases each; the licensed text is never reproduced.
27
clause requirements (clauses 4 to 10)
38
Annex A controls
- Clause 4Context of the organisation4
- Clause 5Leadership3
- Clause 6Planning6
- Clause 7Support5
- Clause 8Operation4
- Clause 9Performance evaluation3
- Clause 10Improvement2
- A.2Policies for AI3
- A.3Internal organisation2
- A.4Resources for AI systems5
- A.5Impacts of AI systems4
- A.6AI system life cycle9
- A.7Data for AI systems5
- A.8Information for interested parties4
- A.9Use of AI systems3
- A.10Third parties and customers3
HOW VERITOME RUNS IT
27 steps, 6 phases, one record each
6 phases, each opening when the one before is complete: the gate rule the EU AI Act journey uses.
- 14 of the 27 steps are one record shared with ISO/IEC 27001, written once and credited in both.
- The Statement of Applicability is a view over the programme, not a second form. Exclusions need a written justification.
- The certification phase is optional and records the arrangements with your certification body.
WHERE IT OVERLAPS
Credited in both, or only related
The 14 shared records are the only evidence two frameworks credit in Veritome, checked against both standards in the owner-verified matrix. Every other link is related: shown, never counted.
ISO 42001Establish4.1
Context of the organisationDone
Also counts toward ISO 27001Credited by work already on file
Across the programme
14 credited · 18 related
34 related
23 related
16 related
Write it once, credited where it counts
Illustrative progress · the steps and counts are the product’s
ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF cross-mapping lands with the full launch, planned for late November 2026.
13 of the 27 steps carry a related link to an EU AI Act article. A related link was not checked against source text by the owner's verified matrix, so it is shown and never counted. Credit shows in three places only:
- “Also counts toward” on a record
- “Credited by work already on file” on a step that is Done
- one figure on each programme card
See all three on the frameworks page, and the EU AI Act article by article at /eu-ai-act.
| With | Records credited in both | Related only: shown, never credited | Page |
|---|---|---|---|
| EU AI Act | 0 | 34 | EU AI Act → |
| GDPR | 0 | 16 | GDPR → |
| ISO 27001 | 14 | 18 | ISO 27001 → |
| NIST AI RMF | 0 | 23 | NIST AI RMF → |
QUESTIONS PEOPLE ASK
ISO/IEC 42001, answered plainly
The same answers, word for word, that the page marks up for search engines and AI assistants.
What is ISO/IEC 42001?
The first international standard for an AI management system, published by ISO and IEC in December 2023. It specifies how an organisation establishes, runs and improves the governance of the AI it develops or uses (policy, roles, risk and impact assessment, lifecycle controls, review). An accredited body can certify it.
Is ISO/IEC 42001 mandatory under the EU AI Act?
No. It is voluntary, and it is not a harmonised standard under the Act. The first harmonised standard, EN 18286, was cited in the Official Journal on 14.10.2026 and covers the Article 17 quality management system; ISO/IEC 42001 carries no presumption of conformity. It organises the management-system half of the work, and does not discharge an Art. 9 or Art. 17 obligation on its own.
How many controls does ISO/IEC 42001 have?
38 Annex A controls, alongside 27 clause requirements in clauses 4 to 10, making 65 requirements in Veritome's catalogue. The Statement of Applicability includes or excludes each control, with a justification.
Can ISO/IEC 42001 and ISO/IEC 27001 share one management system?
Yes. Both follow the Annex SL clause structure, so the context, leadership, support and evaluation clauses are answered once. Veritome shares 14 records between the two programmes: one record, credit in both.
What is the Statement of Applicability?
The document that lists every Annex A control, says whether it is included, and why any is excluded. In Veritome it is a view over the programme: the SoA steps open pre-filled from records already written, and an exclusion needs a justification before it saves.
Does Veritome certify ISO/IEC 42001?
No. An accredited certification body certifies after its own audit, and ISO/IEC 17021-1 keeps the party that helped build the system apart from the one that certifies it. Veritome runs the programme and produces the records; the certification phase records the arrangements with the body you choose.
The other four