ISO/IEC 42001 AI Management

ISO/IEC 42001 specifies requirements for an Artificial Intelligence Management System (AIMS). It is for organizations that provide or use AI systems and want a certifiable way to govern risk, impact, and lifecycle control. It is not a guarantee that a model is accurate, fair, or lawful in every jurisdiction. It is not a substitute for ISO/IEC 27001 or for product-safety regulation.

This directory treats 42001 as the third stage of a practical path: quality → security → AI governance. Most mid-market manufacturers and professional-services firms should not start here. They should start with process control (9001) and information-risk discipline (27001), then extend the same management-system muscles to AI.

Accreditation is still maturing

Unlike ISO 9001, the set of CBs with accredited 42001 scope is smaller and changing. Public announcements through 2024–2026 include bodies such as Schellman (first ANAB AIMS accreditation), SGS, BSI (including a widely reported ANAB + UKAS + RvA combination), LRQA (UKAS), DNV (RvA), Intertek SAI Global (JAS-ANZ), and DEKRA. Those are starting points for research, not a permanent league table.

Verify the live schedule on the accreditation body and IAF CertSearch before you treat any CB as 42001-capable. The method is the same as verifying registrar accreditation, with extra caution that AIMS scopes are still moving.

What to ask a registrar

• Which accreditation body and legal entity will mark the AIMS certificate.
• How they staff AI competence (not only ISMS auditors with a new checklist).
• Whether they will integrate 27001 and 42001 evidence.
• How they treat third-party models, copilots, and shop-floor AI versus in-house development.

Filter the directory and read the 9001 → 27001 → 42001 path guide. If the room is choosing ISO 9001 or ISO/IEC 42001 for this RFQ, use the ISO 9001 vs ISO 42001 comparison. If the other side of the argument is information security, use ISO 27001 vs ISO 42001.

If you need help getting the organization ready — ownership, decision rights, and a 90-day operating cadence — before you pay for a Stage 1, ChiefAIOfficer.com publishes a mid-market governance model. That is readiness work. It is not certification, and this site does not sell it on every page.