ISO 42001 Certification:Prove Your AI IsActually Governed

No, and treat any claim that it does as a reason to check what else is being overstated. ISO 42001 is a voluntary management system standard; the EU AI Act is law with its own obligations and timelines. What certification gives you is the processes the Act expects to find — risk management, technical documentation, human oversight, post-market monitoring and data governance — running on a cycle that produces evidence repeatedly rather than per request.

38 Annex A controls, grouped under nine control objectives running from A.2 to A.10: policies related to AI, internal organization, resources for AI systems, assessing impacts of AI systems, AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships. As in ISO 27001, you select from them and record the selection and any exclusions in the Statement of Applicability.

Two things, consistently. The impact assessment under A.5 has the least precedent in an existing ISMS — it asks about effects on individuals, groups and society rather than on the business, which is a genuinely different exercise. And the data controls under A.7 require provenance for development and enhancement data, which is the one thing most teams cannot reconstruct after the fact. Both are worth starting before the rest of the programme.

No. Certification says a management system exists, is scoped, and was audited against the standard — that impact assessments are performed, data provenance is recorded, oversight paths exist and the system is audited on a cycle. It makes no claim about the accuracy, fairness or safety of any particular model. Conflating the two is the fastest way to lose a technical buyer, and the scope statement on the certificate is what sophisticated buyers read first.

Certification runs on the same rhythm as ISO 27001: a stage 1 documentation and readiness review, a stage 2 operational effectiveness audit, annual surveillance audits, and recertification on a three-year cycle. Implementation time depends almost entirely on how many AI systems are in scope and whether data provenance was recorded as the systems were built — the data and life-cycle work in Annex A objectives A.6 and A.7 is normally the long pole, not the policy work.

Organisations that build AI into a product their customers buy, and organisations whose customers have begun sending a separate AI governance questionnaire alongside the security one. The role matters: the standard distinguishes providers, producers and users of AI systems, and the duties differ. A company embedding a third-party model has real obligations under A.10 for third-party and customer relationships even though it trains nothing itself.