ISO/IEC 42001, published in December 2023, is the first international standard for an AI management system. Like ISO 27001 for information security, it can be independently certified. Procurement teams are increasingly asking suppliers whether they hold it.
What it requires
An organisation must set an AI policy, define roles, assess AI risks and the impact of its systems, set objectives, and run a cycle of monitoring, internal audit and management review. An annex lists controls covering areas such as data, system lifecycle, information for users, and use of third parties.
What a certificate proves
That an accredited body has checked that the management system exists, covers the stated scope and is being operated. That is useful evidence of maturity, and it gives a common language with customers and auditors.
What it does not prove
It does not show that a given AI system is accurate, fair or lawful. It does not by itself demonstrate compliance with the EU AI Act. The Act relies on separate harmonised European standards, which were still being finalised at the time of writing. Check the scope of any certificate: it may cover one product or one site, not the whole company.
A certificate is evidence of a process. Regulators and courts will still ask about the system in front of them.
Is it worth it?
For a supplier selling AI to large or regulated customers, increasingly yes: it shortens due diligence. For an organisation that only uses a few AI tools, the standard is better used as a framework than pursued as a certificate. Either way, start with an inventory and a risk assessment, because certification will require both.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.