ISO 42001 · Basic · 12 min lesson
AIMS foundations - what ISO/IEC 42001 is, context, leadership and the AI policy
ISO/IEC 42001:2023 - clauses 4 and 5
What you will learn
- Explain what ISO/IEC 42001:2023 is, that it is voluntary and certifiable, how its structure matches ISO 9001 and ISO/IEC 27001, and why it does not give a presumption of EU AI Act conformity.
- Describe how clauses 4.1 to 4.4 set context, interested parties, scope and the AI management system for a medical-device software maker.
- State what top management, the AI policy and defined roles must show under clauses 5.1 to 5.3, and spot a weak policy or scope.
Key takeaways
- ISO/IEC 42001:2023 is the first international standard for an AI management system, voluntary and certifiable by an accredited body.
- It uses the same harmonised clause 4 to 10 structure as ISO 9001 and ISO/IEC 27001, so it can sit inside an existing quality system.
- Certification is not a presumption of EU AI Act conformity and does not replace MDR or FDA requirements.
- Clauses 4.1 to 4.4 fix context, interested parties, scope and the management system; the scope decides what a certificate covers.
- Clause 5 needs visible top management leadership, a communicated AI policy and named roles for conformity and reporting.
Free practice question
Meridian Rhythm Software, a fictional maker of AI arrhythmia software, asks whether obtaining ISO/IEC 42001 certification is a legal requirement for selling in the EU.
What is the correct answer?
Yes, it is mandatory for every AI product in the EU.
Not quite. The AI Act does not make certification to ISO/IEC 42001 mandatory for any product.
No, the standard is voluntary; certification is a choice, although customers or contracts may ask for it.
Correct. ISO/IEC 42001 is a voluntary standard; clause 1 sets requirements for organisations that choose to adopt it.
Yes, but only for companies with more than 500 staff.
Not quite. The standard sets no employee threshold and is voluntary for every size. Checking the matching clause of ISO/IEC 42001 confirms this reading.
No, because certification is not possible for AI.
Not quite. Accredited certification bodies can audit against ISO/IEC 42001, so certification is possible.
Key terms
- AIMS: AI management system: the policies, processes and controls an organisation uses to manage the responsible development, provision or use of AI systems.
- Annex SL: The common high-level structure, clauses 4 to 10, shared by ISO management system standards such as ISO 9001 and ISO/IEC 27001.
- interested party: A person or organisation that can affect or be affected by the AIMS, such as patients, clinicians, regulators or suppliers.
- scope: The documented boundary of the AIMS, set under clause 4.3, which also decides what a certificate covers.
- AI policy: Top management's documented intentions and direction for AI, required by clause 5.2.
- top management: The person or group that directs and controls the organisation at the highest level.
Official sources
- ISO/IEC 42001:2023 - AI management system
- ISO/IEC 23894:2023 - AI risk management guidance
- Regulation (EU) 2024/1689 - Artificial Intelligence Act
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.