Govern Your AI. Prove It With ISO 42001.

Pre-built in ISOPlanner™ and ready to implement

What is ISO 42001?

ISO/IEC 42001:2023 is the first international standard for managing artificial intelligence responsibly. It defines the requirements for an Artificial Intelligence Management System (AIMS): a structured way to govern AI risks, assign accountability, and demonstrate that AI systems are developed and used with proper oversight. It follows the same 10-clause structure as ISO 27001 and ISO 9001, with 39 Annex A controls across eight domains. Certification runs on a 3-year cycle with annual surveillance audits.
Any organization that develops, deploys, or uses AI systems and needs to prove responsible governance: software companies shipping AI features, businesses using AI in their processes or decisions, and anyone under the EU AI Act or facing AI questions in procurement.

The EU AI Act names ISO 42001 as a relevant standard for demonstrating compliance. Already ISO 27001 certified? You have a head start: the two standards share the same structure, and many of your existing controls already cover ISO 42001's data governance and security requirements.

Who Needs ISO 42001?

Hosted in EU Icon
100% Hosted in the eu
ISOPlanner™ Supports These ISO 42001 Versions
ISO 42001: 2023
How ISOPlanner™ Supports ISO 42001

Everything ISO 42001 Requires, Built Into ISOPlanner™

AI is moving faster than most governance structures can keep up with. ISO 42001 gives organizations a framework to manage AI responsibly, demonstrate accountability, and stay ahead of regulation. ISOPlanner™ gives you the tools to implement it inside Microsoft 365.

Pre-built ISO 42001 framework

ISOPlanner™ includes a complete ISO 42001 framework with all requirements and Annex A controls pre-structured. You begin from a working foundation. Controls are organized by domain and ready to assign to the responsible owners in your organization.

1
Embedded ML
API Calling ML
2

AI impact assessment

Use ISOPlanner's risk management module to document and assess AI systems. Record the intended purpose, potential risks, affected stakeholders, and treatment decisions for each system. The full assessment history is maintained in SharePoint with a traceable audit record.

Control management

Assign Annex A controls to owners, set monitoring schedules, and track execution through tasks in Outlook and Teams. When an auditor asks for evidence that a control is operating as intended, the record is already compiled.

3
ML Platform
API Calling ML
4

Document control

Policies, procedures, and AI governance documentation are stored in SharePoint with version control. Document approvals are built into the Business plan and above. All documentation is accessible to auditors without manual export.

Multi-standard management

If your organization already operates under ISO 27001, adding ISO 42001 reuses your existing management system, risk methodology, and evidence structure. ISOPlanner™ maps overlapping requirements between standards so your team addresses shared controls once.

5
ML Platform
API Calling ML
6

Timeline

Average ISO 42001 certification timeline with ISOPlanner™: 4-6 months. Organizations with an existing ISO 27001 certification can typically add ISO 42001 in 6-10 weeks. The management system is already in place. The incremental work covers the AI-specific requirements: impact assessment, Annex A controls for AI, and the governance documentation specific to your AI systems.

AI system inventories, risk assessments, policy docs, govern AI responsibly.

Book a demo
Municipality of Waterland - Netherlands

Structured Compliance from the Ground Up.

The Municipality of Waterland needed a structured approach to meet the BIO standard without building a heavy new system. ISOPlanner™ gave them clear ownership, organised tasks, and audit readiness from day one.
Read the Waterland Case
Answered

Frequently Asked Questions

01.

What is an AI Impact Assessment under ISO 42001?

Under ISO 42001 Clause 6.1, organisations must conduct an AI risk assessment to identify and evaluate the potential risks and impacts of their AI systems. This covers both intended and unintended consequences for individuals, groups, society, and the environment, considering the AI system's purpose, deployment context, and degree of human oversight. ISOPlanner™ provides an AI impact assessment template aligned to ISO 42001 that links directly to your risk register and treatment plan.

02.

How does an organisation define the scope of its AI Management System?

ISO 42001 Clause 4.3 requires organisations to define the scope of the AI Management System by considering internal and external issues, interested party requirements, and the nature of the AI activities being conducted. The scope covers which AI systems are included, the purposes they serve, and the organisational boundaries. A clearly defined scope is a prerequisite for certification. ISOPlanner™ includes a scope definition template that guides you through the Clause 4 context analysis.

03.

How does ISO 42001 relate to the EU AI Act?

ISO 42001 and the EU AI Act pursue complementary objectives. The EU AI Act establishes a legal risk-based framework for AI systems placed on the EU market, while ISO 42001 provides a management system standard for governing AI development and use. A certified ISO 42001 management system demonstrates the governance processes and controls required by the EU AI Act, particularly for high-risk AI system providers. ISOPlanner™ maps ISO 42001 controls to EU AI Act obligations so certification evidence supports regulatory compliance.

04.

Can ISO 42001 be integrated with ISO 27001?

Yes. ISO 42001 follows the ISO Harmonized Structure, the same high-level framework used by ISO 27001, ISO 9001, and ISO 14001. This makes integration straightforward: both standards share compatible clauses for context, leadership, planning, support, operation, evaluation, and improvement. Annex B of ISO 42001 also provides explicit guidance on implementing controls from ISO 27001 within the AI management context. ISOPlanner™ supports an integrated approach where ISO 42001 and ISO 27001 share documentation, audits, and evidence.

05.

What are the main roles and responsibilities in an AI Management System?

ISO 42001 Clause 5 requires top management to demonstrate leadership and commitment to the AI Management System. Organisations must assign roles and responsibilities for AI risk management, including an AI governance function. Key responsibilities include approving the AI policy, ensuring the AIMS achieves intended outcomes, directing resources, and overseeing AI-related risks. ISOPlanner™ includes a RACI template for AI governance roles that integrates with your existing management structure.

06.

What is the purpose of an AI Policy under ISO 42001?

ISO 42001 Clause 5.2 requires organisations to establish an AI policy that is appropriate to their purpose, provides a framework for setting AI objectives, commits to responsible AI and continual improvement, and is communicated throughout the organisation. The policy must address specific commitments relevant to the AI systems in scope. ISOPlanner™ includes an AI policy template that meets all Clause 5.2 requirements and is ready for leadership sign-off.

07.

How does ISO 42001 manage risks from third-party AI systems?

ISO 42001 Clause 6.1 and Annex A control A.8 require organisations to assess and manage AI-related risks from externally developed or procured AI systems. This includes evaluating the provider's governance practices, understanding model limitations and training data, and determining appropriate human oversight mechanisms. ISOPlanner™ provides a third-party AI register and assessment template to track every procured AI system and document the risk evaluation required under ISO 42001.