The short answer: ISO/IEC 42001 certifies that an organization runs a management system for AI, with named owners, assessed risks, documented controls and a review cycle. It does not certify that any individual model is accurate, safe or fair, and it does not satisfy the EU AI Act. Treat a certificate as evidence of governance discipline, not as a safety claim about a product, and ask a vendor who audited them and under what accreditation.
Why does this matter to the accountable operator?
Two things are happening at once. Buyers in regulated sectors have started asking suppliers for ISO/IEC 42001, and suppliers have started answering with a logo in a sales deck. The gap between what those buyers think they are being told and what the certificate actually says is wide enough to matter in a procurement decision.
It matters in the other direction too. If you are weighing whether to pursue certification, you are committing a small team to months of work. That is a defensible investment if you know which question the certificate answers. It is an expensive way to acquire a logo if you do not.
The standard itself is not the confusing part. ISO/IEC 42001 was published in December 2023 and specifies requirements for establishing, implementing, maintaining and continually improving an AI management system, which the standard abbreviates as an AIMS. It applies to organizations that provide or use AI products and services. The confusion is about scope: what falls inside the certified boundary and what quietly falls outside it.
What does ISO/IEC 42001 actually certify?
It certifies a management system. That is a specific thing, and the phrase is doing real work.
An auditor assessing you against ISO/IEC 42001 is asking whether your organization has a repeatable way of deciding what AI it will deploy, who is accountable for each system, what risks were assessed, which controls were applied, how the results are monitored, and how problems get fed back into the next cycle. The structure is the same Plan-Do-Check-Act pattern that anyone who has been through ISO 27001 will recognize.
What the auditor is not doing is evaluating your model. They are not measuring its accuracy, testing it for bias, or forming a view on whether a specific output was correct. Those questions may appear inside your own risk assessment, and the auditor will check that you performed one and acted on it. But the certificate attests to the existence and operation of the system, not to the performance of anything the system governs.
This is the sentence most vendor marketing gets wrong, and it is worth stating plainly: a certified organization can deploy a bad model. If it assessed the risk, documented the decision, assigned an owner and monitored the outcome, the management system worked as designed even when the model did not.
Why does the scope statement matter more than the certificate?
Every management system certificate carries a scope statement, and for AI it carries more weight than most people give it.
An organization can certify a single product line, one business unit, or a defined set of AI systems. The certificate is valid for exactly that boundary. A company with forty AI use cases can hold a legitimate certificate covering three of them.
So when a supplier sends you a certificate, the useful document is not the certificate. It is the scope statement and the Statement of Applicability behind it, which records which controls were applied and which were excluded, with reasons. If a supplier will not share the scope, you have learned something. If the scope does not include the system you are about to buy, the certificate is real and also irrelevant to your decision.
Who certifies the certifiers?
This is the part that changed recently, and it is the most useful thing in this article for anyone evaluating a certificate issued in the last two years.
ISO/IEC 42001 was published in December 2023. Certification bodies began offering audits against it almost immediately. But the standard that says what a certification body must be competent at, in order to audit an AI management system credibly, did not exist yet. ISO/IEC 42006 was published in July 2025, more than eighteen months after the standard it supports.
ISO/IEC 42006 supplements ISO/IEC 17021-1, the general standard for bodies that certify management systems, with AI-specific provisions. It sets out what an audit team collectively has to know, including the Annex A controls and how they are implemented in practice, AI technologies, applicable legal obligations and sector context. It also introduces structured audit-time calculation, so that the duration of an audit reflects factors like the number of AI systems in scope, how many are high-risk applications, and the third-party relationships involved. In plain terms, it makes it harder to certify a large, complicated organization in a short, cheap audit.
Accreditation bodies moved it into their schemes from late 2025 through 2026, so accreditation against the published standard is now the benchmark rather than the exception.
The practical consequence for a buyer: certificates are not all backed by the same thing. Some were issued before any AI-specific competence baseline existed, some under draft requirements, and some under full accreditation to the published standard. None of that makes an early certificate fraudulent. It does mean “we are ISO 42001 certified” is an incomplete sentence, and the completing half is who accredited the body that audited you.
Does certification satisfy the EU AI Act?
No, and the reason is procedural rather than technical.
Under Article 40 of the AI Act, a presumption of conformity follows from compliance with a harmonised standard whose reference has been published in the Official Journal of the European Union, developed through a Commission standardisation request. As one legal analysis of the mechanism puts it, the presumption “does not stem from the technical nature of the standard, but from a precise procedure.”
ISO/IEC 42001 is a voluntary international standard. It did not come through that procedure and it is not cited in the Official Journal, so it confers no presumption of conformity, however good the underlying management system is. The European standard being developed to answer the Article 17 quality management system obligation is prEN 18286, which entered public enquiry in late 2025 and still awaits citation.
There is also a substantive mismatch underneath the procedural one. ISO/IEC 42001 is an organizational management standard. Article 17 is a product compliance obligation attached to high-risk systems. They are aimed at different targets, so even a perfect 42001 programme leaves the Act’s product requirements to be demonstrated separately.
None of which makes the work wasted. An organization with a running AI management system will find the AI Act’s documentation, risk management and post-market monitoring obligations far less painful than one starting from nothing. It is a strong foundation and a poor substitute. For the Act’s own timeline and risk tiers, which have moved more than once, see our AI governance framework.
How does this compare to the NIST framework?
The two are often named in the same breath and they work differently.
The NIST AI Risk Management Framework is voluntary and non-certifiable. There is no such thing as a NIST AI RMF certificate, and any organization claiming one is describing something that does not exist. What it gives you is a structure, the four functions of govern, map, measure and manage, that U.S. enterprise buyers and auditors increasingly expect to see reflected in how you work. You align to it and show your work.
ISO/IEC 42001 is the certifiable counterpart. It covers similar ground with a formal audit and a certificate at the end.
A useful way to hold the difference: NIST gives you a vocabulary and a structure to think with, and costs nothing to adopt. ISO/IEC 42001 gives you a third party attesting that you actually do it, and costs real money and months. Mature programmes usually end up mapping to both, because the buyer asking the question changes depending on which market you are selling into.
Two more standards are worth knowing by name, because they fill gaps the headline standard leaves open. ISO/IEC 42005, published in May 2025, is guidance on conducting an AI system impact assessment, meaning how a system may affect individuals, groups or society. ISO/IEC 42006, covered above, governs the auditors.
Should a mid-market company pursue certification?
Sometimes. Here is the honest decision rule we use.
Certification earns its cost when a certificate unblocks revenue. If enterprise buyers or public sector procurement in your market are asking for it, and a deal has stalled without it, the calculation is straightforward. The certificate is a sales asset with a price tag, and you can compare the two.
It is premature when the underlying practice does not exist yet. You cannot certify a management system you have not built. Organizations that start with the audit rather than the governance work spend months producing documentation that describes a process nobody follows, which is expensive and produces exactly one durable artifact: a wall certificate.
The middle path is usually right for a mid-market company in a regulated sector. Build the management system, structure it to the standard, operate it long enough to have real evidence, and keep certification as a decision you can take later when a buyer makes it worth taking. You get most of the risk reduction immediately and defer the audit cost until it converts into revenue.
That middle path is the posture IntellaGrow takes on its own work, and we say so plainly rather than implying otherwise: we structure client governance to these frameworks, and we hold no certification under them. Our published engagement ranges are on the pricing page. Certification audit fees are separate, vary widely with scope and the number of AI systems in play, and are paid to the certification body rather than to us.
What does the readiness work actually involve?
Independent of whether you certify, the work is the same, and it is more organizational than technical:
- Inventory. Every AI system in use, including the ones bought as a feature inside other software and the ones a team started using without telling anyone.
- Ownership. A named accountable human per system. Not a committee, and not the vendor.
- Risk and impact assessment. What could go wrong, who it lands on, and what you decided to do about it. ISO/IEC 42005 is the guidance to work from.
- Controls across the lifecycle. Access scoped to the minimum needed, human approval on actions that carry consequence, and evidence captured while the work happens instead of reconstructed later.
- Monitoring and review. A cadence that catches drift, and a route for problems to change the next decision.
- A Statement of Applicability. Which controls apply, which do not, and why.
If you want the version of this that is about running AI safely rather than passing an audit, what governed AI actually means is the plain-language start, and our AI governance and compliance service describes how we implement it.
Frequently asked questions
What does ISO/IEC 42001 certify?
It certifies that an organization operates an AI management system meeting the standard’s requirements: an AI policy, named owners, risk and impact assessment, controls applied across the AI lifecycle, monitoring, internal audit, management review and continual improvement. It attests to how the organization governs AI. It does not attest to the accuracy, safety or fairness of any individual model, and a certified organization can still deploy a model that performs badly.
Is ISO/IEC 42001 certification required by law?
No. It is a voluntary international standard. No jurisdiction currently requires it. It appears in contracts and procurement questionnaires because buyers use it as a proxy for governance maturity, which makes it commercially important in some markets without being a legal obligation anywhere.
Does ISO/IEC 42001 certification make us EU AI Act compliant?
No. Under Article 40 of the AI Act, a presumption of conformity requires a harmonised standard cited in the Official Journal and developed through a Commission standardisation request. ISO/IEC 42001 is a voluntary international standard that did not come through that process. The European standard aimed at the Article 17 quality management system obligation is prEN 18286, which is still working through the process. A 42001 programme makes AI Act work substantially easier and does not replace it.
What is ISO/IEC 42006 and why does it matter to a buyer?
ISO/IEC 42006, published in July 2025, sets the requirements for the bodies that audit and certify AI management systems, supplementing ISO/IEC 17021-1 with AI-specific competence and audit-time rules. It matters because ISO/IEC 42001 certificates were being issued from early 2024, before that baseline existed. When evaluating a supplier’s certificate, ask which accreditation body stands behind the certification body, and read the scope statement.
How long does ISO/IEC 42001 readiness take?
For a mid-market organization with a defined set of AI use cases, building a working management system typically takes a few months, and the binding constraint is decision-making bandwidth rather than technical complexity: agreeing who owns what is slower than writing anything down. Certification adds an audit cycle on top, and most bodies want to see the system operating with real evidence before they will certify it, so building and running it comes first regardless of whether you certify at the end.
Working out whether certification belongs on your roadmap at all is a scoping question, and it is the kind of thing our AI Readiness and Cost-Reduction Assessment settles before anyone spends money on an audit.
Sources
- ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system, ISO
- ISO/IEC 42001 explained: what it is, ISO
- ISO/IEC 42005:2025, AI system impact assessment, ISO, May 2025
- ISO/IEC 42006:2025, Requirements for bodies providing audit and certification of artificial intelligence management systems, ISO, July 2025
- New benchmark for bodies certifying AI management systems, CQI and IRCA
- ISO 42006 raises the bar for ISO 42001 certifiers, Bright Defense
- ISO/IEC 42001 and the AI Act: why certification is not (yet) a presumption of conformity, Law and Technology
- Regulatory framework for AI, European Commission
- NIST AI Risk Management Framework, NIST