Overview
ISO/IEC 42001 is the international standard for AI Management Systems (AIMS). It helps organizations establish accountability, risk management, and controls for developing and using artificial intelligence. It uses the harmonized structure (clauses 4–10) and can be implemented on its own or integrated with ISO 27001, ISO 27701, or ISO 9001. A core element is the AI impact assessment, which evaluates potential effects on individuals, groups, and society before and during deployment.
What it covers
- Context, leadership, and AI policy (clauses 4–5)
- AI risk assessment and treatment, including impact on individuals and society (clause 6)
- AI impact assessments for systems that affect people or decisions
- Support, operation, and control of AI systems throughout their lifecycle (clauses 7–8)
- Performance evaluation and continual improvement (clauses 9–10)
- Alignment with responsible AI principles and integration with existing management systems
How we help
Implementation, audits and maintenance.
Implementation
We help establish an AI governance framework, identify and assess AI-related risks, run AI impact assessments for systems that affect individuals or automated decisions, design controls, and build the documentation and processes needed for a certifiable AIMS. Impact assessments cover intended use, potential harms, affected stakeholders, and mitigation measures.
Audits
AIMS internal audits, readiness assessments that review impact assessment records and risk treatment, and certification audit support.
Maintenance
Ongoing AI risk monitoring, updates to impact assessments when systems or use cases change, management review support, and continual improvement as AI use evolves.
Typical outcomes
What you have at the end
- Documented AI scope, policy, and risk assessment
- Completed AI impact assessments for in-scope systems
- Control framework for AI development and use
- Evidence ready for certification audit
- A system that can integrate with ISO 27001 or ISO 27701
Relevant credentials
Who does the work
Internal Auditor (I42001IA)
CertiProf · valid to Oct 2029AI Governance Fundamentals (I42001AIGF)
CertiProf · valid to Aug 2027Typical engagement
From gap analysis to certification.
Gap analysis
Current-state assessment against the standard and your obligations.
Risk assessment
Identify what could go wrong and plan how to treat it.
Governance & process design
Roles, policies and processes sized to how you operate.
Implementation & controls
Hands-on support designing and evidencing controls.
Internal audit & readiness
Independent internal audit and Stage 1 / Stage 2 preparation.
Training
Build capability so your team can run the system.
Related services
Often implemented together
Information Security
Build and certify an ISMS, from risk assessment and Annex A controls to Stage 2.
Learn more → ISO/IEC 27701:2025Privacy Information Management
A standalone, certifiable PIMS under the 2025 edition, or transition from 2019.
Learn more → AI GovernanceAI Governance Programs
Policy, inventory, ownership and oversight for AI, with or without certification.
Learn more →Ready to start on ISO/IEC 42001?
Preparing for ISO certification, tightening governance, or need an independent assessment? Tell us where you are and we’ll map the route.
Or email sales@metronguard.com