Your Auditor Will Ask About AI: ISO 42001 and the AI Management System Explained

ISO 42001 Explained

ISO/IEC 42001 is the international management system standard for artificial intelligence. Published in December 2023 by ISO and IEC, it brings owners, risk treatment and audit evidence to AI use inside a certifiable management system. ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS), and it runs on the Plan-Do-Check-Act cycle every ISO management standard shares; a management system standard, not an application-level specification. ISO names it the world’s first AI management system standard, built for organisations that develop, provide or use AI systems, across any size and sector. ISO’s requirements at a glance span leadership and organisational context, AI policy and objectives, risk management for AI systems, data governance and system lifecycle controls, transparency and information provision, performance evaluation and monitoring, and continual improvement.

No framework operates alone. The table below places ISO 42001 next to the other standards, frameworks and statutes this studio anchors AI governance work against. Singapore’s AI Verify testing framework crosswalks to ISO/IEC 42001 and to the NIST AI RMF (crosswalks dated 21 July 2025 and 13 October 2023 respectively on the current AI Verify listing). The same listing describes the AI Verify Testing Framework as helping companies assess their AI systems against 11 internationally recognised AI governance principles, and the AI Verify Foundation’s FAQ says it was designed as an audit and testing tool supporting both third-party independent testing and self-assessment; it is a testing framework, not a certifiable management-system standard. Every row names a standard, framework or statute in its own right, never an Synthesised compliance claim.

Why It Is More Than Paperwork

ISO 42001 is more than paperwork because what an auditor inspects is running evidence, not filed intentions: owner assignments, AI risk-assessment and treatment records (commonly kept as a risk register), impact assessments and monitoring records the AIMS produces as it operates. A policy statement on its own proves nothing until the system generates that evidence. The standard requires risk-assessment and treatment processes with documented results and assigned responsibilities; treating it as paperwork misreads what an auditor inspects.

ISO 42001 is voluntary in Singapore and Australia, so, absent a contractual or sector-specific requirement, no fine attaches to skipping it; the stake sits in tender access and audit friction instead. A certified AIMS provides reusable independent evidence that can reduce duplicated diligence across a procurement panel’s AI-governance questionnaires, though it does not replace tender-specific due diligence; without governance evidence, enterprise and government deals can stall at the compliance gate. ISO’s own requirements at a glance run as an operating system, not a binder, and each requirement named above is an operated control, not a filed document. What an auditor inspects is running evidence: owner assignments, AI risk-assessment and treatment records (commonly a risk register), impact assessments and monitoring records the AIMS produces as it runs; a paperwork-only reading captures none of these. In a production build, Synthesised.ai can attach governance evidence to each sprint, so the governed system that ships is the same one an auditor reads later; the week-8/month-12 timings are illustrative, and actual timelines are agreed per engagement. That discipline is exactly what the standard names.

Clauses and Controls

The Management System Clauses

Clauses 4 to 10 of ISO 42001 specify the requirements an organisation is audited against. The table below is Synthesised.ai’s working summary of those seven requirement clauses, the count no floor page’s own standard summary carries.

Clause summary prepared by Synthesised.ai; the purchased ISO/IEC 42001:2023 text is the authoritative wording.

The Annex A Control Themes

Annex A groups AI-specific controls by control objective, and an organisation selects from them by applicability. The table below is Synthesised.ai’s working summary of the objective themes; control counts stay unstated here, because no verified source is cited for them, and none is invented to fill the gap.

Annex A summary prepared by Synthesised.ai; the purchased ISO/IEC 42001:2023 text is the authoritative control list.

What Auditors Actually Inspect

An ISO 42001 auditor inspects operating evidence, not intentions: AI risk-assessment and treatment records (commonly a risk register), owner assignments, impact assessments and monitoring records the management system produces as it runs. The inspection targets map to the clauses: the risk register and treatment sit under clause 6, operational lifecycle controls sit under clause 8, and monitoring plus internal audit sit under clause 9. This is a structural boundary, not a definitional one: what governance is, and its control domains, defines the AI governance concept these controls operate in full.

ISO 42001 Versus ISO 27001

ISO 42001 governs AI behaviour and ISO 27001 governs information security: the structures rhyme, the scopes never merge, and one certification never substitutes for the other. ISO/IEC 27001:2022 is titled Information security, cybersecurity and privacy protection, Information security management systems, Requirements, Edition 3, published October 2022, and in Synthesised.ai’s view a structural management-system sibling of 42001.

The table below sets the substitution-risk view no floor page publishes.

An organisation staging governance over time stages the ISO 42001 governance-maturity route these standards anchor, widening the audited control scope one level at a time.

Certification Steps and Scope

Scopes the Management System to Named AI Uses

The scope statement names which AI systems and uses the AIMS covers; scope sets the audit’s size before any control is assessed.

Documents the Risk Register and Impact Assessments

The organisation records an AI risk assessment and treatment plan under clause 6, and impact assessments under Annex A’s A.5, as the evidence base the certification audit reads.

Implements Controls and Collects Operating Evidence

Applicable Annex A controls operate, and the management system produces monitoring records and internal audit results under clause 9 as it runs.

Submits to Stage-One and Stage-Two Audits

An independent certification body runs a documentation-readiness audit, then an implementation audit against the requirements. Audit-stage durations stay unstated here; no accreditation-body figure is verified for this page, and none is invented to fill the gap.

Maintains Surveillance Audits on the Certification Cycle

Certification runs as a cycle: surveillance audits confirm the AIMS keeps operating, and clause 10 drives continual improvement between them. Cycle length stays unstated for the same reason: no verified figure, no invented number.

Align Your AI Programme to the Standard

Because certification audits inspect operating evidence, not intentions, aligning an AI programme to ISO 42001 means producing the risk register, owner map and audit trail inside the build itself. Synthesised.ai can attach eval-loops, observability and governance artefacts to each sprint, so the evidence an ISO 42001 audit reads is built in rather than reconstructed later; illustrative week-8/month-12 timings are agreed per engagement. Engagements build to ISO 42001; building to a standard is not certification.

The evidence pack above gets produced inside delivery, not after it. An AI consulting engagement maps each sprint’s governance evidence to the standard, and the wider set of definitions and frameworks it draws on indexes the AI resources hub. Enquiries route through the enquiry form; no pricing figure appears anywhere on this page.