Last updated: 9 November 2026
ISO 42001 is the first international standard for an AI management system. It is certifiable by an accredited body and shows you govern how AI is developed, bought and used, including risk, oversight and impact on people. It does not by itself make you compliant with AI law.
What it asks of you
AI policy and scope
Decide which AI systems and uses are in scope and who is accountable.
AI risk assessment
Identify risks such as bias, data leakage and wrong answers, and treat them.
Human oversight
Define where people review AI output and how incidents are handled.
Supplier control
Check the AI tools and suppliers you rely on, including those staff already use.
| Question | ISO 27001 | ISO 42001 |
|---|---|---|
| Focus | Protecting information | Governing AI systems and their impact |
| Best for | Any business handling customer data | Businesses building, selling or heavily using AI |
| Relationship | Complements ISO 42001 | Shares the management system structure |
Certification does not make an organisation compliant with the EU AI Act, although the risk-based approach is closely aligned with it. Start with the basics: an AI acceptable use policy is a sensible first step.
How ABCOM helps
We pair independent ISO consultants with Vanta, which offers an ISO 42001 framework that maps to existing controls. Details in how we help with ISO certification.
Quick answers
Is ISO 42001 mandatory?
No. It is voluntary, but customers and partners increasingly ask how you govern AI.
Do we need ISO 27001 first?
Not required, but the two share a structure, so having ISO 27001 makes ISO 42001 easier.
Customers asking how you govern AI? Talk to us about ISO 42001 readiness.
Related answers and guides
- Which ISO standard does our business need?
- What is ISO 27001, and can a small business get certified with Vanta?
- Do we need an AI acceptable use policy, and what should it say?
- How does ABCOM help with ISO certification?
- All ABCOM FAQs
Sources and further reading
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about Microsoft Defender and Purview. Free, friendly and no obligation.