ISO 42001

Questions we're often asked.

Why are we being asked for ISO 42001?

When you build, deploy or even just embed third-party AI in your product or operations, your customers need to know you govern it responsibly. Depending on the nature of the AI and the decisions it influences, that extends to how you assess impact, manage data and models, keep humans in the loop, and monitor systems in production.

Do we need ISO 42001 if we already have ISO 27001?

ISO 27001 covers information security. ISO 42001 covers how you govern AI systems specifically: bias, transparency, human oversight, lifecycle risk. They overlap on governance mechanics, but the AI-specific controls sit only in 42001. Many companies integrate the two management systems.

Does this apply to us if we only use third-party AI?

Yes. ISO 42001 distinguishes between building, providing and using AI systems. If you deploy third-party models into your product or operations, you're still accountable for how those systems behave and impact users.

How does this relate to the EU AI Act?

The EU AI Act is legislation; ISO 42001 is a management-system standard. They aren't the same, but a well-run 42001 program produces much of the governance, risk and lifecycle evidence you'll need to demonstrate AI Act compliance.

Is it too early to certify?

It depends on your buyers and stage. ISO 42001 is still an early-adopter framework, not a routine enterprise requirement. It can make sense when a buyer explicitly asks for it, alongside an existing ISO 27001 program, or when the governance benefit and differentiation justify the investment. If SOC 2 is your main assurance, make sure it covers your AI features and agents first.