ISO/IEC 42001 explained: what it is, and whether you can actually be certified against it

Yes, ISO/IEC 42001 certification is real. The standard is an auditable management system standard, and since 2025 a companion standard, ISO/IEC 42006, has set the requirements for the bodies that certify against it. But the certificate goes to an organization, not a person, and conformity with the standard is not the same thing as conformity with the law.

The standard, precisely

The full published title is ISO/IEC 42001, "Information technology - Artificial intelligence - Management system." It is edition 1.0, published on December 18, 2023.

Its scope is deliberately broad. It specifies requirements and guidance for establishing, implementing, maintaining and continually improving an AI management system, usually shortened to AIMS, within organizational contexts. It applies to organizations of any size, type or nature that provide or use AI-based products or services. A 4-person startup fine-tuning a model and a government agency buying one both fall inside that scope.

Read the title again before you go further, because the last two words carry all the weight. This is a management system standard. That phrase means something specific in the ISO world, and misunderstanding it is the single most common mistake people make with 42001.

Management system standard, technical standard, framework

A technical standard tells you what a product or process must be. It sets measurable properties: dimensions, tolerances, protocols, formats. You test the artifact against the specification and it passes or fails.

A management system standard tells you how an organization must run itself with respect to a subject. It sets requirements on governance: policies, defined roles, risk processes, documentation, review cycles, continual improvement. An auditor examines the organization, not the model. Two companies with very different AI systems can both conform to 42001, because what is being assessed is how they manage those systems.

A framework is looser than either. It is a structured set of good practices you can adopt in whole or in part. There is no external audit and no certificate, because there are no binding requirements to audit against.

Type	What it constrains	What gets assessed	Certificate possible?
Technical standard	The product or process itself	The artifact, against the specification	Depends on the scheme
Management system standard	How the organization governs a subject	The organization's processes and records	Yes, by an external body
Framework	Nothing; it guides	Nothing formally	No

ISO/IEC 42001 sits in the middle row. It will not tell you what accuracy your model needs or how to document a training dataset at a technical level. It tells you that your organization must have a working, maintained, improving system for governing its AI, and it makes that system auditable.

So can you actually be certified against it?

Your organization can. This is not a matter of interpretation, because ISO published a standard whose entire purpose is to govern 42001 certification. ISO/IEC 42006, "Information technology - Artificial intelligence - Requirements for bodies providing audit and certification of artificial intelligence management systems," was published in 2025. Its scope states:

This document specifies additional requirements to ISO/IEC 17021-1. The requirements contained in this document, when implemented, support the demonstration of competence, consistency and reliability by the bodies performing auditing and certification of an artificial intelligence management system (AIMS) according to ISO/IEC 42001 for organizations that provide, develop or use AI systems.

Note what that scope does and does not say. It regulates the certifiers, not the certified. It adds AI-specific requirements on top of ISO/IEC 17021-1, the baseline document it names for management system certification bodies. And it confirms the shape of the whole arrangement: a certification body audits an organization's AIMS against 42001 and issues a certificate to that organization.

That means the certificate belongs to a company, a division or some other defined organizational scope. If your manager told you, personally, to "get ISO 42001 certified," the sentence needs unpacking. [UNVERIFIED: training providers sell individual credentials with names like "ISO 42001 lead implementer" or "lead auditor," which certify a person's competence to build or audit an AIMS rather than certifying the AIMS itself.] Find out which of the two your manager actually means before you spend money.

Where 22989 and 42005 fit

ISO/IEC 42001 does not stand alone. Two neighbors matter most, and neither is certifiable in the way 42001 is.

ISO/IEC 22989, "Information technology - Artificial intelligence - Artificial intelligence concepts and terminology," edition 1.0, was published on July 19, 2022 by ISO/IEC JTC 1/SC 42. It runs to 60 pages. Its own scope says it "establishes terminology for AI and describes concepts in the field of AI" and "can be used in the development of other standards and in support of communications among diverse, interested parties or stakeholders." It is the vocabulary layer. When 42001 uses a term of art, 22989 is where the definition lives. You do not get certified against a dictionary.

ISO/IEC 42005, "Information technology - Artificial intelligence (AI) - AI system impact assessment," edition 1.0, was published on May 28, 2025. It provides guidance for organizations performing AI system impact assessments for individuals and societies that can be affected by an AI system and its foreseeable applications. The key word is guidance. Its catalog entry describes it as guidance, not requirements, and no companion standard exists to govern certification against it. It supports the work your AIMS requires; it is not itself a certification target.

Standard	Role	Published	Certification target?
ISO/IEC 22989	Concepts and terminology	July 19, 2022	No
ISO/IEC 42001	AIMS requirements	December 18, 2023	Yes
ISO/IEC 42005	Impact assessment guidance	May 28, 2025	No
ISO/IEC 42006	Requirements for certification bodies	2025	No; it governs the certifiers

Article 40 and the presumption of conformity

The EU AI Act connects standards to law through Article 40, and you should be precise about what that connection is.

Article 40(1) says that high-risk AI systems or general-purpose AI models which conform with harmonised standards, or parts of them, whose references have been published in the Official Journal of the European Union under Regulation (EU) No 1025/2012, "shall be presumed to be in conformity" with the requirements in Section 2 of that Chapter or, as applicable, the obligations in Chapter V, Sections 2 and 3. The presumption applies:

to the extent that those standards cover those requirements or obligations.

Three things follow, and each one narrows the claim.

First, the presumption attaches only to harmonised standards whose references have been published in the Official Journal. ISO/IEC 42001 is an international standard from the ISO/IEC catalog. Being an ISO standard does not make it a harmonised standard under the AI Act. Under Article 40(2), the Commission issues standardisation requests to the European standardisation organisations, consulting the Board and relevant stakeholders including the advisory forum, and those requests also cover deliverables on reporting and documentation to improve AI systems' resource performance, such as reducing a high-risk system's energy consumption. Under Article 40(3), participants in that process take into account existing international standards consistent with Union values. So international work like 42001 feeds the European process, but the presumption flows from Official Journal publication, not from ISO's catalog. Whether any harmonised standard covering these requirements has been cited in the Official Journal is a fact you must check at the moment you rely on it.

Second, the presumption is only as wide as the standard's coverage. If a harmonised standard covers some requirements and not others, you are presumed conformant only for the covered ones.

Third, a presumption of conformity is not conformity with the law itself. The legal obligations sit in the regulation. The standard is an evidentiary route toward them, within the limits Article 40 sets. A 42001 certificate, on its own, demonstrates that your AIMS meets 42001. It does not demonstrate that your high-risk system meets the AI Act, and no certification body operating under 42006 will tell you otherwise.

What to do with this

If you were told to get ISO 42001 certified, you can now translate the instruction. Confirm whether the target is the organization's AIMS, audited by a certification body working under 42006, or a personal credential about your own competence. Know which document does which job: 22989 supplies the terminology, 42001 supplies the auditable requirements, 42005 supplies impact assessment guidance, 42006 disciplines the certifiers. And if an AI governance exam sits between you and your next role, expect to need exactly these distinctions cold: the full title and 2023 publication of 42001, why a management system standard certifies organizations rather than products, and why Article 40's presumption starts and stops with harmonised standards published in the Official Journal. Get those boundaries right and the whole standards landscape stops being a blur of numbers.