What is ISO 42001? The standard for responsible AI
ISO 42001 is the first international standard for AI management systems. If you develop, implement or use AI, this standard helps you do that responsibly. With the arrival of the EU AI Act , it is becoming more and more relevant. In the Netherlands, the standard is available from NEN (Netherlands Standardisation Institute) .
ISO/IEC 42001 at a glance
| Topic | What you need to know |
|---|---|
| Full name | ISO/IEC 42001:2023, the AI management system (AIMS) |
| Published | December 2023, the first certifiable AI standard in the world |
| Structure | High Level Structure, requirements in clauses 4 to 10 |
| Annex A | 38 controls across nine domains, selected based on risk |
| Unique element | The AI impact assessment (AISIA): effects on people, not only technology |
| Relationship to the EU AI Act | No guarantee of compliance, but a solid basis |
| Certificate validity | 3 years, with an annual surveillance audit |
What is ISO 42001?
ISO/IEC 42001 describes how organisations set up an AI management system (AIMS). Such a system ensures that you develop and use AI in a reliable, transparent and ethically responsible way. In the Netherlands, the standard is available from NEN (Netherlands Standardisation Institute) .
ISO published the standard in December 2023. It is the first certifiable standard for AI in the world. It gives organisations a framework to manage the risks of AI without holding back innovation.
What does it cover in practice? Questions such as these: how do you assess the impact of your AI system on people? How do you make decisions explainable? How do you deal with bias in your data? How do you monitor quality throughout the entire lifecycle of your AI?
ISO 42001 uses the same structure as ISO 27001, ISO 9001 and other modern management system standards. The High Level Structure (HLS) makes it easier to combine several certifications.
Why is ISO 42001 relevant now?
The timing is no coincidence. The European Union has adopted the AI Act, the first comprehensive AI legislation in the world. This law sets strict requirements for AI systems, especially where they pose risks to people.
ISO 42001 helps you meet many of those requirements. It does not guarantee full compliance, but it provides a solid basis. Organisations that start with ISO 42001 now will be better prepared for the obligations that are coming.
The timeline of the EU AI Act is as follows:
- February 2025: Prohibited AI applications and the AI literacy requirement
- August 2025: Requirements for general-purpose AI models
- December 2027: Requirements for high-risk AI systems in Annex III (postponed from August 2026)
- August 2028: Requirements for high-risk AI in regulated products
The deadlines for high-risk AI are expected to be postponed through the Digital Omnibus package. A political agreement of 7 May 2026 still needs formal approval. Check the current position with the Dutch government (Rijksoverheid) .
Who is ISO 42001 for?
The standard is relevant to any organisation that develops, implements or uses AI. In practice, it mainly concerns these groups.
AI developers and tech companies that build AI systems for customers or for their own use. Think of machine learning platforms, chatbots, image recognition and recommendation systems.
Organisations that implement AI in their business processes. A bank that uses AI for credit assessment. A hospital with AI-supported diagnostics. A retailer with personalised recommendations.
IT service providers that deliver AI solutions to customers. Consultants, system integrators and managed service providers.
Government organisations that use AI for public services or enforcement. The societal impact is especially large here.
Sectors with a direct impact on people, such as healthcare, financial services and HR, face the strictest requirements under the EU AI Act. For these sectors, ISO 42001 is especially relevant.
The core of ISO 42001
ISO 42001 is built on six principles for trustworthy AI.
Transparency means it is clear how your AI system works and which decisions it makes. There is no black box that nobody can look into.
Accountability means you can explain why your AI system makes certain decisions. Someone is responsible for what the AI does.
Fairness is about preventing discrimination and bias. Your AI must not systematically disadvantage certain groups.
Explainability is closely related to transparency. The factors that influence an outcome are understandable to the people who work with the system.
Privacy means you handle the data your AI uses and generates with care.
Reliability means your AI system works safely and predictably in all circumstances.
The parts of ISO 42001
ISO 42001 consists of ten clauses and four annexes.
Clauses 1 to 3 are introductory: scope, references and definitions.
Clauses 4 to 10 contain the requirements. They follow the familiar Plan-Do-Check-Act cycle: determine the context, show leadership, plan, provide support, operate, evaluate and improve.
Annex A contains 38 controls spread across nine domains. This is the toolbox you choose from based on your risks. Read more about the Annex A controls.
Annex B provides implementation guidance for the controls.
Annex C describes AI-related objectives and risk sources.
Annex D contains references to sector-specific standards.
Unique to ISO 42001: the AI impact assessment
A distinctive element of ISO 42001 is the AI System Impact Assessment (AISIA). This goes further than a standard risk analysis.
A risk analysis looks at what can go wrong and how likely that is. An impact assessment looks at the effects of your AI system on individuals, groups and society.
What happens if your AI makes a wrong decision? Who is affected by it? How serious is that? Can someone be disadvantaged without knowing it or being able to challenge it?
Questions like these force you to look wider than technical risks alone. Read more about the AI impact assessment.
The first ISO 42001 certificate in the Netherlands
In 2025, DNV issued the first ISO 42001 certificate in the Netherlands to Metyis, an internationally operating data and AI company. This was a milestone for the Dutch market.
Since then, the number of certified organisations has grown steadily. Awareness of the standard is still relatively low. That is changing now that the EU AI Act is becoming concrete.
Certification bodies in the Netherlands include DNV, TÜV, BSI, Kiwa and LRQA. They offer training, gap analyses and certification audits. Read more about certification bodies.
What does ISO 42001 certification cost?
The costs depend on the size of your organisation, the complexity of your AI systems and your current level of maturity.
For a medium-sized organisation, plan for these costs:
- Implementation: €15,000 - €75,000
- Certification audit: €8,000 - €20,000
- Annual surveillance audits: €5,000 - €12,000
These are indications. A small startup with one AI product costs less than a large organisation with dozens of AI applications.
Read more about costs and timeline.
How do you start with ISO 42001?
The route to ISO 42001 certification follows a logical sequence.
Step 1: Take stock of your AI systems. Which AI do you use? Where? For what purpose? Who is responsible? Read the practical guide with a register example on the page taking inventory of AI systems.
Step 2: Do a gap analysis. How far are you from the standard? What do you already have, and what is missing?
Step 3: Build your AI management system. Policy, procedures, roles and governance. Read what an AI management system involves exactly, and how to set up AI governance.
Step 4: Carry out risk and impact assessments. Per AI system. Read more about AI risk management.
Step 5: Implement controls. Choose from Annex A what fits your risks.
Step 6: Internal audit and improvement. Test your own system. Read more about internal audits.
Step 7: Certification audit. An external auditor assesses your system.
See the step-by-step plan for a detailed explanation.
ISO 42001 and other standards
If you already have ISO 27001, you have a head start. The structure is identical, and you can reuse many processes. You add the AI-specific elements.
The combination makes sense. ISO 27001 covers information security, and ISO 42001 covers AI governance. AI systems process data, so security is relevant. And many AI risks, such as data leaks or unauthorised access, are also information security risks.
Read more about ISO 42001 vs ISO 27001. If your AI systems process personal data, ISO 42001 vs ISO 27701 is also relevant. The privacy management standard and the AI standard overlap strongly on that point. ISO 42001 is also part of a wider family of ISO standards for AI. It is the only one of these that is a certifiable management system standard.
Important links
Sources
Standards and legislation:
- ISO/IEC 42001 at ISO - The official standard
- NEN - Dutch standardisation institute
- EU AI Act (EUR-Lex) - Full legal text
- Dutch government (Rijksoverheid) on the AI Act - Dutch context
- European AI Office - EU coordination
Frameworks and guidelines:
- NIST AI Risk Management Framework - US AI risk framework
- OECD AI Principles - International AI principles
- UNESCO AI Ethics - Ethical guidelines
Accreditation and certification:
- Raad voor Accreditatie (Dutch Accreditation Council) - Dutch accreditation authority