Skip to Content
ISO 42001ISO standards for AI

ISO standards for AI: the complete family

There is not one ISO standard for AI, but a whole family. ISO/IEC 42001  is the best known and the only certifiable one, but around it sit guidelines that help with risks, terms and impact. They all come from the same committee, ISO/IEC JTC 1/SC 42 . In the Netherlands you can obtain them through NEN . On this page you can see per standard what it does and who it is for.

Which ISO standards for AI exist?

The standards fall into two types. One is certifiable: ISO/IEC 42001, the AI management system. You can get a certificate for it from a certification body. The rest are guidelines and technical reports. They help you fill in the requirements, but you cannot be certified against them.

StandardNamePurposeStatusFor whom
ISO/IEC 42001:2023AI management system (AIMS)Governing and controlling AI responsiblyCertifiableAny organisation that develops or uses AI
ISO/IEC 23894:2023Guidance on AI risk managementFilling in the risk process for AIGuidelineRisk and compliance roles
ISO/IEC 22989:2022Concepts and terminologyOne language for AI termsGuidelineAnyone working with AI standards
ISO/IEC TR 24028:2020Overview of AI trustworthinessBackground on robustness and safetyTechnical reportDevelopers and architects
ISO/IEC 42005:2025AI system impact assessmentAssessing the impact on peopleGuidelineAnyone carrying out an impact assessment

Only ISO/IEC 42001 results in a certificate. The other standards are useful as reference works and for filling in requirements, but you cannot be audited against them.

ISO/IEC 42001: the hub of the family

ISO/IEC 42001:2023  was published in December 2023 and is the first certifiable AI standard in the world. It describes how you set up an AI management system: policy, roles, risk management and continual improvement. The standard follows the High Level Structure, just like ISO 27001 and ISO 9001.

The other standards in the family connect to it. They give more detail on parts where 42001 only sets the requirement. Read more about what ISO 42001 is and the requirements of the standard.

ISO/IEC 23894: risk management for AI

ISO/IEC 23894:2023  works out the risk process specifically for AI. Where ISO 42001 requires that you control your risks, 23894 shows how. It aligns with ISO 31000, the general risk management standard.

Use this standard as a practical supplement to your AI risk management. It describes AI-specific risk sources such as bias, data quality and lack of explainability.

ISO/IEC 22989: concepts and terminology

ISO/IEC 22989:2022  sets out the basic concepts: what an AI system is, what a model is, what training data is and what model drift is. It makes sure everyone speaks the same language. It is a useful starting point before you dive into the other standards.

For an accessible explanation of these terms, you can also visit our terms and definitions page.

ISO/IEC TR 24028: trustworthiness of AI

ISO/IEC TR 24028:2020  is a technical report, not a standard you comply with. It gives background on trustworthy AI: robustness, safety, transparency and explainability. Think of it as a reference work that underpins the concepts behind AI ethics.

ISO/IEC 42005: AI impact assessment

ISO/IEC 42005:2025  was published in 2025 and focuses on one part: the impact assessment. How do you assess the consequences of an AI system for people, groups and society? It is the practical guide to the AI impact assessment that ISO 42001 asks for.

Which standard do you need?

Start with ISO/IEC 42001 if you want to certify or want to arrange your AI governance in a structured way. Pick up the rest where you need more depth: 23894 for risks, 42005 for impact, 22989 for terms, 24028 for trustworthiness.

The EU AI Act is not an ISO standard but a law. ISO standards can help you comply with it, but they are not the same thing. Read ISO 42001 vs EU AI Act for the difference.

Further reading

Sources

For startups and scale-upsTerms and definitions