ISO 42001: how to implement an AI management system in the enterprise

When a company asks me how to govern its AI systematically and in a certifiable way, the answer increasingly points to one specific standard: ISO 42001. It is the first international standard for artificial intelligence management systems and, in the projects I lead, it is becoming the framework that orders everything else.

What ISO 42001 is and what it is for

ISO 42001 defines the requirements to establish, implement, maintain and improve an AI management system, known by its English acronym as AIMS. It follows the same logic as other management standards: a continuous-improvement cycle that requires the organisation to plan, do, check and act on how it develops and uses artificial intelligence.

Its value lies in turning AI governance into something structured and auditable. Instead of scattered good intentions, ISO 42001 requires policies, roles, controls and evidence.

ISO 42001 and the EU AI Act: allies, not rivals

A common question is whether ISO 42001 replaces the EU AI Act. It does not: they complement each other. The EU AI Act is a legal obligation; ISO 42001 is a voluntary framework that helps precisely to demonstrate that you comply. Implementing a management system compliant with the standard makes it far easier to prove regulatory compliance.

That is why I recommend approaching them together: the standard provides the management structure and the regulation sets the specific requirements. This integrated view fits with my general approach to IT regulations.

How to implement an AI management system step by step

Context and leadership

Everything starts with management’s commitment and understanding the organisation’s context: what AI it uses, for what purposes and which stakeholders are involved. Without the involvement of the governing body, ISO 42001 remains a dead letter.

Risk and impact assessment

The standard requires assessing risks and also the impact of AI systems on people. Here I connect with the discipline of risk management: AI adds new dimensions, such as bias or explainability, that must be assessed explicitly.

Controls, audit and improvement

With the risks identified, controls are implemented, their effectiveness is audited and it is continuously improved. Certification comes when an accredited body verifies that the management system really works, not just on paper.

How much it costs and how long it takes to implement ISO 42001

One of the first questions I get is about cost and timeframe. There is no single figure, because it depends on the size of the organisation and how many AI systems it has running, but there is a clear pattern: the bulk of the effort is not in the technology, but in ordering what already exists. Most companies already use AI in some way; what they lack is documenting who governs it, how its risks are assessed and what controls they apply. That is why a realistic project usually runs between six and twelve months to certification, with most of the work concentrated in the first months of diagnosis and design of the management system.

My advice is not to try to tackle everything at once. Starting with the most critical AI systems, building the governance framework around them and then extending it to the rest is far more effective than trying to certify the entire organisation from day one. That phased approach reduces the perceived cost and demonstrates results early, which helps keep management’s support throughout the project.

ISO 42001 and conformity assessment

It is worth understanding how ISO 42001 relates to the AI Act’s obligations. The standard does not replace the conformity assessment the regulation requires for high-risk systems, but it makes it far easier. An organisation that already has a certified AI management system arrives at the conformity assessment with much of the documentation done: risk analyses, controls, traceability and improvement processes. In practice, implementing ISO 42001 is the best possible preparation for later passing the conformity assessment of a high-risk AI system without surprises.

That is why I encourage people not to see certification as a decorative seal. Done well, it is the backbone that supports both regulatory compliance and the trust of clients and partners. The difference between a company that improvises its AI governance and one that has it certified becomes clear as soon as the first serious audit appears.

A common question I am asked is whether it is worth getting certified in ISO 42001 or whether it is enough to draw on its structure. My answer depends on the context: for a company operating in regulated sectors or selling to large clients, the certificate is a commercial and trust argument that opens doors. For an SME taking its first steps, adopting the framework without seeking immediate certification already brings order and method. What matters is not the seal itself, but internalising the continuous-improvement cycle the standard proposes and sustaining it over time.

Conclusion: order to govern AI

ISO 42001 provides what is most lacking in many organisations that adopt AI: order. Implementing an artificial intelligence management system does not slow innovation, it channels it. And, along the way, it makes EU AI Act compliance easier and conveys a trust that is hard to improvise.

Frequently asked questions about ISO 42001