How to Implement ISO 42001: A Step-by-Step AIMS Guide

What are the steps to implement ISO 42001?

Every implementation follows the same ten steps, whatever the size of the organisation. The order matters: the register and leadership come before controls, and checking comes before certification.

• 1. Score where you stand: rate each practice from 0 (not done) to 4 (improving) and set a target.
• 2. Register every AI system you build, buy or use, including AI features inside bought software and proposals not yet built.
• 3. Decide your role for each system (provider, deployer or both) and screen each for high-risk, prohibited or medical-device questions with your adviser.
• 4. Build a business case with low, likely and high cases and get leadership to sign it, with a clear statement that certification is not legal compliance.
• 5. Context and scope: issues, interested parties (including people affected who are not customers) and a scope a customer would recognise.
• 6. AI policy and roles: one page approved by top management; a RACI with one owner per activity.
• 7. AI risk assessment with criteria approved before any scoring, and impact assessment for every system that affects people.
• 8. Treatment and Statement of Applicability: choose modify, retain, avoid or share; walk all 38 Annex A controls; get owners to accept residual risk.
• 9. Build and run: release gate, model cards, logs, data provenance, supplier terms, user information, AI literacy training and a route for concerns.
• 10. Check and certify: internal audit, management review, corrective action, then Stage 1 and Stage 2 with an accredited body.

What does ISO 42001 actually require?

ISO/IEC 42001:2023 was published on 18 December 2023 as the first edition, and ISO's page listed no amendment at November 2026. A European adoption, EN ISO/IEC 42001:2026, was published in March 2026 for sale by European national standards bodies. The standard applies to organisations that provide or use AI-based products or services.

The requirements sit in clauses 4 to 10, which follow the plan, do, check, act cycle and the same harmonised structure as ISO/IEC 27001 and ISO 9001: context, roles and scope; leadership and AI policy; planning (AI risk assessment, risk treatment, the Statement of Applicability, AI system impact assessment and objectives); support (resources, competence, awareness, communication, documented information); operation; performance evaluation (monitoring, internal audit, management review); and improvement.

Annex A lists 38 controls in nine groups: AI policies, internal organisation, resources for AI systems, impact assessment, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships. Annex B gives implementation guidance, Annex C gives example objectives and risk sources, and Annex D covers use across sectors. The standard is copyrighted: buy it, and paraphrase rather than copy it.

Why start with an AI system register?

Every later step depends on knowing what AI you run. Risk assessment needs a system to assess, impact assessment needs to know who it affects, the Statement of Applicability needs to know whether you build anything, and supplier reviews need to know which supplier sits behind which feature. The standard does not use the word register, but its scope, resource and intended-use requirements cannot be met without one.

Ask about behaviour, not products. 'Which tools do you use that predict, write, summarise, rank or recommend?' finds AI features suppliers have added in updates, such as a recruiting system that starts ranking applicants by default. For each system record its purpose (which becomes its intended use), whether you built or bought it, who it affects, its life cycle stage, its owner and supplier, whether it uses personal data and your role. Then screen it with your adviser: could it be a prohibited or high-risk use under EU law, or software with a medical purpose? If the answer may be yes, stop and record a decision before anyone builds or switches it on.

How is an AI impact assessment different from a risk assessment?

A risk assessment asks what could go wrong for the organisation and its objectives, scored with likelihood and impact against criteria leadership approved. Clause 6.1.4 adds a separate duty: assess the potential consequences of AI systems for individuals, groups of people and society. That includes people who never chose to use the system, such as patients who meet a clinic's chat assistant or applicants screened by a hiring tool.

A practical method has five decisions: is one needed (the register can decide this by rule); who is affected and could they be affected differently; what harms and benefits could follow; how big are they (for example severity times scale, each rated 1 to 4); and what you decide, proceed, proceed with conditions or do not proceed, with a review date. ISO/IEC 42005:2025 gives detailed guidance. Invite someone who meets the affected people every week: in our worked example, a receptionist who translated for patients asked the question that found the biggest gap.

Worked example: what does the business case look like?

Here is the sample from a fictional 260-person health-tech company in Copenhagen that already held ISO/IEC 27001, built with the kit's calculator. Every figure is an estimate for illustration, in euros, over one three-year certification cycle.

The cost of doing it, including internal time, came to €342,400, with €179,500 in year 1. Internal time was the largest category at €207,700; the cash cost was €134,700 because document control, internal audit and supplier reviews already ran inside the ISMS. Benefits combined expected loss avoided from four AI loss scenarios with the margin on fees protected or won from customers who ask about AI governance. The low case was roughly break-even and slightly negative; the likely and high cases were positive. Showing all three is what made the case credible to the finance director.

How do you write the Statement of Applicability?

The Statement of Applicability lists every Annex A control, whether it applies, why it is included or excluded, and whether it is implemented. Auditors read it first and test it throughout the audit, so every line must be true today.

For each of the 38 controls choose a reason for inclusion (risk treatment, impact assessment, a legal or contract requirement, a customer requirement or good practice), a status (implemented, partial, planned or not started), an owner and an evidence reference that points to a record an auditor can open. Organisations that build AI usually find every control applies. Organisations that only use bought AI may justifiably exclude some development and data controls, with a one-line reason such as 'We do not develop or train AI systems; all AI is bought; reviewed each year'. Partial with an owner and a date is better than implemented without evidence.

Does ISO 42001 certification mean legal compliance in the EU, US or UK?

No. An ISO/IEC 42001 certificate shows that an accredited certification body found your AI management system conforms to the standard for the scope on the certificate. It does not prove compliance with the EU AI Act or any other law, and it does not certify individual products.

The AI Act was amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026. On the European Commission's current timetable, high-risk duties for listed uses apply from 2 December 2027 and for AI in regulated products from 2 August 2028. In October 2026 the Commission cited EN 18286, a quality management standard for providers of high-risk AI systems, as the first harmonised standard under the Act; that standard gives the presumption of conformity, not ISO/IEC 42001. An AIMS still helps a great deal: the register, roles, risk and impact records, logs, human oversight and incident handling are exactly the evidence legal duties ask for. Ask your adviser which duties apply to you.

Most frameworks ask the same questions in different words, so one AIMS can carry most of the evidence. The NIST AI Risk Management Framework organises practice into Govern, Map, Measure and Manage; NIST says the framework is being revised. In Canada there is no comprehensive federal AI law, but a voluntary code for advanced generative AI and privacy law that applies to AI. The UK relies on existing regulators and ICO guidance, and the government decided in February 2026 not to publish its draft AI Management Essentials tool. Australia condensed its earlier guardrails into six essential practices in its Guidance for AI Adoption in October 2025. New Zealand published voluntary business guidance in July 2025.

Map each framework to your AIMS areas once and keep the specifics, such as dates and thresholds, in one dated register you check every quarter.

How long does it take, and what happens at the certification audit?

There is no fixed timeline. In the worked example, a company starting at an average maturity of 0.44 out of 4, with an ISMS to build on, planned 36 weeks from kick-off to Stage 2 and reached 2.50 eleven days before Stage 1.

Stage 1 reviews design and readiness: scope and roles, AI policy, register, risk and impact methods and results, Statement of Applicability, internal audit and management review records. Stage 2 tests whether the system works: the auditor samples evidence, interviews people and follows a few AI systems end to end. Minor nonconformities usually need a correction, root cause and corrective action plan by an agreed date; a major one normally needs follow-up before certification. Certificates run on a three-year cycle with surveillance audits in years two and three.

Certification bodies for AI management systems must meet ISO/IEC 42006:2025, published in July 2025, on top of ISO/IEC 17021-1. In the UK, UKAS announced its first ISO/IEC 42001 accreditation of a certification body on 15 January 2026, and ANAB accredits bodies in the US. Check a body's accreditation scope on the accreditation body's register, and avoid anyone who offers to write your AIMS and certify it.

What are the most common ISO 42001 mistakes?

These come up again and again in internal audits and certification audits.

• Treating an AI ethics statement as the management system.
• Deciding one role for the whole company instead of a role per AI system.
• A register that misses AI features inside bought software.
• Scoring AI risks before agreeing criteria, so results cannot be repeated.
• Impact assessments that list only customers, not the people affected.
• A Statement of Applicability with no reasons, or controls marked implemented with no evidence.
• Releases that skip the gate under deadline pressure.
• Supplier certificates accepted without reading the scope.
• Metrics with no decisions, and internal auditors auditing their own work.
• Telling customers the certificate means EU AI Act compliance.

How do you keep people and skills ready?

Auditors talk to people, not just documents. A 45-minute briefing built around your own near misses, followed by a short scenario-based knowledge check, works better than a long slide deck. Keep attendance and results as evidence of competence and awareness, and define deeper competence for system owners, engineers and evaluators.

For a wider view of judgement in the people who sign off AI decisions, the Signing It Off: AI Governance Judgment assessment on AssessAll tests real scenarios. AIMS leads benefit from a written development plan for the competences the role needs, and Jobulary's individual development plan guide is a practical place to start. The ISO 42001 AI Management System Starter from Bodhih Training includes the register, the forms, the briefing plan, the knowledge check and every template in this guide.