AI Governance
Do you need ISO/IEC 42001, or a policy and a control?
ISO/IEC 42001 is the AI management system standard, and accredited certification arrived in 2026. Whether you need it is a separate question.
ISO/IEC 42001 is the management system standard for artificial intelligence — the AI equivalent of what ISO 27001 does for information security. It asks you to establish, operate and continually improve a documented system for governing AI, rather than to meet a fixed list of technical controls.
Something changed recently that most published guidance has not caught up with. Accredited certification is now genuinely available. ISO/IEC 42006, the standard governing certification bodies, was published in July 2025; UKAS granted accreditation in January 2026 and ANAB in March 2026. Advice written before that told you to wait because nobody could meaningfully certify you. That advice is now out of date.
Which raises the more useful question: do you need it?
Deciding
When it is worth it — and when it is not
We would rather talk you out of a certification you do not need than sell you one you cannot justify.
Worth it: a customer is asking
The most defensible reason. If a contract or an RFP names ISO/IEC 42001, the cost-benefit is already settled and the question is only how efficiently you get there.
Worth it: you are selling into the EU
A certified management system produces documentation in a shape that maps onto EU AI Act conformity work. It is not a substitute for conformity assessment, but it means you are not starting from nothing.
Worth it: AI is central to your product
If AI is what you sell rather than something you use, a management system stops being overhead and starts being how you run the business. The recurring audit is then a forcing function you would benefit from anyway.
Probably not: you have three AI features and no one asking
An acceptable-use policy, a documented risk assessment and an enforced technical control will do more for a fraction of the cost. Certification would be theatre, and expensive theatre.
Probably not: you are pre-product
Certifying a management system for AI you have not built yet certifies an intention. Build the thing, then govern it.
The honest middle path
Adopt the structure without pursuing the certificate. You get the governance benefit and the documentation, and you can certify later if a customer ever asks. For most mid-market organizations this is the right answer.
Questions
Frequently asked
Can we actually get certified now?
Yes. This is the substantive change from a year ago. ISO/IEC 42006:2025 established the requirements for bodies certifying AI management systems, and accreditation followed — UKAS in January 2026, ANAB in March 2026. If you were previously told accredited certification was not available, that was true when it was said and is not true now.
How does it relate to ISO 27001?
Same management-system architecture, so if you already run ISO 27001 you know the shape and much of the governance scaffolding is reusable. The subject matter differs: 42001 concerns AI-specific risks — data governance for training, impact on affected individuals, transparency, human oversight — rather than information security controls.
Does certification mean we comply with the EU AI Act?
No, and be careful with anyone who implies otherwise. The AI Act imposes obligations that attach to specific systems by risk classification; ISO/IEC 42001 certifies a management system. Certification produces evidence that helps and demonstrates seriousness, but it is not a conformity assessment and does not substitute for one.
How long does it take?
It depends far more on your starting documentation than on the standard. Organizations with a mature ISO 27001 system and a real AI inventory move considerably faster than those starting cold. The readiness assessment will give you a realistic answer for your situation rather than a generic one.
More from AI Governance
Want to know where you actually stand?
We will tell you what is in scope, what an assessor will accept, and what you do not need.