ISO 42001: AI Management System Steps, Tools and Templates
ISO/IEC 42001 is the management system standard for AI. An organisation that follows it scopes its AI management system (AIMS), assesses AI risks and impacts, applies the Annex A controls that fit, checks they work, and can be certified by an accredited body.
This page orders the work into six steps, each with the PlayCISO tool for it. Last reviewed 12 November 2026. Buy the standard itself from ISO or your national standards body; this page does not reproduce it.
Updated 12 November 2026
1. Scope the AI management system
Decide which AI systems, roles and sites are in. Everything later is judged against the scope.
- AIMS scope builder: Issues, interested parties, AI roles and boundaries, with a draft scope statement.
- ISO 42001 + 27001 planner: What to share or keep separate if you already run ISO 27001.
2. Find the gaps
Compare what you do today with the requirements and Annex A controls.
- Annex A guide: Each control area, what good looks like and the evidence auditors sample.
- Gap assessment lab: Practise mapping findings to control areas and choosing corrective actions.
3. Plan the work and the owners
Turn gaps into a dated plan with named owners, objectives and the people skills you need.
- Project plan template: Phases and tasks from scope to certification.
- RACI template: Who owns each clause and Annex A area.
- Objectives planner: Measurable, owned and dated AI objectives with KPIs.
- Competence matrix: Roles, target levels and training evidence (clauses 7.2 and 7.3).
- Documented information register: The documents and records you need, with owners and reviews (clause 7.5).
4. Decide and evidence the controls
State which Annex A controls apply and why, then collect the proof.
- Statement of Applicability builder: Applicability, status, owner and justification per control area.
- Evidence binder: Which controls need evidence and what to file.
5. Check, correct and review
Prove the system works: internal audit, fix nonconformities, and a management review.
- Internal audit planner: A 12-month risk-based audit programme (clause 9.2).
- Nonconformity tracker: Root cause, corrective actions and effectiveness checks.
- Management review: The inputs and decisions the review must record.
6. Get certified
Pick a certification body and work back from the date; rehearse the audit first.
- Certification countdown: Plan back from your target date through Stage 1 and Stage 2.
- Mock audit: The evidence an auditor samples, in order.
- Stage 2 audit lab: Face a simulated certification auditor over three audit days.
Frequently asked questions
What is ISO 42001?
ISO/IEC 42001:2023 is the international management system standard for artificial intelligence. It sets out how an organisation runs an AI management system (AIMS): scope, policy, risk and impact assessment, controls (listed in Annex A), monitoring, internal audit and continual improvement. Like ISO 27001, it can be certified by an accredited certification body.
What is the difference between ISO 42001 and ISO 27001?
ISO 27001 covers information security; ISO 42001 covers the responsible development and use of AI systems. Both follow the same management system structure, so organisations that already hold ISO 27001 can share policies, internal audit and management review between them. The 42001 and 27001 planner shows what to share, merge or keep separate.
Who needs ISO 42001 certification?
No law requires it on its own. Organisations seek it when customers, procurement teams or regulators ask for evidence that AI is governed, most often AI product companies and organisations deploying AI in regulated work. Decide on demand from your own customers and contracts.
How long does ISO 42001 certification take, and what does it cost?
It depends on scope, how much of a management system you already run, and the certification body. We do not publish a typical figure because none we have seen is sourced. The certification countdown works back from your target date so you can see whether it is realistic, and certification bodies quote the audit cost.
What is the Statement of Applicability?
The document that lists each Annex A control, whether it applies to your scope, why, and its implementation status. Auditors use it to plan what they sample. The SoA builder drafts one.