What it is
ISO/IEC 42001:2023 was published on 18 December 2023 by ISO/IEC JTC 1/SC 42. It “specifies requirements for establishing, implementing, maintaining, and continually improving” an AI management system (AIMS). It is a requirements standard, so organizations can be certified against it; ISO says certification is voluntary and is done by independent certification bodies, not ISO.
Its Annex A sets out reference controls. Secondary sources commonly cite 38 controls; ISO’s own page does not state a number.
Certification in 2025-2026
- ISO/IEC 42006:2025 (July 2025) sets requirements for bodies that audit and certify AI management systems.
- ANAB runs an ISO/IEC 42001 accreditation program referencing 42006.
- BSI announced ANAB accreditation in March 2026, adding to UKAS and RvA.
- ISO’s page shows no amendment or revision of 42001 in progress.
Japan’s Article 13 AI guideline also references ISO/IEC 42001 for lifecycle AI governance.
Licence terms: why “separate permission required”
ISO’s licence agreement (updated 29 May 2026) says the licensee “is not permitted to access, use, or process the ISO Publication for or related to any machine learning” or generative AI uses unless “expressly authorized under a separate licence agreement issued by ISO”. Earlier wording we reviewed in this series also named “embedding, prompting, querying, comparing”. ISO “expressly opts out of the text-and-data-mining exception under Article 4 of Directive (EU) 2019/790”, and its site states that no ISO content may be used for machine learning or AI, apart from ISO Open Data.
Working with ISO/IEC 42001 and AI
- Keep the standard’s text out of AI tools and RAG indexes unless you hold an AI-permitted licence.
- Write your own AIMS documents (policy, risk process, controls) and analyze those.
- Reference clause numbers, not text, in prompts and indexes.
- Map 42001 to openly reusable frameworks such as the NIST AI RMF for AI-assisted analysis.
- Ask ISO or your national body about AI-permitted licences in writing.
Common mistakes
- Pasting clauses into an AI assistant “just to check”.
- Assuming a private, on-premises model avoids the licence restriction.
- Relying on statutory TDM exceptions that ISO has opted out of.
- Citing “38 controls” as an official ISO figure.
Checklist
- ISO text excluded from AI indexes unless licensed
- Own AIMS documents used for analysis
- Clause numbers referenced instead of text
- Certification body accreditation checked
- Licence inquiries documented
How AskDona helps
AskDona analyzes your own AIMS documentation and maps it to clause numbers and to openly reusable frameworks, without your team loading licensed ISO text.
Run a sample AIMS readiness check on your own documents
AskDona shows the evidence; your AI governance team decides.
Editor’s note. This article is general information, not legal advice. The “separate permission required” rating comes from our source list and is a first-pass judgment, not a legal opinion. Confirm licence terms with ISO.
FAQ
Is ISO/IEC 42001 certifiable? Yes. Certification is voluntary and done by independent certification bodies.
What is ISO/IEC 42006? A 2025 standard setting requirements for bodies that certify AI management systems.
Can I upload ISO/IEC 42001 to an AI tool? Not under a standard ISO licence; AI use needs separate permission.
Is a revision planned? ISO’s page shows none in progress as of October 2026.
References
All pages opened and checked by October 26, 2026.
| Source | What it supports |
|---|---|
| ISO: ISO/IEC 42001:2023 | Date, scope, no revision listed |
| ISO: ISO/IEC 42001 explained | Voluntary certification |
| ISO: ISO/IEC 42006:2025 | Certification body requirements |
| ANAB: ISO/IEC 42001 accreditation | Accreditation program |
| BSI: ANAB accreditation (Mar 2026) | Certification uptake |
| ISO: Licence agreement | AI and TDM restrictions |