AI Certification: ISO/IEC 42001 and Related Standards

Key standards at a glance

Most international AI standards come from the ISO/IEC JTC 1/SC 42 committee. Not all of them can be certified. Many serve as guidance or as a shared vocabulary.

ISO/IEC 42001 in detail

ISO/IEC 42001 uses the same Harmonized Structure as ISO 27001 and ISO 9001. Its parts are: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. So it is easy to add to the management systems you already have. The parts that are specific to AI include:

• AI policy and roles: clear goals and duties for building and using AI
• AI risk assessment and impact assessment: rating the risks to the organisation and the impact of AI systems on people and society
• Annex A controls: these cover data quality and origin, the AI system life cycle, information for people affected, responsible use and third parties, among other things
• Statement of applicability: as with ISO 27001, you explain which controls you put in place and which you do not

The standard applies to providers, developers and firms that only use AI. A company that only uses AI will set other priorities than a software vendor.

The certification process

1. Set the scope: Which sites, processes and AI systems should it cover?
2. Gap analysis: Compare where you stand with what the standard asks. Ideally, build on an ISMS you already have.
3. Build the management system: Policies, risk and impact assessment, statement of applicability, training and documents.
4. Internal audit and management review: Proof that the system really runs.
5. Certification audit: An accredited certification body runs a two-stage audit. First it reviews your documents. Then it checks how you put them into practice.
6. Upkeep: A surveillance audit every year and recertification after three years.

If you are already certified to ISO 27001, you can reuse many parts and aim for a combined audit. When you pick a certification body, make sure it is accredited for ISO/IEC 42001.

BSI AIC4 for AI cloud services

Germany's Federal Office for Information Security (BSI) published the AI Cloud Service Compliance Criteria Catalogue (AIC4). It sets criteria for the security of AI services in the cloud. Areas include robustness, data quality, explainability and performance. It builds on the C5 cloud criteria catalogue. A public auditor checks it in an audit. If you buy AI services, an AIC4 attestation is a useful reference point when you compare vendors.

Relationship to the EU AI Act

ISO/IEC 42001 certification is not a conformity assessment under the AI Act. It does not replace one. For high-risk AI systems, Regulation (EU) 2024/1689 requires its own conformity assessment plus CE marking. Depending on the use case, this is done through internal control or with a notified body.

CEN and CENELEC are now drafting harmonised European standards. If you meet them, you will be presumed to conform. An AI management system based on ISO/IEC 42001 still helps a lot. It gives structure to risk management, documents, human oversight and monitoring. The AI Act asks for all of these too.

Who benefits from certification?

• Software vendors and service providers whose customers want proof of responsible AI development
• Firms that use AI in sensitive areas such as HR, lending or healthcare
• Organisations with an ISMS that want to add AI governance with little extra effort

If you only use AI a little, it is often enough to follow the standard without formal certification.

Conclusion

ISO/IEC 42001 is today the main certifiable standard for AI governance. It fits well with ISO 27001. But it does not replace your duties under the AI Act. SecTepe supports gap analyses and helps you build AI management systems, ideally as part of an existing ISMS.

Frequently asked questions

Is ISO/IEC 42001 certification legally required?

No. Certification is voluntary. But customers may ask for it in contracts. It also makes it easier to show that your AI governance is well structured.

How long does it take to get certified?

That depends on company size, scope and the work you have already done. If you have a working ISO 27001 ISMS, the effort is much lower than starting from scratch.