ISO 42001

ISO 42001 is an international standard from ISO and IEC titled “AI management systems.” In everyday terms, a management system is the written rules, roles and routines an organization uses to run one area of its work in an orderly way that someone else can check. Organizations can be certified against ISO 42001. You will often see it on an AI vendor’s trust or security page, listed next to ISO 27001 and SOC 2.

Why it matters

Several AI vendors list this certification, so you may come across it when choosing a tool. Treat it as a useful sign, not a guarantee. A certificate shows that an outside auditor looked at how the vendor manages AI. It does not prove that a given tool is safe for your data. Every certificate also has a scope, and that scope may not include the product you plan to use. Before you rely on it, ask the vendor for a copy of the certificate and a list of the services and products it covers. If you are working out your own approach to AI governance, the guide to AI governance frameworks is a good next step.