Skip to content
2026 pilot: one company at a time
The Ark of ISOFrom zero to certified
ISO/IEC 42001 · Artificial intelligence

If your company uses AI, it already has something to govern.

The world's first certifiable artificial intelligence management system. It applies whether you develop models or only use third-party AI.

start with the AI system inventory
Reserve my seat See how the work looks inside
What is specific to this standard
  • Your role towards each AI system: you develop it, provide it or use it
  • AI system inventory, including AI embedded in purchased software
  • Clause 6.1.4: impact assessment on people and society (ISO/IEC 42005 guidance)
  • Annex A: 38 controls in 9 domains, different from those of 27001

Clauses 4 to 10 are the same across the four standards; this is what goes on top.

Where the standard stands today.

Status of the standard · October 2026

Editions and related documents with their status
DocumentStatusWhat it means
ISO/IEC 42001:2023Current and certifiableFirst edition and only auditable version. The world's first AI management system.
ISO/IEC 42005:2025GuidanceGuidance for the AI system impact assessment required by clause 6.1.4.
ISO/IEC 42006:2025GuidanceRequirements for bodies that certify an AIMS.
EN ISO/IEC 42001:2026European adoptionThe same 2023 text adopted as a European standard; it is not a revision.

It also applies if you only use third-party AI

Field note

The underlying misunderstanding is believing ISO 42001 is for those who train models. The first step is identifying your role towards each AI system (you develop it, provide it or use it) and the controls change radically with the answer.

A company consuming a third party's language model does not manage the same things as the one training it, but it does have obligations: responsible use, information to interested parties and supplier management. And it needs something almost nobody has: an inventory of AI systems, including the AI embedded in software it already bought without noticing.

The requirement that exists in no other standard

Clause 6.1.4, AI system impact assessment, has no equivalent in 9001, 27001 or 27701. And it is constantly confused with the risk assessment of 6.1.2. They are two different exercises and both are mandatory: 6.1.2 looks at what can go wrong for the organization; 6.1.4 looks at the consequences the system has for people, groups and society.

That second exercise is the one an auditor will scrutinize, because it is the standard's reason for being. The guidance for it is ISO/IEC 42005:2025.

Certifying is not complying with the EU AI Act

Worth being clear on before investing. ISO 42001 helps you comply with the European AI regulation, but it is not a harmonized standard and gives no presumption of conformity. The AI Act has its own obligations (prohibitions, high-risk regime, transparency duties) with fines of up to 35 million euros or 7% of global turnover.

And do not copy your ISO 27001 Statement of Applicability: the 38 Annex A controls of 42001 are spread across 9 domains and are about artificial intelligence, not information security.

With The Ark of ISO

What this work looks like inside.

  1. Map your context

    Processes, scope and whatever you already have written. Half-finished documents are reused, not discarded.

  2. Measure the gap

    Requirement by requirement of ISO/IEC 42001, with four states: compliant, in progress, gap, observation.

  3. Draft and approve

    Every document is born as a draft. A person approves it and the approval is recorded, as clause 7.5 requires.

  4. Rehearse the audit

    Stage 1 and Stage 2 rehearsals with findings written with criterion, evidence and statement, the way an auditor writes them.

The Ark of ISO's requirement catalogue uses its own curated interpretation of each clause. It never reproduces the literal text of the standard, which belongs to ISO and ICONTEC: to implement you need your licensed copy.

Frequently asked questions

Is it useful for an SME or only for big tech?
It is useful for any organization using AI in decisions that affect people: hiring, scoring, automated customer service, case prioritization. Size does not define scope; use does.
What is the AI system inventory?
The catalogue of all the AI your organization uses, including the AI embedded in third-party software. Without that inventory there is no defensible scope, no risks and no Statement of Applicability.
Can it be integrated with ISO 27001?
It is the natural pair. They share clauses 4 to 10 and the Statement of Applicability mechanism, so the management system is one with two different control catalogues.
How many controls does it have?
38 controls grouped in 9 domains: policies, internal organization, resources, impacts, life cycle, data, information to interested parties, use and third parties.

Same base, different catalogue.

All four share clauses 4 to 10. You document the base once and each standard's catalogue goes on top.

ISO 9001QualityISO/IEC 27001Information securityISO/IEC 27701Privacy

Next on the route, on the same base: ISO 14001, ISO 45001, ISO 37001 and ISO 22301. Adding them does not mean rebuilding the system.

Ready to set sail?

The 2026 pilot onboards one company at a time. Leave your email and we will write when your seat opens.

Reserve my seatSee how it works