ISO 42001 AIMS Check
How mature is your AI management?
20 questions, 5 categories, 3 minutes. Find out how well your company governs AI systems responsibly — in line with ISO 42001 and the EU AI Act.
How mature is your AI management?
ISO/IEC 42001:2023 is the first international standard for an AI management system (AIMS). It answers the question the EU AI Act has put to many companies: how do I govern AI systematically, instead of improvising afresh in every project? The check above estimates your maturity along the structure of the standard.
What the standard requires
ISO 42001 follows the same harmonised structure as ISO 27001 and ISO 9001. If you know either of those, you will find your way around immediately:
| Part | Content |
|---|---|
| Clauses 4–10 | Context, leadership, planning, support, operation, evaluation, improvement — the management system core |
| Annex A | Controls for the AI context: AI policy, roles, resources, impact assessment, lifecycle, data, information for third parties |
| Annex B | Implementation guidance for the controls — in practice the most useful part |
| Annexes C/D | Objectives and sources of risk, plus guidance on applying the standard across domains and sectors |
The decisive difference from ISO 27001
ISO 27001 protects information. ISO 42001 also asks about the effects on people and society — fairness, transparency, traceability, unintended consequences. That element, the AI System Impact Assessment, has no counterpart in ISO 27001 and is the least familiar part for many.
The most common error of reasoning: "We will certify to ISO 42001, then we are AI Act compliant." It is not that simple. The AI Act is law; ISO 42001 is a voluntary standard. It is an excellent framework for meeting the requirements demonstrably — but it is not automatic.
Who it pays off for
- Providers of AI products — you need risk management, data governance and lifecycle control anyway. A management system brings them together and can be shown to customers.
- Companies with AI in critical processes — HR, credit, medicine, infrastructure: here the AI Act applies as a high-risk category, and the pressure to evidence things is high.
- Suppliers to large groups — AI governance is appearing in supplier questionnaires more and more, much as ISO 27001 did ten years ago.
How to read your result
- Low maturity — AI is in use but not governed. There is no overview of which systems are in the house at all. The first step is always the inventory.
- Medium maturity — individual projects are well documented, but there are no overarching rules, roles or approval routes.
- High maturity — a management system is recognisable. What is left is usually the impact assessment, measuring effectiveness, and internal audit.
The check is a self-assessment and is no substitute for a gap analysis against the standard.
The pragmatic route
Do not build a second management system alongside your ISMS. ISO 42001 shares its structure, document control, internal audit, management review and improvement process entirely with ISO 27001. What makes sense is an integrated system: one set of processes, two standards — plus the AI-specific controls and the impact assessment. In our experience, anyone already running ISO 27001 manages the addition in a fraction of the time.
Common questions about ISO 42001
Can ISO 42001 be certified?
Yes. It is built as a management system standard and can be certified by accredited bodies — just like ISO 27001, with stage 1 and stage 2 audits, surveillance audits and recertification.
Does ISO 42001 make us AI Act compliant automatically?
No. The AI Act is binding law; ISO 42001 is a voluntary standard. It covers many requirements structurally — risk management, data governance, documentation — but replaces neither the conformity assessment for high-risk systems nor the registration.
Do we need ISO 27001 first?
No, it is not a prerequisite. In practice it is the usual and more economical route, because both standards use the same structure and let you share processes, document control and audits.
What is an AI system impact assessment?
A structured assessment of the effects an AI system can have on individuals and groups — beyond the classic view of risk. It covers fairness, freedom from discrimination, traceability and unintended consequences, among other things. It is a core element of the standard.
Is it worth it if we only use AI here and there?
Certification, usually not yet. But an AI inventory, a short AI policy and clear responsibilities pay off from your first production system onwards — if only because of the AI literacy duty in the AI Act.
How long does implementation take?
Without an existing management system, six to twelve months is realistic. With a lived ISMS to ISO 27001 that shortens considerably, because the management system core is already there.
