Get Started with your requirements and primary focus, that will help us to make your solution
What the standard asks for, clause by clause, a readiness checklist, and what changes when your AI systems are autonomous agents that act on their own. Then, if you want it, help getting certified.
From XenonStack, trusted on five-year contracts by a leading Indian bank and a Dubai government entity.
ISO/IEC 42001:2023 is the international standard for an AI management system (AIMS). It sets requirements for how an organisation governs the AI it builds, provides or uses: policy, roles, risk and impact assessment, life-cycle controls, monitoring and continual improvement. Organisations can be independently audited and certified against it.
Published in December 2023, it follows the same high-level structure as ISO 27001 and ISO 9001, so teams that already run those systems can extend them rather than start again. It does not certify a model or a product. It certifies the system of management around them.
Enterprise buyers increasingly ask for it in security and procurement reviews.
A recognised way to show regulators structured control over AI-driven decisions.
Evidence of accountable AI for citizen services and national AI programmes.
One management system to govern agents across business units and vendors.
| Dimension | ISO/IEC 42001 | EU AI Act | NIST AI RMF | ISO/IEC 27001 |
|---|---|---|---|---|
| What it is | Management system standard for AI | Law (EU regulation) | Voluntary risk framework | Management system standard for information security |
| Certifiable | Yes, by accredited bodies | Conformity assessment for high-risk systems | No | Yes |
| Scope | How the organisation governs all its AI | Obligations by AI risk category | Govern, map, measure, manage AI risk | Confidentiality, integrity, availability of information |
| Who it binds | Organisations that choose to adopt it | Providers and deployers in or serving the EU | Organisations that choose to use it | Organisations that choose to adopt it |
| How it fits | The operating backbone | An AIMS supports many of its governance duties | Its practices map well onto AIMS controls | Shares the clause structure; extend rather than duplicate |
ISO 42001 certification does not on its own establish EU AI Act compliance. It gives you the management system that makes meeting those obligations repeatable.
Clauses 1–3 cover scope, references and definitions. The auditable requirements start at clause 4.
Your role (developer, provider, user), stakeholders, and the scope of AI systems the AIMS covers.
Top-management commitment, an AI policy, and clear roles and accountability.
AI risk assessment and treatment, AI system impact assessment, objectives, and a Statement of Applicability for Annex A controls.
Resources, competence, awareness, communication and documented information.
Run the planned controls, repeat risk and impact assessments as systems change, and manage the AI life cycle.
Monitoring and measurement, internal audit and management review.
Handle nonconformities, take corrective action and keep improving the system.
Control areas covering AI policies, internal organisation, resources for AI systems, impact assessment, the AI system life cycle, data for AI systems, information for interested parties, responsible use of AI, and third-party and customer relationships. Annexes B–D give implementation guidance, objectives and risk sources, and sector context.
If you can't tick most of these, start with a gap assessment.
Most ISO 42001 programmes were designed around models that recommend. Agents call tools, change records and move money. That raises three questions an auditor will ask.
What may this agent do without a person? Boundaries checked before every action turn your risk treatment into something enforced, not just documented.
Why did it act? A trace of inputs, policy applied and approver for every action is the operational record clauses 8 and 9 need, produced automatically.
How did it earn autonomy? Moving through Shadow, Supervised, Bounded and Full with exit tests gives you documented human oversight at each stage.
Certification is granted by an accredited certification body after a two-stage external audit, followed by surveillance audits during the certificate's validity. Stage durations depend on estate size and existing governance.
Inventory AI and agents, set scope, and measure against every clause and control.
Policy, roles, risk and impact methods, and the Statement of Applicability.
Put controls into operation, including boundaries and traces for agents.
Test the system, close nonconformities, and hold a management review.
Stage 1 and stage 2 audits by your chosen certification body.
A live register of systems, owners, models, data and autonomy levels.
Each agent's boundaries mapped to clauses and Annex A control areas.
Decision traces, approvals and incidents exported as audit-ready records.
New model, new tool or higher autonomy triggers a fresh risk and impact review.
Built on the Elixir platform that governs every agent we deliver through AI agent development, and alongside AgentGRC continuous GRC for governed operations.
AI inventory, scope, and a clause-by-clause gap report with a prioritised plan. Scope and commercial terms are agreed per engagement.
Policies, risk and impact methods, Statement of Applicability, and controls running on AgentGRC.
Internal audit, management review, evidence packs and support through the certification body's audits.
We prepare you for certification. The certificate itself is issued by an independent accredited certification body.
No. It is voluntary, but customers, regulators and procurement teams increasingly use it as evidence of responsible AI governance.
It depends on how many AI systems are in scope and what governance you already have. Organisations with ISO 27001 usually move faster. Timelines are agreed after the gap assessment.
No. They are separate standards, but they share a structure, so an existing ISO 27001 system can be extended for an AIMS.
Not on its own. It supports many governance duties, but the Act has specific legal obligations that need separate mapping and, for high-risk systems, conformity assessment.
Yes. The standard covers organisations that develop, provide or use AI, including models and agents from vendors.
Agents take actions, so you need enforced decision boundaries, a trace of each decision as evidence, and documented human oversight as their autonomy grows.
No. We prepare you and support you through the audit. Certification is issued by an independent, accredited certification body.
We'll inventory your AI and agents, set the scope and show you exactly what stands between you and certification.
AI continuously monitors systems for risks before they escalate. It correlates signals across logs, metrics, and traces. This ensures faster detection, fewer incidents, and stronger reliability
Proactive detection of performance and availability issues
Root-cause analysis across microservices and environments
Automated remediation playbooks to reduce MTTR
AI converts camera feeds into instant situational awareness. It detects unusual motion and unsafe behavior in real time. Long hours of video become searchable and summarized instantly
Real-time detection of suspicious motion or intrusion
Natural language video search and instant playback
Smart summaries for audits, investigations, and compliance
Your data stack becomes intelligent and conversational. Agents surface insights, detect anomalies, and explain trends. Move from dashboards to autonomous, always-on analytics
Connects to warehouses, lakes, and streaming sources
Question-answering in natural language
Continuous monitoring for anomalies and KPI deviations
Agents identify recurring failures and performance issues. They trigger workflows that resolve common problems automatically. Your infrastructure evolves into a self-healing environment
Automated diagnostics for recurring errors
Playbook execution: restart services, scale pods, clear queues
Feedback loop for improving remediation strategies
AI continuously checks controls and compliance posture. It detects misconfigurations and risks before they escalate. Evidence collection becomes automatic and audit-ready
Continuous control checks across infrastructure and SaaS
Automated evidence collection for audits
Risk scoring and prioritized remediation recommendations
Financial and procurement workflows become proactive and insight-driven. Agents monitor spend, vendors, and contracts in real time. Approvals and sourcing decisions become faster and smarter
Real-time visibility into spend and commitments
Anomaly detection on invoices and vendor performance
Intelligent workflows for approvals and sourcing decisions
