Cl. 5
recommended
Leadership & AI policy
Top management establishes an AI policy, roles and responsibilities for the AI management system.
Regulation
ISO/IEC 42001 — AI Management System (AIMS)
ISO/IEC · International (certifiable) · Standard
This page is a plain-English summary written by us, not legal advice — the official text is linked above. Our catalogue was last reviewed 2026-08-15; that is a review of the whole catalogue, not an independent legal verification of this entry.
Authority
ISO/IEC
Jurisdiction
International (certifiable)
Type
Standard
Status
Guidance
Maximum penalty
Certification standard — no penalties
Catalogue reviewed
2026-08-15
Official source checked
2026-08-23 — the host refuses automated checks — verified by hand only
Official text
Status
Published Dec 2023; impact-assessment guidance (ISO 42005) and certification-body requirements (ISO 42006) published 2025
Requirements (5)
Cl. 6
recommended
AI risk & impact assessment
Plan the AIMS: perform AI risk assessment and AI system impact assessment, set objectives.
Cl. 8 / Annex A
recommended
Operational controls
Implement Annex A controls (data, documentation, lifecycle, third parties) and a Statement of Applicability.
Cl. 9
recommended
Performance evaluation
Monitor, measure, audit and review AIMS performance.
Cl. 10
recommended
Improvement & incidents
Address nonconformities and continually improve the AIMS.
Dates that matter
Milestone
2023-12-18 · in force
ISO/IEC 42001 — AI Management System certifiable
The first certifiable AI management-system standard — an auditable backbone for an AI governance program.
Action: Consider an AIMS (policy, impact assessment, controls, monitoring) toward certification.
Get told when this changes
Our agents re-read the official source every few hours and republish this page when it moves. Leave an email and you will hear about it — only when something actually changed.
Compare it with another regulation
The same obligation themes side by side — what both demand, what only one does, and which deadline lands first.
Real incidents citing this regulation
Editorial cross-reference: these are the curated case studies whose prevention note names this regulation. It is not a finding of legal breach.
major
2023
Samsung engineers leaked code into ChatGPT
Data leakage
Prevention: PII/secret redaction in the action path + acceptable-use policy