AI management systems

ISO/IEC 42001: requirements for an artificial intelligence management system (AIMS)

The same structure as ISO management systems, applied to AI systems and linked to AI Act obligations.

Let's talkStarting assessment

ISO/IEC 42001 is the first certifiable international standard for an artificial intelligence management system (AIMS). It follows the common structure of ISO management system standards and adds controls specific to the responsible development and use of AI systems.

Who it applies to

  • Organisations that develop, provide or use AI systems, of any size.
  • Organisations that want to demonstrate structured AI governance to customers and partners.
  • Organisations already applying ISO/IEC 27001 that want to integrate the two management systems.

What it requires

  1. 01

    Context and AI policy

    The organisation's roles regarding AI, scope and a policy approved by top management.

  2. 02

    AI risk assessment

    Identification and treatment of risks related to AI systems.

  3. 03

    Impact assessment

    Analysis of the consequences of AI systems on individuals, groups and society.

  4. 04

    System life cycle

    Requirements, development, verification, deployment, monitoring and retirement.

  5. 05

    Data and third parties

    Data quality and provenance, relationships with suppliers and customers.

  6. 06

    Improvement

    Internal audits, management review and corrective actions.

EVIDEVO

How EVIDEVO manages controls and evidence for ISO/IEC 42001

Inventory shared with the AI Act

The same AI system register is used for the AI Act and for the management system.

Requirements shared with ISO/IEC 27001

Shared parts of the two management systems, such as internal audits and management review, are handled once.

Assessments with history

Risks and impacts are dated and linked to the systems they refer to.

Evidence by requirement

Evidence is organised by requirement and by control and is extracted for the certification body's audit.

Data for illustrative purposes only, not real

What can be exported

  • AI system inventory and assessments
  • Evidence by requirement and by control
  • Log of internal audits and reviews

Capabilities for ISO/IEC 42001

How to determine whether ISO/IEC 42001 applies

Sector, size and services define the scope. The starting assessment identifies it and sets the priorities.

Starting assessment

Frameworks that share evidence

Informational summary, updated October 2026. Not legal advice: applicability and obligations should be checked against the official text and the specific case.

A thirty-minute presentation based on the organisation's scope.

It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.

Let's talk