AI GOVERNANCE
What Is ISO/IEC 42001? The AI Management System Standard Explained
ISO/IEC 42001 explained simply: what an AI management system is, how the standard relates to AI Verify and the NIST AI RMF, and what certification means.
Correct as at 8 November 2026
ISO/IEC 42001 is the international standard for an AI management system: the policies, roles, risk processes and controls an organisation uses to govern AI and improve over time. It is published by ISO and IEC. Singapore's AI Verify framework is mapped to it, which helps organisations see where their existing practice already overlaps.
Key takeaways
- ISO/IEC 42001 sets out how an organisation runs an AI management system, not how a single model should behave
- A management system joins policy, roles, risk assessment, controls, monitoring and improvement into one cycle
- The AI Verify Testing Framework is mapped to ISO/IEC 42001:2023, so AI Verify evidence can feed a 42001 gap review
- Read the standard itself from an official source before claiming to follow it
- Using a standard and being certified against it are different things, so word any public claim carefully
What is ISO/IEC 42001?
ISO/IEC 42001 is a management system standard for artificial intelligence (AI). It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organisation. Singapore's own resources refer to it directly: IMDA calls it the standard on AI Management Systems, and the AI Verify framework is mapped to the 2023 edition.
The AI Verify Foundation's framework page describes ISO/IEC 42001:2023 as a first-of-its-kind international standard aimed at broad, responsible adoption of AI, sitting within a family of AI standards being developed by the committee ISO/IEC JTC 1/SC 42.
Two points help newcomers place it:
- It is about the organisation. The standard looks at how decisions about AI are made, recorded and reviewed across the organisation.
- It complements testing. Technical tests check what an AI system does. A management system decides which tests are needed, who runs them and what happens with the results.
This guide summarises the standard in general terms only. The full text is sold by national standards bodies, such as the National Standards Authority of Ireland (NSAI), so read it from an official source before you rely on any detail.
How does an AI management system work?
An AI management system works as a repeating cycle. You set a policy and objectives, name who is responsible, assess risks, put controls in place, check whether they work and improve what does not. The value comes from joining these steps up, so the same questions are asked of every AI use and the answers are written down.
The building blocks below describe a management system in plain terms. They are not the clause structure of the standard, which you should read in the standard itself.
| Building block | What it means in practice | Singapore or international resource that can help |
|---|---|---|
| Policy and objectives | A written statement of how the organisation will use AI and what it wants to achieve | An AI use policy for staff |
| Roles and responsibilities | Named owners for approving, running and reviewing each AI use | AI Verify accountability process checks |
| Risk assessment | A consistent way to find and rate risks before and during use | IMDA Starter Kit, NIST AI RMF |
| Controls | The safeguards chosen to reduce each risk, such as human review or access limits | IMDA Model AI Governance Framework for Generative AI |
| Monitoring and testing | Checks that the controls work and the system still behaves as expected | IMDA Starter Kit, Project Moonshot |
| Review and improvement | Regular reviews that fix gaps and record what changed | AI Verify evidence records |
IMDA's Starter Kit for Testing LLM-Based Applications says its guidance is aligned with ISO/IEC 42001, particularly the reference controls in section A.6. That gives a practical link between a management system on paper and the testing that proves controls work. A structured AI risk assessment sits at the centre of this cycle.
How does ISO/IEC 42001 compare with AI Verify and the NIST AI RMF?
The three serve different purposes and work well together. ISO/IEC 42001 is an international management system standard. AI Verify is Singapore's testing framework and toolkit, with process checks under 11 governance principles. The NIST AI Risk Management Framework is a US government framework for managing AI risk, intended for voluntary use.
| Question | ISO/IEC 42001 | AI Verify Testing Framework | NIST AI RMF |
|---|---|---|---|
| Who publishes it? | ISO and IEC | AI Verify Foundation, a not-for-profit subsidiary of IMDA | US National Institute of Standards and Technology |
| What kind of document is it? | Management system standard | Process checklist with outcomes and evidence, plus open-source testing tools | Risk management framework with a companion playbook |
| How is it organised? | Requirements for the management system and reference controls | 11 principles, each with outcomes, processes and evidence | Four functions: Govern, Map, Measure, Manage |
| How do they connect? | Mapped to AI Verify in July 2025 | Mapped to ISO/IEC 42001 and to the NIST AI RMF | Mapped to AI Verify in October 2023 |
NIST released its framework on 26 January 2023 and states on its website that version 1.0 is being revised. Its definition of risk combines the probability of an event and the size of its consequences. The AI Verify framework page lists both mappings, and the process checks show which items connect to the NIST framework and to ISO 42001.
In Singapore, IMDA's Model AI Governance Framework for Generative AI adds nine dimensions, from accountability and data to testing, security and incident reporting. These help you decide what your management system should cover.
What does certification mean?
Certification means an independent body has audited an organisation's management system against the standard and confirmed that it meets the requirements. ISO develops and publishes standards but does not provide certification or conformity assessment itself; that is done by other bodies. Using the standard as a guide and holding a certificate are two different things.
Keep the distinction clear in anything you publish:
- Using the standard as a guide. You read it and shape your AI governance around it. This makes no claim about an audit.
- Being certified. An independent certification body has audited your management system. Only an organisation that holds a valid certificate should say this.
AI Verify works differently. Its framework page presents it as a way to assess and document responsible AI practice. Its separate AI Tester Accreditation Programme accredits firms that provide AI testing services; it does not certify an organisation's management system.
This guide describes the standard for general understanding. It makes no statement about the certification status of any organisation.
What might ISO/IEC 42001 look like in a Singapore workplace?
Imagine a small software firm at one-north that builds a document search tool using retrieval-augmented generation (RAG). A corporate client's tender asks whether the firm follows ISO/IEC 42001. The founder wants to answer honestly and decide whether the standard is worth working towards.
This is an illustrative scenario, not a real case. A sensible approach would be to:
- answer the tender truthfully: the firm is reviewing the standard and does not hold a certificate
- obtain the standard from an official source and read it with the person who would own AI governance
- work through the AI Verify process checklist, noting the items that show an ISO 42001 reference
- list what already exists, such as a test log or a named approver, and what is missing, such as a written AI policy
- use IMDA's Starter Kit to plan tests for hallucination and data leakage, the risks the client is most likely to ask about
- decide, after the gap review, whether formal certification is worth pursuing for this client base
The output is a short gap list and an honest answer, which is more useful to the client than a vague claim.
Common mistakes
The most common mistakes with ISO/IEC 42001 come from treating it as a label rather than a way of running things. Organisations claim alignment they have not checked, rely on second-hand summaries instead of the standard, or treat AI governance as a task for IT alone. Each one weakens trust when a client or auditor asks for evidence.
- Loose claims. "Aligned with ISO 42001" invites questions. Say exactly what you have done, and never imply certification you do not hold.
- Working from summaries. Guides like this one help you start, but the requirements are in the standard. Read it from an official source.
- Copying standard text. Summarise the standard in your own words in internal documents and follow the licence terms of the copy you obtain.
- Treating mapping as equivalence. A crosswalk shows where two frameworks overlap. It does not mean completing one completes the other.
- Leaving it to IT. Policy, roles and review involve managers, HR and whoever handles data protection, not only technical staff.
What to learn next
ISO/IEC 42001 is easier to approach once the basics are in place: a written policy, named owners and a repeatable risk assessment. The guides below cover each one with Singapore sources, so you can build a working foundation first and decide later whether the full standard suits your organisation.
- Start with what AI governance is and how organisations begin.
- See how Singapore's testing framework works in what AI Verify is and who it is for.
- Draft the policy layer with how to write an AI use policy, which includes a template.
- Browse the AI governance category or return to the AI learning pathway.
Sources
- ISO/IEC 42001:2023 Information technology: Artificial intelligence: Management system, Standards Council of Canada (SCC), accessed 8 November 2026
- Does ISO carry out certification?, ISO Help Centre, accessed 8 November 2026
- ISO/IEC 42001:2023 Standard, National Standards Authority of Ireland (NSAI), accessed 8 November 2026
- What is AI Verify Testing Framework, AI Verify Foundation, accessed 8 November 2026
- About us, AI Verify Foundation, accessed 8 November 2026
- FAQ, AI Verify Foundation, accessed 8 November 2026
- Project Moonshot, AI Verify Foundation, accessed 8 November 2026
- Starter Kit for Testing LLM-Based Applications for Safety and Reliability, Infocomm Media Development Authority (IMDA), accessed 8 November 2026
- MGF for GenAI, AI Verify Foundation, accessed 8 November 2026
- AI Risk Management Framework, National Institute of Standards and Technology (NIST), accessed 8 November 2026
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), National Institute of Standards and Technology (NIST), accessed 8 November 2026
Frequently asked questions
What is ISO/IEC 42001?
ISO/IEC 42001 is the international standard for an AI management system. It sets out how an organisation governs its use of AI through policies, roles, risk processes and controls, and how it improves them over time. It is about the organisation's system of management, not the behaviour of one model.
What is an AI management system?
It is the joined-up set of policies, responsibilities, processes and records an organisation uses to run its AI work consistently. It usually covers an AI policy, named roles, risk assessment, controls, monitoring and regular review, so problems are found and fixed rather than repeated.
How does ISO/IEC 42001 relate to AI Verify?
The AI Verify Foundation has published a mapping between the AI Verify Testing Framework and ISO/IEC 42001:2023, dated 21 July 2025. The framework's process checks show references to ISO 42001, which helps organisations see where AI Verify evidence overlaps with the standard.
How is ISO/IEC 42001 different from the NIST AI RMF?
ISO/IEC 42001 is an international management system standard. The NIST AI RMF is a framework from a US government agency, intended for voluntary use, built around four functions: Govern, Map, Measure and Manage. Both deal with AI risk, but they are different kinds of document.
Can I quote the text of ISO/IEC 42001?
The full text is a published standard, so obtain it from an official source and follow its licence terms. Summaries like this guide describe the standard in general terms only and are not a substitute for reading it.
Does following ISO/IEC 42001 mean an organisation is certified?
No. Using the standard to shape your management system and being certified against it are different things. Certification is a separate formal process, so any public claim should say exactly which one applies.
Explore the next step
Read what AI Verify is View the GenAI Builder Sprint courseGuides provide general information; course-specific requirements and funding should be checked against the approved records before enrolment.
RELATED POSTS
Keep reading.
START HERE
Interested in practical AI training?
GenAI Builder Sprint covers model configuration, evaluation and simple application development. Check whether the programme suits your goals.
