Scope
Which AI activities, teams and locations does the system cover?
ISO/IEC 42001 guide
ISO 42001 is less about the certificate and more about the habit behind it.
The standard gives your organisation a shared way to run AI: who decides, how risk is judged, which controls exist and how you learn from what goes wrong. This guide shows how to build that rhythm, step by step.
A management system answers five questions your leadership will eventually ask.
Leadership
Who sets the policy, provides resources and is accountable?
Risk
How do you assess impact, and what happens when something changes?
Controls
Which safeguards are designed, tested and kept up to date?
Improvement
How do incidents and reviews feed back into the system?
Build it in four moves, starting small and growing the scope.
- 01
Pick a first scope
Choose one business unit or a handful of AI systems that matter. A narrow, real scope beats a broad, vague one.
- 02
Name the owners
Give each system a business owner and a technical owner, and set a regular review with leadership.
- 03
Assess and control
Record risks and impacts, then choose proportionate controls for oversight, data, suppliers and change.
- 04
Review and improve
Run an internal review, fix what it finds, and widen the scope when the first one is steady.
Certification is an independent step, and being ready makes it calmer.
Certification is carried out by accredited third-party bodies, who will want to see a working system with evidence of operation, not only a set of policies. The usual path is a readiness review, closing the gaps, an internal audit and then the external assessment.
Want to get your evidence in order first? See AI audit readiness.
The operating system
One place where the standard's requirements meet your real documents.
Alive Assist maps your policies, records and reports to the management-system requirements, shows which are covered and which are open, and keeps every finding traceable to its source. Alive Standards give your team a common reference for what good looks like.
Who can execute, from first scope to review.
Your leadership sets the mandate, and your product, risk, legal and procurement teams supply the evidence. We help with the rest.
Find your starting point
A short assessment that shows the next owner, control or piece of evidence to tackle.
Take the assessmentBring in a specialist
Match your implementation mandate to a vetted specialist and interview before you decide.
Meet matched specialistsTurn gaps into delivery
Convert prioritised findings into scoped work with owners and timing.
See implementation supportQuestions people ask us about ISO 42001
What is ISO/IEC 42001?
It is an international standard for an AI management system. It sets out how an organisation can govern its use and development of AI through scope, leadership, risk, controls, evidence and continual improvement.
Is ISO 42001 mandatory?
No, it is voluntary. Customers, partners and regulators may still value it, because it shows that AI is managed as an ongoing process rather than a one-off project.
Does ISO 42001 certification mean we comply with the EU AI Act?
No. The standard and the Act are different instruments. A management system can hold the owners, controls and evidence that help you answer the Act, but legal compliance depends on your role and systems.
Who certifies an organisation against ISO 42001?
Accredited third-party certification bodies. Alive supports readiness, gap analysis and implementation, and does not issue certificates.
Sources behind this guide
- ISO/IEC 42001:2023 AI management systemChecked 2026-10-21
International Organization for Standardization · Standards body
Use for management-system structure and implementation framing, not certification claims.
Inside Alive Assist
Nine layers in every report, one structure across EU AI Act, ISO/IEC 42001 and NIST
Each assessment opens as a summary and goes down layer by layer: requirement coverage, gaps with their sources, prioritised actions, a control matrix, a risk register, evidence confidence, exposure scenarios and a board decision pack. Because the structure is identical for every framework, results line up side by side.
AI management system
ISO/IEC 42001 control mapping
24%
readiness in this sample run
Reflects the evidence supplied, so it rises as gaps are closed.
The nine layers
- Executive summary
- Requirement coverage
- Gap analysis with sources
- Prioritised actionsShown
- Control matrix
- Risk register
- Evidence confidence
- Exposure scenarios
- Board decision pack
Prioritised actions, layer by layer. Open prioritised actions and the work is ordered by clause: control the AI lifecycle including third parties (Cl. 8), approve an AI policy (Cl. 5) and run an AI risk and impact assessment (Cl. 6) rank High; scope, competence, audit and corrective actions follow.
Screens are from Alive Assist sample runs. Readiness reflects the evidence supplied in that run and is not an assessment of any organisation. Alive does not give legal advice or certify compliance.
Continue with the connected guides
- Business resilienceThe outcome first: see your position, find vulnerabilities and act in order.Read the guide
- EU AI Act guideFind your role, classify risk and plan AI literacy.Read the guide
- AI governance operating modelOne system for the Act, the standard and your own policies.Read the guide
- AI audit readinessOrganise evidence for an internal check or an independent assessor.Read the guide
- AI governance maturity assessmentCheck where you stand and what to do first.Read the guide
- Ten enterprise casesHow legal, compliance and procurement teams could structure one evidence trail across Hydrogen Map, Assist and Ace.Read the guide