Do you need ISO 42001 certification?

ISO 42001 certification is voluntary, so whether you need it depends on your customers and on how far your AI governance has come, not on a legal deadline. A standard is not a law: it describes a way of organising work, while laws such as the EU AI Act set requirements that apply whether or not you hold a certificate.

What ISO 42001 is

Voluntary standard. ISO/IEC 42001:2023, usually shortened to ISO 42001, is a standard for an AI management system: the policies, roles, processes and regular reviews an organisation uses to govern its AI. It can be certified, which means an independent certification body audits the organisation against the standard and issues a certificate if it conforms.

Certification shows customers and partners that AI is managed in a structured, audited way, and the discipline it requires can make work on legal requirements easier. It does not guarantee full compliance with the AI Act, GDPR or any other law. A certified company still has to check each legal obligation that applies to its AI.

How it compares with other frameworks

• ISO/IEC 23894:2023 gives guidance on AI risk management (ISO/IEC 23894:2023). It is useful for the risk side of the work whether or not you pursue certification.
• NIST AI RMF 1.0, the AI Risk Management Framework from the US National Institute of Standards and Technology, is a voluntary framework (NIST AI RMF). Its Generative AI Profile (NIST AI 600-1) applies it to generative AI.
• Harmonised standards under the AI Act are European standards being developed by the CEN-CENELEC Joint Technical Committee 21 (JTC 21) to support the Act’s requirements. They are still in progress.

All of these are voluntary. None of them replaces the legal requirements, and choosing one does not oblige you to adopt the others.

When ISO 42001 certification makes sense

Certification is worth considering when:

• customers or partners ask for it in contracts or supplier questionnaires;
• tenders you want to bid for require it or award points for it;
• you build AI into products sold to larger organisations and are repeatedly asked to prove how you govern it;
• you already run documented AI processes and want an external check of them.

It is probably too early when:

• nobody has asked for it;
• you do not yet have an AI inventory, an AI use policy or a named person responsible for AI;
• preparing for the audit would take time and money away from that basic work.

Hypothetical example: a 12-person agency that uses AI tools for copywriting receives its first supplier questionnaire from a large client. The client asks how AI risks are managed but does not require certification. For now, the agency answers with its inventory, policy and review process, and plans to reconsider certification if tenders start asking for it.

Recommendation. Even if certification is too early, a framework is still useful as a structure. It shows what a mature approach covers and where your gaps are.

Next step: take one framework, either ISO 42001 or the NIST AI RMF, and compare what you have already done against it: inventory, policy, assessments, responsibilities and reviews. Write down the three largest gaps.

Sources and further reading

• ISO/IEC 42001:2023
• ISO/IEC 23894:2023
• NIST AI Risk Management Framework
• NIST AI 600-1, Generative AI Profile