ISO/IEC 42001 readiness
Get ISO/IEC 42001 ready with an AI management system that runs
ISO/IEC 42001 asks for an AI management system that is established, implemented, maintained, and improved. Readiness means it already runs, with records that show it.
Sentient prepares the ownership, controls, risk and impact assessments, audit and review cycles, and evidence an AI management system depends on.
01
- Plan
- Do
- Check
- Act
What ISO/IEC 42001 is
A certifiable standard for AI management systems.
ISO/IEC 42001:2023, published by ISO and IEC in December 2023, sets requirements for establishing, implementing, maintaining, and continually improving an AI management system (AIMS). It applies to organizations of any size that provide or use AI-based products or services.
It is a management system standard with the same clause structure as ISO/IEC 27001 for information security. It follows a Plan-Do-Check-Act cycle and governs how the organization manages AI, rather than how each AI system is built.
Certification is voluntary. ISO does not certify organizations. Independent certification bodies do, and national accreditation bodies may accredit them. ISO/IEC 42006 sets requirements for bodies that audit and certify AI management systems.
Sources
- ISO/IEC 42001:2023, edition 1. December 2023.
- ISO, ISO/IEC 42001 explained. Checked October 2026.
- ISO/IEC 42005, AI system impact assessment.
- ISO/IEC 42006, requirements for AIMS certification bodies.
02
- Document
- Record
Where readiness stalls
Documents describe a system. Records prove it runs.
Many ISO 42001 implementation efforts start with a policy set. Assessors and enterprise buyers look for evidence that the system operates.
What the document set says
What a ready AIMS shows
What the document set says
We have an AI policy.
What a ready AIMS shows
An AI policy approved by top management, communicated, and reflected in how systems are approved and changed.
What the document set says
AI risks are assessed.
What a ready AIMS shows
A repeatable AI risk assessment and treatment process, with results recorded per system and revisited when systems change.
What the document set says
We consider impacts.
What a ready AIMS shows
AI system impact assessments for affected individuals and groups, completed before deployment and updated with the system.
What the document set says
Controls are in place.
What a ready AIMS shows
A Statement of Applicability that justifies each Annex A control included or excluded, linked to evidence that it operates.
What the document set says
Leadership oversees AI.
What a ready AIMS shows
Management review records with inputs, decisions, and actions, held at planned intervals.
03
- Scope
- Lead
- Plan
- Check
Readiness, clause by clause
What an AIMS needs before an assessor arrives.
Clauses 4 to 10 set the management system requirements. Readiness means each one has an owner, a process, and records.
01
Context and scope
Clause 4
Define which AI systems, teams, and locations are in scope, the roles your organization plays with those systems, such as provider, producer, or customer, and what interested parties expect.
02
Leadership and AI policy
Clause 5
Top management commitment, an AI policy, and assigned roles, responsibilities, and authorities for the management system.
03
Risk, treatment, and impact assessment
Clauses 6 and 8
An AI risk assessment and treatment process, AI system impact assessments, AI objectives, and a Statement of Applicability. ISO/IEC 42005 gives guidance on impact assessment.
- AI risk assessment
- Risk treatment
- Impact assessment
- Statement of Applicability
04
Support and documented information
Clause 7
Resources, competence, awareness, communication, and controlled documents, kept current as people and systems change.
05
Internal audit and management review
Clause 9
Monitoring and measurement, an internal audit program, and management review at planned intervals, with results retained.
06
Improvement and corrective action
Clause 10
Nonconformities found, corrected, and traced to their cause, with the management system improved over time.
04
- Select
- Operate
- Evidence
Annex A and operating records
Controls your teams operate, with evidence attached.
Annex A lists reference control objectives and controls. They cover areas including AI policy, internal organization, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems, and third-party relationships.
Sentient builds the controls you select into the tools, workflows, and processes teams already use, so approvals, evidence, and review come from doing the work rather than from extra tasks.
01
AI system inventory
Every in-scope system with its owner, purpose, data, vendors, and life cycle stage.
Systems and dependencies
02
Ownership and authority
Named owners and approval thresholds for deployment, material change, and retirement.
Roles and decision rights
03
Human oversight
Review points where a person can intervene, with each decision recorded.
Human review
04
Change management
Changes to models, data, prompts, vendors, or permissions trigger risk and impact review.
AI life cycle control
05
Third-party relationships
Supplier and customer responsibilities defined and checked, for AI you buy and AI you provide.
AI vendor risk
06
Evidence records
Records produced as controls operate, ready for internal audit, management review, and an external assessor.
Audit evidence
Sentient defines the governance architecture. Your platforms enforce the runtime controls. Sentient is not the enforcement platform or an identity and access management vendor.
05
- Assess
- Design
- Operate
- Prepare
How Sentient prepares you
Readiness for certification or independent review.
Sentient does not audit, certify, or manufacture assurance. It builds the management system your team runs and the evidence an independent assessor will examine.
01
Gap assessment
Readiness review
Compare current practice with clauses 4 to 10 and Annex A, and rank the gaps by effort and exposure.
02
Design the AIMS
Governance architecture
Set scope, ownership, decision rights, risk and impact methods, and the Statement of Applicability. AI governance consulting covers these decisions.
03
Implement and operate
Governance implementation
Put records, controls, and the review cadence into operation with the teams that own each system, and run them long enough to produce evidence.
04
Prepare for assessment
Independent review
Support your internal audit program and management review, close findings, and prepare for the certification body you choose. Internal auditors must be objective and impartial, so your own auditors or an independent party perform the audit.
06
- Question
- Answer
Questions, answered
ISO/IEC 42001 questions buyers ask.
What does ISO 42001 readiness involve?
It means your AI management system already operates before assessment. Scope is defined, owners are assigned, AI risk and impact assessments are done, Annex A controls are selected in a Statement of Applicability, and records show that internal audit and management review have run.
AI governance implementationCan Sentient certify us to ISO 42001?
No. Sentient is not a certification body and does not audit, certify, or manufacture assurance. Certification comes from an independent certification body, ideally one accredited by a national accreditation body. Sentient prepares the management system and evidence that body will examine.
AI diligence and assurance readinessIs ISO/IEC 42001 certification mandatory?
No. ISO states that certification is voluntary. Companies pursue it when customers, partners, or enterprise procurement want independent confirmation of how AI is managed. Whether a law or contract requires it is a question for your counsel.
How does ISO/IEC 42001 relate to the NIST AI RMF?
ISO/IEC 42001 is a certifiable management system standard. The NIST AI RMF is a voluntary risk framework with no certification. NIST publishes a crosswalk between the two, and one set of operating records can support both.
NIST AI RMF implementationDoes ISO/IEC 42001 satisfy the EU AI Act?
Not by itself. EU AI Act obligations are legal requirements that depend on your role and each system's risk category. An AI management system can organize many of the records those obligations rely on, but it does not replace a legal assessment, and Sentient does not give legal advice.
EU AI Act readiness
07
- Discuss
- Design
- Implement
- Operate
Be ready before they ask
Build the operating structure before the next customer, investor, insurer, partner, or buyer demands proof.
Sentient builds the governance structure companies need to show how AI is owned, controlled, reviewed, evidenced, and operated. Talk to Sentient about what your customers, investors, insurers, partners, or buyers will expect to see.