ISO 42001 explained: what the AI management standard requires
ISO/IEC 42001:2023 is a certifiable management-system standard for the organization that provides or uses AI. It asks you to set up, run and improve an AI management system. It does not certify one AI product, and the public sources we could read do not show a named red team or pentest requirement. Testing is one topic of its Annex A controls.
ISO/IEC 42001:2023 is the international standard for an AI management system, called an AIMS. It tells an organization how to govern the AI it builds or uses. It does not describe technical tests. This page covers what the standard is, who asks for it, how its parts fit together and where test evidence can support an audit. It is not legal advice, and the standard text itself is paid, so we mark what we could and could not read.
What is ISO/IEC 42001?#
ISO/IEC 42001 is a management-system standard for artificial intelligence. The IEC Webstore lists it as "Information technology - Artificial intelligence - Management system", edition 1.0, published 2023-12-18, 51 pages, from committee ISO/IEC JTC 1/SC 42 (IEC Webstore).
The scope sentence reads: "This document specifies the requirements and provides guidance for establishing, implementing, maintaining and continually improving an AI (artificial intelligence) management system within the context of an organization." It applies to organizations that provide or use AI products or services.
A management system is the set of policies, roles, processes and records an organization uses to run a topic. ISO 27001 does this for information security. ISO 42001 does it for AI. A certification body audits the system. It does not audit one model.
Who needs ISO 42001 and who asks for it?#
No law makes ISO 42001 mandatory. The people who ask for it are buyers, partners and internal compliance leads. A typical request is a line in a vendor security questionnaire: "Do you hold ISO 42001, or do you follow an equivalent AI governance framework?"
| Situation | What usually happens |
|---|---|
| Enterprise buyer lists 42001 in a vendor form | You answer yes, no or "in progress", and describe equivalent controls |
| You sell AI features to regulated customers | Buyer asks for governance evidence, and a certificate is one way to give it |
| You build a model or an agent product | You may use the standard as a checklist without certifying |
| You only use third-party AI tools | The standard still applies to use of AI, so it can be in scope |
Before you start a certification project, ask the buyer which evidence they accept. Our page on AI security questionnaires lists what buyers ask about AI features. The certification guide covers the audit path.
What does the standard require? Clauses 4 to 10#
ISO management-system standards share one clause layout. Clauses 4 to 10 hold the requirements you are audited against. We could not read the clause text, so this table gives the usual ISO structure and the AI-specific question each clause raises. Treat the right column as our reading, not a quote.
| Clause | Topic | What an AI organization has to decide |
|---|---|---|
| 4 | Context of the organization | Which AI systems exist, who is affected, what is in scope |
| 5 | Leadership | Who owns the AIMS, and which AI policy leaders approve |
| 6 | Planning | How AI risks and impacts are assessed, and which objectives follow |
| 7 | Support | Resources, skills, awareness, documented information |
| 8 | Operation | How AI systems are run, assessed and changed in daily work |
| 9 | Performance evaluation | Monitoring, internal audit, management review |
| 10 | Improvement | How findings and incidents lead to corrective action |
Testing evidence matters most in clauses 6, 8 and 9. Clause 6 asks you to assess risk. Clause 8 is where you run the controls. Clause 9 is where you show that they work.
What are Annex A controls and Annex B guidance?#
Annex A is titled "Reference control objectives and controls" and Annex B is titled "Implementation guidance for AI controls". Both are listed in the table of contents as normative (sample pages). A note in the standard says organizations "may not require all controls listed in Annex A".
That note means you pick controls from a risk assessment, then record why you left others out. In ISO terms this record is the statement of applicability.
Secondary sources say Annex A includes a control A.6.2.4, "AI system verification and validation". We did not see the control text, so we do not quote it. Verification and validation is the Annex A topic where test reports are most likely to serve as evidence.
Does ISO 42001 require security testing or red teaming?#
We cannot show that it does. ISO/IEC 42001 asks the organization to set up an AI management system. Testing is one topic of its Annex A controls. The standard text is paid, so we cannot confirm a named method, a test frequency or a requirement for external testers.
Check the exact wording with your auditor. Two points help in that conversation:
- A management-system audit checks that you assess risk and keep evidence. A pentest report is evidence for a risk you have named.
- Your auditor decides what counts as sufficient for your scope. We cannot say that any auditor will accept a given report.
How does ISO 42001 relate to NIST AI RMF and the EU AI Act?#
The three documents have different jobs. ISO/IEC 42001 is a certifiable standard for an organization. NIST AI RMF 1.0 (NIST AI 100-1, January 26, 2023) is a voluntary framework. The EU AI Act (Regulation (EU) 2024/1689) is law.
| Document | Type | Certifiable | Testing wording we verified |
|---|---|---|---|
| ISO/IEC 42001:2023 | Management-system standard | Yes, for an organization | Not verified (text is paid) |
| NIST AI RMF 1.0 with AI 600-1 | Voluntary framework and profile | No | AI 600-1 action MS-2.7-007: "Perform AI red-teaming to assess resilience against" prompt injection, among other attacks |
| EU AI Act | Regulation | Not applicable | Art. 55(1)(a): adversarial testing for general-purpose AI models with systemic risk. Art. 15(5): resilience of high-risk systems |
The EU dates moved. Regulation (EU) 2026/1744 says Annex III high-risk duties apply from 2 December 2027 and Annex I duties from 2 August 2028 (Omnibus text). Art. 15 does not use the words "red team" or "penetration test". For detail, read our guides on NIST AI RMF and red teaming and EU AI Act red teaming. The frameworks page compares all of them.
What evidence can an AI red team report give an auditor?#
An AI red team report can support three parts of an AIMS: the risk assessment, the verification and validation of a system, and the monitoring of controls. It shows that someone tried to break a named system under written authorization and recorded what happened.
Sample evidence map
This is a demonstration with a fictional app, "Harbor Notes Assistant". No real customer system was tested.
| Report content | AIMS topic it can support | Example |
|---|---|---|
| Scope, assets and test conditions | Context and scope (clause 4) | Assistant, retrieval index and two tools, staging only |
| Findings with severity and evidence | Risk assessment (clause 6) | Retrieved note from another tenant, request and response saved |
| Controls that held | Verification (Annex A topic) | Injected instruction in a note did not trigger the delete tool |
| Fixes and retest result | Improvement (clause 10) | Tenant filter added, retest shows the note no longer appears |
Keep four things with the report: the scope letter, the authorization, the evidence index and the retest note. A report from a test of one app is not a certificate for the organization. It is one input to the records the audit reads.
If you plan to build this evidence, see how to scope an AI red team and the example report.
Questions
Does ISO 42001 require penetration testing or red teaming?
We cannot show that it does. The standard text is paid, and we read only the scope, the table of contents and a sample. Annex A has controls about AI system verification and validation, per secondary sources. Ask your certification body which testing evidence it expects for your scope.
Can a product be ISO 42001 certified?
The standard is written for an organization. Its scope sentence covers an AI management system within the context of an organization that provides or uses AI products or services. A certificate therefore covers the management system and its stated scope, not a single model or app.
Is ISO 42001 the same as ISO 27001?
They are separate standards. Both are management-system standards, and some vendors call 42001 the AI counterpart of 27001. ISO 27001 covers information security. ISO 42001 covers governance of AI systems across their life cycle.
Do I need ISO 42001 to sell AI features to enterprises?
Not by law. Some buyers ask for it in security questionnaires. Others accept a described control set or a test report. Ask the buyer which evidence they accept before you start a certification project.
Sources
- IEC Webstore: ISO/IEC 42001:2023 Information technology, Artificial intelligence, Management system (checked 9 November 2026)
- ISO/IEC 42001:2023 sample pages (iTeh Standards) (checked 9 November 2026)
- NIST AI 600-1: Generative AI Profile (checked 9 November 2026)
- Regulation (EU) 2024/1689 (EU AI Act) (checked 9 November 2026)
- Regulation (EU) 2026/1744 (Digital Omnibus on AI) (checked 9 November 2026)