ISO 42001

The standard for managing AI.

ISO/IEC 42001:2023 asks an organization to govern its AI the way ISO 27001 asks it to govern information security: a management system, run on evidence, audited by a third party. Clauses 4 to 10 are the Harmonized Structure, shared with 27001 — so if you already run one, most of the management-system records you keep count towards both. Annex A is where they part company.

• All 38 Annex A controls

  One plain-English line per control, grouped the way Annex A groups them.

• What we cover, clause by clause

  Every clause from 4 to 10, where its records live in the product, and where the limits of any software sit.