ISO/IEC 42001 (AI management system)

What it is

ISO/IEC 42001:2023, “Information technology - Artificial intelligence - Management system”, was published on 18 December 2023. Its scope says it specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving an AI management system within the context of an organisation.

It is intended for any organisation that provides or uses products or services that use AI systems, whatever its size, type or sector, and is meant to help it develop, provide or use AI responsibly while meeting its obligations and the expectations of interested parties. ISO describes it as covering the path from risk assessment to effective treatment of AI risks, using the familiar Plan-Do-Check-Act cycle.

Like ISO/IEC 27001, it is a management system standard. It doesn’t tell you whether a particular AI tool is safe. It gives you a structured, auditable way of finding out what AI is in use, who owns it, what could go wrong and what you are doing about it.

Why it matters for a UK small or regulated business

AI tools are arriving through every route at once: features switched on in existing software, tools bought on a credit card, and suppliers using AI on your data. Large buyers and audit committees are starting to ask suppliers how they govern that, and ISO/IEC 42001 gives a recognised answer in the same way ISO/IEC 27001 does for information security. Both are management system standards, so an organisation that already runs ISO/IEC 27001 will recognise the approach.

The standard is only as useful as the attention it gets. A programme that is treated as paperwork produces a certificate. One wired into how decisions get made produces real visibility of AI risk.

Where Microsoft 365 fits

For many businesses, AI arrives through Microsoft 365 first, for example through Copilot and other assistants that work with your mail and documents. The information security basics, such as who can access which data, how sensitive information is labelled and how sign-in is protected, are the foundation an AI management system relies on.

How &DEV helps: we work with executive teams who want ISO/IEC 42001 done properly; read why the certificate alone won’t save you, or get in touch. For the Microsoft 365 foundations, see our cyber assurance uplift.