Skip to content

ISO/IEC 42001 AI Governance

What is ISO/IEC 42001?

ISO/IEC 42001:2023 is the international standard that describes how an organization sets up an AI management system to develop, provide or use artificial intelligence responsibly. It does not describe a single model or product; it covers how the organization manages AI: policy, roles and responsibilities, risk and impact assessment, lifecycle, data, third parties, monitoring and continual improvement. Its structure is aligned with other management system standards such as ISO/IEC 27001, so it offers a familiar skeleton to organizations that already run information security management.

My position: lead auditor training, not an organizational certification

Yunus Sevğane completed the ISO/IEC 42001:2023 AI Management System Lead Auditor training at Sigmacert Global in June 2025. It is a training certificate; it does not mean I certify or independently audit on behalf of an organization. I use the standard as a working method when I run AI projects. If your organization needs certification, I recommend an independent expert or an accredited certification body. The full list of my training is on the Certificates page.

What do I do in project leadership?

  • Purpose and scope: which business question the AI system serves, and where it must not be used, is written down.
  • Responsibility: the business owner, the technical owner and the escalation point are named; who decides to expand, stop or roll back is clear.
  • Data: source, permission, personal-data risk, access and retention rules are settled in the first weeks.
  • Risk and impact: risks are recorded with an owner and a mitigation; points needing human approval are identified.
  • Third parties: what data goes to external model, service and data providers, and what happens if a provider changes, is written down.
  • Monitoring and improvement: what is monitored while live, how often, and how findings turn into the next decision is defined.

For the detailed question list, see the post AI governance with ISO/IEC 42001: a checklist for the project lead.

What do I not do?

I do not issue ISO/IEC 42001 certificates for your organization, perform accredited audits or give legal compliance opinions. The standard is voluntary and does not replace legal obligations. My contribution is to set governance up from the start as a record that feeds decisions, rather than a pile of documents added at the end of a project.

Frequently asked questions

What is the difference between ISO/IEC 42001 and ISO/IEC 27001?

ISO/IEC 27001 describes an information security management system; ISO/IEC 42001 describes an AI management system. Both use a common management-system skeleton; 42001 adds AI-specific topics such as risk, impact, transparency and lifecycle.

Are you an ISO 42001 lead auditor?

I completed the ISO/IEC 42001:2023 lead auditor training. That training certificate does not mean I am an auditor for a certification body; I use the perspective it gave me in project management.

Is ISO 42001 mandatory?

The standard is voluntary. It may come up because of customer, tender or regulatory expectations; it does not replace legal obligations.

Does it apply to a small AI project?

Yes, at a suitable scale: a short record of purpose, owner, data, risk and monitoring is a good start for most projects.

To talk

The first step is a short intro call. Use the contact page, write on WhatsApp (+90 531 679 10 14) or email yunus@sevgane.com.

Related pages