Contents
Most small and mid-sized businesses now use AI somewhere: a chatbot on the website, an assistant that drafts quotes, a model that forecasts demand, an AI feature inside the ERP. Few have written down who is responsible for it, how it was checked, or what happens when it gets something wrong. Customers are starting to ask. So are auditors, insurers and, for firms that sell into Europe, regulators.
ISO/IEC 42001 is the international standard for answering those questions in a structured way. For a business that already runs an ISO 9001 quality system, it is not a second system to build from scratch. It uses the same structure, and much of the work extends what is already in place. This article explains what the standard requires, what an ISO 9001 business already has, what it needs to add, and a realistic plan to get there.
What ISO/IEC 42001 is
ISO and IEC published ISO/IEC 42001:2023 in December 2023 as the first international standard for an artificial intelligence management system (AIMS). It sets requirements for how an organization governs the AI it develops, provides or uses, and it is certifiable: an accredited certification body can audit the management system and issue a certificate, as for ISO 9001 or ISO/IEC 27001.
- Clauses 4 to 10 follow ISO's harmonized structure for management system standards, the same structure as ISO 9001: context, leadership, planning, support, operation, performance evaluation and improvement.
- Annex A lists 38 reference controls grouped under nine control objectives, numbered A.2 to A.10. An organization selects the controls that apply and justifies any exclusions in a Statement of Applicability, as in ISO/IEC 27001.
- Annex B gives implementation guidance for each control. Annexes C and D are informative, covering AI-related objectives and risk sources, and use across sectors.
The standard certifies the management system, not a particular AI model or product. A certificate says that the organization governs its AI in a controlled, documented and improving way.
What your ISO 9001 system already gives you
Because both standards share the harmonized structure, an ISO 9001 business has the skeleton of an AI management system already. The table shows what carries over and what ISO/IEC 42001 adds at each clause.
| Clause | Already in ISO 9001 | What ISO/IEC 42001 adds |
|---|---|---|
| 4 Context | Internal and external issues, interested parties, scope | Your role for each AI system (developer, provider, user), and AI-specific issues such as legal requirements and the intended use |
| 5 Leadership | Quality policy, roles and responsibilities | An AI policy and named accountability for AI |
| 6 Planning | Risks and opportunities, quality objectives | AI risk assessment and treatment, and an AI system impact assessment covering effects on individuals, groups and society |
| 7 Support | Resources, competence, awareness, documented information | Competence in AI, and resources such as data, tools and computing |
| 8 Operation | Operational planning and control, outsourced processes | Operating the risk treatment, impact assessments and lifecycle controls from Annex A |
| 9 Performance evaluation | Monitoring, internal audit, management review | Monitoring AI system performance and the effectiveness of AI controls |
| 10 Improvement | Nonconformity and corrective action, continual improvement | The same processes, applied to AI incidents and failures |
The practical consequence: an ISO 9001 business keeps one management system. Document control, internal audit, management review and corrective action are extended to cover AI, not duplicated. Our article on integrating ISO 9001, 14001 and 45001 describes the same approach for environment and safety.
What is genuinely new: the Annex A controls
The new work sits mostly in Annex A. The nine control objectives are:
| Objective | What it covers | Typical evidence for an SME |
|---|---|---|
| A.2 Policies related to AI | An AI policy aligned with other policies, and its review | A two-page AI policy approved by management |
| A.3 Internal organization | Roles, responsibilities and a way to report concerns | A named AI owner; a route for staff to raise problems |
| A.4 Resources for AI systems | Data, tools, computing and people the AI depends on | An inventory of AI systems and what each uses |
| A.5 Assessing impacts of AI systems | Effects on individuals, groups and society | A short impact assessment for each significant AI use |
| A.6 AI system life cycle | Requirements, design, verification, deployment, operation and monitoring | Test results before release; monitoring after |
| A.7 Data for AI systems | Data quality, provenance and preparation | Where training or reference data comes from and how it is checked |
| A.8 Information for interested parties | What users and others are told about the AI | User guidance; disclosure that a chatbot is AI |
| A.9 Use of AI systems | Responsible use within intended purposes | Acceptable use rules for staff; human review where needed |
| A.10 Third-party and customer relationships | Suppliers of AI and customers who use your AI | Supplier questions on AI; contract terms; what customers are told |
The control most ISO 9001 businesses have not done before is the impact assessment (A.5). A quality risk assessment asks what could go wrong for the business and its customers. An AI impact assessment also asks what could go wrong for the people affected by the AI's output: a job applicant screened out, a customer given wrong advice, a supplier wrongly flagged. For most SME uses the answer is short. Writing it down is what matters.
Many SMEs use AI rather than build it. Their focus will be on A.9 and A.10: rules for how staff use AI tools, and what they ask of the suppliers whose AI they rely on. Our article on using AI tools inside a quality system covers the ISO 9001 side of that work.
ISO/IEC 42001 and the EU AI Act
ISO/IEC 42001 is voluntary, and certification to it does not by itself mean compliance with the EU Artificial Intelligence Act. It is not one of the harmonized standards whose use gives a presumption of conformity with the Act. It does produce much of the evidence the Act asks for: an inventory of AI systems, documented risk assessment, human oversight arrangements, records of testing and monitoring, and a process for incidents and corrective action. For a Canadian business with European customers, it is a sensible way to organize that work. Our journal paper on the EU AI Act for Canadian businesses explains when the Act applies and what it requires.
Certification: how it works
Certification follows the same path as ISO 9001. A stage 1 audit reviews the documented system and readiness. A stage 2 audit checks that the system works in practice. A certificate is issued for three years, with surveillance audits in between. ISO/IEC 42006:2025 sets the requirements for bodies that certify AI management systems, so check that your certification body is accredited for ISO/IEC 42001.
Costs vary widely with size, scope and how much of the system already exists. Published estimates run from under $10,000 in audit fees for a small organization with existing ISO infrastructure to well over $100,000 for a full program in a larger one. The largest saving comes from building on an existing ISO 9001 or ISO/IEC 27001 system rather than starting a separate one. Many SMEs do not need a certificate at all: aligning with the standard and keeping the evidence is enough until a customer asks for one.
A 26-week plan for an ISO 9001 business
- Inventory AI and set the scope. List every AI system you build, sell or use, including AI features inside purchased software. Decide which are in scope.
- Write the AI policy and name the roles. Keep the policy short. Name one accountable owner and a route for staff to raise concerns.
- Assess risks and impacts. Extend your existing risk register to AI, and write a short impact assessment for each significant use.
- Prepare the Statement of Applicability. Go through the 38 Annex A controls, mark which apply and say why any do not.
- Put the controls in place. For most SMEs: testing before release, monitoring after, data source records, supplier questions and contract terms, and user disclosure.
- Train people. Short, role-based training on the AI policy and acceptable use.
- Audit internally. Add AI to your internal audit programme. Our article on internal audits that find real problems applies directly.
- Review with management. Add AI performance, incidents and changes to the management review agenda.
Then book the certification audit if you want a certificate. A firm transitioning to ISO 9001:2026 at the same time can combine the work, since the new edition also strengthens leadership and planning. See our ISO 9001:2026 transition plan.
Key points
- ISO/IEC 42001 is the certifiable international standard for governing AI, with the same structure as ISO 9001.
- An ISO 9001 business already has most of the management system. The new work is in the 38 Annex A controls, especially impact assessment.
- SMEs that use rather than build AI should focus on acceptable use (A.9) and suppliers (A.10).
- Certification does not by itself mean compliance with the EU AI Act, but it produces much of the evidence the Act asks for.
- Extend your existing system rather than building a second one. About six months is realistic.
Want help adding AI governance to your quality system? Chmltech helps small and mid-sized businesses build and maintain ISO 9001 systems and extend them to new requirements. Book a strategy call.
Sources
- ISO: ISO/IEC 42001:2023 Information technology – Artificial intelligence – Management system
- Advisori: ISO 42001 certification, a complete guide (Annex A structure; status under the EU AI Act)
- Openlayer: ISO 42001, a complete guide to AI management systems (June 2026)
- Elevate: ISO 42001 certification vs compliance, cost differences in 2026
- SOC 2 Auditors: ISO 42001 (certification, ISO/IEC 42006:2025)
