ISO/IEC 42001. Readiness and support for certification.
Gap analysis, the design of your AI management system, Annex A controls and preparation for the certification audit, run alongside your EU AI Act work.
30 minutes with a solution architect.
What is ISO/IEC 42001, and how does Solorai help?
ISO/IEC 42001, published in December 2023, is the international standard for an AI management system: the policies, roles, risk processes and controls an organisation uses to develop, provide or use AI responsibly. Certification is granted by an accredited certification body. Solorai prepares you for it: gap analysis, system design, Annex A controls, internal audit and audit readiness.
Written and reviewed by Solorai
- management system clauses, 4 to 10
- 7
- Annex A controls in 9 areas
- 38
- certification audit stages
- 2
What does ISO/IEC 42001 readiness include?
Everything up to the certification audit. The audit itself belongs to the certification body.
Gap analysis
Your current practices compared with clauses 4 to 10 and the Annex A controls, with a prioritised plan.
Scope and AI policy
The scope of the management system, your AI policy and objectives, agreed with top management.
Risk and impact assessment
AI risk assessment and AI system impact assessment processes, applied to your real systems.
Annex A controls
The controls you need, recorded in a statement of applicability with evidence for each.
Internal audit and review
An internal audit and a management review before the certification audit.
Audit support
Preparation for stage 1 and stage 2, and help closing any findings.
Path to certification
What is the path to certification?
Seven steps. The first four are yours with our support, the last three belong to the certification body.
Gap analysis
Solorai
Where you stand against the clauses and the Annex A controls.
Design the management system
Solorai with your team
Scope, AI policy, roles, risk and impact processes, statement of applicability.
Implement and run
Your team, with our support
The processes and controls in daily use, with records.
Internal audit and management review
Solorai and your team
Your own check before the external audit.
Stage 1 audit
Certification body
Documentation and readiness review.
Stage 2 audit
Certification body
Implementation and effectiveness of the management system.
Surveillance audits
Certification body
Regular checks during the three-year certificate cycle.
Where to start
How do we start with ISO/IEC 42001?
Fixed formats with a clear scope. Prices are agreed in a written proposal.
ISO/IEC 42001
Gap analysis
Your current practices against clauses 4 to 10 and Annex A, with a prioritised plan to certification.
- Duration
- Scoped in a written proposal
EU AI Act
AI Act starter
An inventory of your AI systems, risk classification, an internal AI policy and AI literacy measures. Legal opinions are not included.
- Duration
- About 4 weeks
- For
- EU companies
FAQ
ISO/IEC 42001, in short
What is ISO 42001?
ISO/IEC 42001:2023 is the international standard for an AI management system. It sets requirements in clauses 4 to 10, from context and leadership to performance evaluation and improvement, plus 38 reference controls in Annex A.
Who can certify against ISO/IEC 42001?
Accredited certification bodies. They follow ISO/IEC 17021-1 and ISO/IEC 42006:2025, the standard for bodies that audit and certify AI management systems. Solorai prepares organisations for certification but does not certify.
How does ISO 42001 certification work?
After you run the management system and complete an internal audit and a management review, the certification body runs a stage 1 audit of documentation and readiness and a stage 2 audit of implementation and effectiveness. Surveillance audits follow during the three-year certificate cycle.
Does ISO 42001 make us compliant with the EU AI Act?
Not on its own. ISO/IEC 42001 gives no presumption of conformity under the AI Act, but it provides much of the management structure the Act expects. EN 18286, the first harmonised standard, is designed to be layered on top of it.
Can ISO 42001 be combined with ISO 27001?
Yes. Both follow the same management system structure, so document control, internal audit and management review can be shared.
Can a company that only uses AI adopt ISO 42001?
Yes. The standard applies to organisations that develop, provide or use AI systems.
Related reading
- Industries
AI for banks and financial services
For banks and financial services firms.
Read the guide - Industries
AI for manufacturing
For manufacturers and industrial companies.
Read the guide - Guide
EU AI Act checklist for companies
A step-by-step EU AI Act checklist for companies: inventory your AI systems, classify risk, map obligations by role and set deadlines.
Open the checklist
Sources: ISO/IEC 42001, Regulation (EU) 2024/1689
Your road to ISO/IEC 42001. Start with a 30-minute briefing.
Tell us where you stand with AI governance. We will reply with a clear next step.