Certification · AI management
Sightadel guides you through the requirements of ISO 42001 – from taking stock of your AI systems through risk and impact assessment to the certification audit. With templates from practice, drafting help and consultants for the difficult parts.
What it is about
ISO 42001 describes a management system for artificial intelligence. The standard does not say how a model is built. It requires you to know where AI is used in your organisation, who is responsible for it, what risks and impacts are associated with it, and how you manage this across the entire life cycle.
It is structured like ISO 27001: clauses 4 to 10 govern the management system itself – context, leadership, planning, support, operation, performance evaluation, improvement. In addition, there is an AI risk assessment and an impact assessment for affected individuals. Annex A contains controls on policies, organisation, resources, impact assessment, life cycle, data, information for interested parties, use and third parties. As with ISO 27001, you justify in a Statement of Applicability which of them apply.
The standard is voluntary. The EU AI Act is binding. The prohibitions, the obligation to ensure AI literacy among staff and the rules for general-purpose AI models already apply. The obligations for high-risk systems were postponed in 2026: to December 2027 for stand-alone systems and to August 2028 for AI in regulated products. ISO 42001 creates the organisation needed to meet these obligations. A certificate does not replace them.
Customers ask how you manage data, models and risks. A certificate answers this once instead of in every questionnaire and prepares you for the obligations under the EU AI Act.
AI is built into chatbots, standard software and analytics, often without an overview. The management system starts with an inventory and clear responsibilities – worthwhile even without a certification goal.
If you run ISO 27001, you can reuse leadership, risk process, internal audit and management review. What is new is mainly impact assessment, life cycle and data quality.
Requirements
Summarised in our own words. The original text in its current version is always authoritative.
Your role in relation to AI – developer, provider, user – is determined, as are interested parties and a clearly defined scope.
In SightadelGuiding questions lead you to your role and scope. The AI inventory is built as a list of systems with purpose, owner and classification.
Top management takes responsibility, approves an AI policy and assigns roles.
In SightadelDraft AI policy based on the industry template. You decide yourself what you want to use AI for and what not – Sightadel flags these points.
A repeatable risk assessment, a treatment plan and an assessment of the impact on individuals, groups and society. Measurable objectives for the system.
In SightadelRisk register per AI system, linked to measures. The impact assessment is guided step by step and filed as evidence.
All Annex A controls with decision, justification and implementation status.
In SightadelBuilt as you work through it: applicability, justification, status and owner for each control – exportable for the auditor.
Proof that those involved are qualified for their AI-related tasks, plus controlled documentation.
In SightadelTraining as recurring cycles with evidence – the same records serve as proof of AI literacy under the EU AI Act.
Requirements, development, verification, release, operation and monitoring of AI systems are defined. The provenance and quality of data are known.
In SightadelEvery control as a guided question with answer options, template, evidence link and comment. Action plans with due dates for open items.
Users and affected individuals receive the necessary information, use is governed, suppliers and partners are included.
In SightadelProviders of AI services are assessed in the Vendors module. In the Trust Center, you show customers how you manage AI.
Internal audit, management review, handling of nonconformities and continual improvement.
In SightadelBoth as a cycle with date and checklist. Nonconformities become measures with a deadline; the activity log shows the history.
Process
Four to eight months, depending on the number and criticality of the AI systems. Considerably less with an established ISMS, because the management system is already in place.
Record all AI systems, including those embedded in standard software. Define role and scope. Without an inventory, no risk can be assessed.
Adopt the AI policy, appoint an owner for each system, set objectives.
Assess risks for each system, assess the impact on affected individuals, decide on treatment. Critical systems first.
Work through Annex A with guidance, build the Statement of Applicability, define procedures for life cycle and data, deliver training.
Check the entire system yourself once and have it reviewed by top management – a prerequisite for the certification audit.
An accredited body reviews documentation and implementation. The auditor works directly in Sightadel with their own role and can never delete anything.
Ready to start
Clarify these questions early and you save weeks later on. In Sightadel they are set up as your first tasks.
Division of work
If software filled everything in, the standard would not serve its purpose – and the auditor would notice. That is why it is clearly defined what stays with you.
From practice
From many years of consulting and certification practice: these are the points that cost the most time or lead to nonconformities in the audit.
AI is also built into office software, CRM and cloud services. Survey all business units and check procurements for AI features before you assess.
Whether you develop, provide or only use AI determines the scope. Define the role for each system, otherwise controls and justifications will not fit together.
An impact assessment that does not look at specific affected individuals is not convincing. Involve the business unit and, where appropriate, data protection.
AI risks concern fairness, transparency and accountability, not just security. Business units and management belong in it from the outset.
The certificate proves a management system, not compliance with the EU AI Act. Check statutory obligations separately.
Without defined triggers, the assessment becomes outdated with the next model change. Define which changes require a new review.
One piece of evidence, several frameworks
We deliberately do not give a percentage – it depends on your scope. Where requirements overlap, one piece of evidence is attached to all of them.
Same structure of clauses 4 to 10. Leadership, risk process, document control, internal audit and management review can be run together. Information security of the AI systems is already covered there.
GDPRWhere AI processes personal data, the record of processing activities and the data protection impact assessment apply. The impact assessment under ISO 42001 supplements them but does not replace them.
ISO 9001Same basic structure. If you build AI into products, you can reuse supplier evaluation, release processes and corrective actions from quality management.
NIST CSF 2.0The Govern function and risk management provide a common language with management and US customers. AI-specific topics such as impact assessment are missing there.
Audit and evidence
Like ISO 27001, ISO 42001 is audited by accredited certification bodies. Sightadel does not certify. You choose an auditor from our independent partner network or a body of your choice. No commission is paid for audits – neither to us nor to the partners.
The audit takes place in two stages, followed by annual surveillance audits and recertification after three years. If you are already certified to ISO 27001, many bodies will agree to a combined audit. The auditor receives their own access in Sightadel: they see the audit scope, add comments and – once you approve – create or edit entries. They can never delete anything.
To the independent auditor networkThe Sightadel licence for ISO 42001: Price on request. All editions and discounts are on the pricing page. On top of that comes the certification body, which invoices independently based on audit days. Their number depends on size, sites and the number and type of AI systems in scope. Obtain quotes and make sure the body is accredited for ISO 42001 or can demonstrate an ongoing accreditation process.
The largest item is the internal effort, and it is distributed differently than for ISO 27001. In addition to one person responsible for the management system, you need time from specialists who know the AI systems: development, data owners, business units that use AI, and often data protection and legal. Impact assessments cannot be done at a desk alone.
If you already run an ISMS based on ISO 27001, you save considerably. Leadership, document control, internal audit, management review and corrective actions are then already set up. What is new is mainly the AI inventory, AI policy, AI risk assessment, impact assessment and the life cycle controls. Where experience is lacking, you can add consulting as a package in the app.
Customers increasingly ask how providers manage AI: which models are used, with what data, who checks the results, how are errors handled? An ISO 42001 certificate answers these questions in a structured way, confirmed by an independent body. Software providers that build AI features into their products in particular use it to shorten their customers' procurement and security reviews.
The standard is voluntary; the EU AI Act is not. But the two fit together well. Depending on role and risk class, the Act requires, for example, AI literacy among staff, risk management, data quality, documentation, human oversight and transparency. ISO 42001 provides the organisation in which such obligations are reliably met and demonstrated.
However, a certificate does not replace a statutory conformity assessment. Whether a system counts as a high-risk system and what obligations follow from that must be checked separately, ideally with your legal advisers. Sightadel does not provide legal advice on this. For the statutory obligations, Sightadel has a separate EU AI Act framework that you can manage with the same evidence.
Annex A contains 38 controls, grouped into nine areas. They range from AI policies and internal organisation through resources such as data, tools, computing power and people to the assessment of the impact of AI systems. Further areas concern the life cycle of AI systems, data, information for interested parties, responsible use, and relationships with suppliers and customers.
As with ISO 27001, you select from this catalogue the controls that treat your risks and justify exclusions in the Statement of Applicability. A company that only buys and uses AI will assess many development controls differently from a manufacturer of AI products. What matters is that the justification matches the defined role.
An annex with implementation guidance explains each control in more detail; further annexes cover objectives, risk sources and use in different sectors. In Sightadel, every control is a guided question with answer options, template, evidence link and comment. Sightadel does not contain the text of the standard. You need a copy of the standard in-house.
The centrepiece is an AI inventory: which systems you develop, provide or use, for what purpose, with what data, who is responsible and what role you play. Without a complete inventory, the risk assessment and impact assessment remain incomplete, and the auditor asks about precisely that.
In addition, there is the AI policy approved by top management, the scope, the method and results of the AI risk assessment, the treatment plan, the Statement of Applicability, AI objectives, evidence of competence, documentation of the impact assessments, as well as the audit programme, audit reports, management review and corrective actions. For individual systems, auditors also expect evidence on the life cycle: requirements, verification before release, monitoring in operation and handling of malfunctions.
In Sightadel, these documents are attached to the relevant control. Impact assessments are guided step by step and filed as evidence, and providers of AI services are assessed in the Vendors module. The activity log shows who made which decision and when.
The audit follows the same pattern as for other ISO management systems: stage 1 reviews documentation and audit readiness, stage 2 the implementation. Beforehand, an internal audit and a management review must have been completed in full at least once.
In stage 2, auditors typically pick a specific AI system and trace it: where is it in the inventory, how was it assessed, what impacts were assessed, who approved its release, how is it monitored in operation, what happens when there is a complaint? Prepare this chain fully for two or three systems, including the interviewees from the business and technical side.
Common weaknesses are an inventory that overlooks cloud services with AI features, impact assessments with no reference to affected individuals, and missing criteria for when a system must be reassessed. If you are already certified to ISO 27001, many bodies will agree to a combined audit, which saves audit days.
The certificate is valid for three years with annual surveillance audits. With AI, maintenance is more demanding than with many other systems, because models, providers and use cases change quickly. A new model at the service provider, a new use case in sales or a new dataset can trigger a reassessment.
So define which changes trigger a reassessment, and make the inventory a mandatory step in every procurement. Monitoring in operation, complaints and incidents should feed into the management review. Repeat AI literacy training regularly, because tools and rules change.
In Sightadel, inventory reviews, reassessments, training, internal audit and management review run as recurring cycles with dates. You link the same evidence to ISO 27001, the GDPR or the EU AI Act, so you only maintain it once. In the Trust Center, you show customers how you manage AI without compiling new documents for every request.
What it costs
You only pay for the frameworks you actually need. The editions differ in capacity and response time, not in subject-matter scope. If you run several frameworks, you save permanently. All prices, discounts and a calculator are on the pricing page.
The certification or audit body invoices its fees directly to you. If needed, you can add consulting as a package in the app.
Working materials
Checklists and templates for other frameworks are available under Resources.
Practical aids, not legal advice.
Terms
No, the standard is voluntary. The EU AI Act is mandatory. ISO 42001 is a structured way to implement its organisational requirements and demonstrate them to customers.
No. In parts, the Act goes further, for example with conformity assessment and registration for high-risk systems or its own transparency obligations. ISO 42001 provides the foundation; you check the remaining statutory requirements separately. Sightadel does not provide legal advice on this.
The prohibitions and the AI literacy obligation have applied since February 2025, the rules for general-purpose models since August 2025, and the transparency obligations since August 2026. The high-risk obligations were postponed: to December 2027 for stand-alone systems and to August 2028 for AI in regulated products.
Yes, considerably. Both standards have the same structure. You run leadership, risk process, internal audits and management review together, and in Sightadel you link existing evidence to both frameworks.
A certificate usually not yet. An inventory, clear responsibilities and trained staff, yes – the EU AI Act already requires AI literacy today. As soon as customers ask for proof, you build on that.
The licence for ISO 42001: Price on request. All editions and discounts are on the pricing page. Get in touch if you want to know how to use the standard in Sightadel.
No. ISO standards are protected by copyright. Sightadel contains structure, controls, guiding questions, templates and its own explanations – not the wording. You need a copy of the standard in-house.
Four to eight months to audit readiness is realistic if one person works on it regularly and the business units play their part. With an existing ISMS based on ISO 27001, it is usually faster, because leadership, audit programme and document control are already running. The inventory and the impact assessments have the greatest influence on the duration.
Three items: the Sightadel licence (Price on request); the certification body, which invoices independently based on audit days; and your internal effort. With an existing ISO 27001 system, internal effort and often also audit days decrease if the body offers a combined audit.
Not necessarily, but experience with this young standard is scarce. Support is particularly helpful for clarifying roles, impact assessment and the distinction from the EU AI Act. In Sightadel, you can add consulting as a package in the app if you get stuck at any point.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
