ISO 42001 guides: Overview · Requirements · Cost · How to get certified
Last updated: 10 July 2026 · Reviewed by Ann Reyes, Lead Auditor (Davao)
ISO/IEC 42001:2023 requires an AI management system (AIMS) that makes your organization’s use of artificial intelligence governed, assessed and accountable — on the harmonized clause 4–10 structure, with AI-specific requirements that have no equivalent in older standards.
The AI-specific requirements
AI policy and accountability: a policy governing development and use of AI, with roles and responsibilities assigned — someone answers for each system. AI system inventory: a register of the AI in scope, in-house and procured, with intended purpose and context. AI risk assessment: risks to the organization from each system — performance, security, dependency. AI impact assessment: the requirement that distinguishes 42001 — effects on individuals and society: bias and fairness, transparency and explainability, safety, privacy. Life-cycle controls (Annex A): from data acquisition and model development or selection, through deployment and human oversight, to monitoring, incident handling and retirement. Third-party AI: supplier controls for procured models and AI-embedded services — ChatGPT-class tools included.
The management-system spine
Context, scope and interested parties; leadership; objectives and planning; competence and awareness for people building or operating AI; documented information; performance evaluation with internal audit; management review; improvement. Organizations holding ISO 27001 reuse most of this spine directly.
Documents auditors expect
AI policy · AIMS scope and AI system inventory · risk and impact assessment methodology and results per system · Statement of Applicability against Annex A controls · life-cycle procedures (data, development, deployment, monitoring) · human-oversight arrangements · supplier AI requirements · incident records · audit and review records.
How auditors read these requirements in practice
The gap between meeting the ISO 42001 requirements and demonstrating them is where first attempts stumble. A requirement is not satisfied when the procedure exists; it is satisfied when the procedure, the practice and the records tell one consistent story an auditor can trace end to end. AI assessors test inventory completeness first — shadow AI is the classic finding — then read impact assessments for real analysis. Philippine organizations preparing for ISO 42001 certification in the Philippines should walk their own trace before any external party does: pick one real transaction, follow it through every claimed control, and note where the story breaks. That single exercise — done honestly — predicts audit results better than any documentation review, which is why our pre-certification internal audits are built around exactly this discipline.
Implementing without over-engineering
A practical sequence for tackling these requirements without drowning: start from your existing practice, not from the standard’s table of contents. Map what your organization already does that satisfies each requirement — in most established Philippine companies that covers more ground than expected — then close genuine gaps in risk order, not clause order. Draft documentation last, describing the improved reality rather than aspirations. This sequence, the reverse of how template implementations work, produces systems that pass audits because they are true. It is also faster: gap assessment tells you the real distance in a week, and everything after that is closing known gaps instead of transcribing a standard. Start with the assessment; the requirements shrink once they are mapped against what you already do.
From requirements to your first audit-ready day
The distance from reading ISO 42001’s requirements to being audit-ready is best measured in evidence, not documents. A useful self-test we give every client: could you, today, hand an auditor one month of records proving the system ran — meetings minuted, checks performed, issues logged and closed, training delivered? Then two months, then three? Certification bodies sample operating history because operation is what certification vouches for; the requirements are simply the categories that history must cover. This reframing rescues teams from documentation paralysis: the goal is never a complete binder, it is a running system leaving true traces. Build the traces requirement by requirement — start with the processes that already run well, formalize their records first, then extend to the gaps — and audit-readiness arrives as an accumulation rather than a cliff. Our gap assessment scores exactly this evidence maturity, which is why its output is a project plan rather than a lecture.
A final word from practice
After sixteen-plus years preparing Philippine organizations across every discipline this site covers, the pattern behind successful outcomes in ISO 42001 certification in the Philippines is unglamorous and consistent: start earlier than feels necessary, assess before deciding, build on real practice, and keep the system alive after the credential arrives. Organizations that follow it experience audits as formalities and revisions as calendar entries; organizations that don’t fund the rescue industry. Whichever category your current state resembles, the first step is identical — an honest assessment — and it is a week, not a commitment. +63 977 815 1204 reaches a consultant, not a call tree.
Talk to a Sterling consultant, not a call centre: our lead auditors Mark Santos (Metro Manila), Zia Bautista (Cebu) and Ann Reyes (Davao) deliver every project on-site across the Philippines. Book a free consultation →
ISO 42001 requirements — quick answers
What is the difference between the AI risk assessment and the AI impact assessment?
Direction of harm. The risk assessment protects the organization — model failures, security, drift, dependency. The impact assessment protects people affected by the AI — bias, fairness, transparency, safety — and is the requirement regulators and enterprise clients read first. Both are mandatory, per system in scope.
Does ISO 42001 apply if we only use vendor AI tools?
Yes — deployed and procured AI is squarely in scope. Governing selection, data exposure, human oversight and monitoring of third-party tools is most of the standard’s value for companies that build nothing themselves; an inventory full of SaaS AI still needs governing.
How does Annex A work — like ISO 27001’s?
Same logic: a control catalogue you apply by applicability, justified in a Statement of Applicability. Controls span the AI life cycle — data quality and provenance, development documentation, deployment safeguards, human oversight, monitoring and decommissioning.
Do the requirements demand explainable AI everywhere?
They demand transparency and explainability proportionate to impact — a credit-decision model owes far more explanation than a spam filter. The impact assessment is where that proportionality gets decided and documented, which is exactly how auditors will test it.
Start with certainty: a one-week gap assessment tells you the true distance, cost and timeline — request yours.