ISO/IEC 42001:2023

Your AI management system, built on one AI register.

Run the ISO 42001 clauses and decide which Annex A controls apply, on the same AI register you keep for the EU AI Act. When a customer asks how you govern AI, show the system running.

Book a demo Start free readiness check

Statement of Applicability for a demo company with ISO 42001:2023 Annex A Controls selected and an Export CSV button: 38 applicable, 0 excluded, 16 complete and 22 in progress, and controls A.2.2 AI policy, A.2.3 Alignment with other organizational policies and A.2.4 Review of the AI policy, each applicable with the justification Regulatory and the status Complete. — The Statement of Applicability for ISO 42001 Annex A: each control applicable or not, with a justification and a status, exportable to CSV. Product screens show a fictional demo company.The Statement of Applicability for ISO 42001 Annex A: which controls apply and which are excluded, counted on one card. Product screens show a fictional demo company.

What the standard asks

A management system for AI.

ISO/IEC 42001 is the international standard for an AI management system. It is voluntary, and it is how a compliance lead, CISO or head of AI answers when a customer questionnaire, an auditor or procurement asks how you govern AI. It rests on three things.

Clauses 4–10
Run an AIMS

Set the scope, an AI policy and objectives, assess AI risks and the impact of your AI systems, make sure people are competent, then measure, audit internally and improve.
Annex A
Choose your controls

Decide which of the 38 reference controls you need, from data quality to supplier terms, and record each decision and its reason in a Statement of Applicability.
Certification
Show that it works

A certification body, usually an accredited one, audits you in two stages, documents first and then practice, followed by surveillance audits each year and recertification every three years.

38 Annex A controls In 9 categories

27 clause requirements The management system

Annex A by category

A.2 3 Policies related to AI
A.3 2 Internal organization
A.4 5 Resources for AI systems
A.5 4 Assessing impacts of AI systems
A.6 9 AI system life cycle
A.7 5 Data for AI systems
A.8 4 Information for interested parties
A.9 3 Use of AI systems
A.10 3 Third-party and customer relationships

How Fidureon covers it

From AI inventory to audit day.

The parts of an AI management system that take the most time, in one place, each tied to the clause or control it answers.

AI register

Your AI systems, in scope.

Every AI system you build or use, with its EU AI Act risk tier, your role as provider or deployer, its Annex III category, FRIA status, EU database ID and human-oversight mechanism. The same register serves the EU AI Act, and exports as a branded PDF.

The AI register on the EU AI Act page

AI Register for a demo company with an Export PDF button: six AI systems in total, three high risk, one limited risk and three in production, and a table of systems such as Copilot for office productivity, a CV screening assistant and GridCast load forecasting, with type, EU AI Act risk level, status, provider and owner. — The AI register: every AI system with its EU AI Act risk class, status and owner. Lifted out: one system’s classification, with its Annex III category and your role as provider.The AI register: every AI system with its type and EU AI Act risk class.

AI system classification for GridCast load forecasting: EU AI Act risk level High Risk, AI systems in Annex III categories requiring full compliance framework; High-Risk Category (Annex III) Critical Infrastructure; Provider Role Provider. — The AI register: every AI system with its EU AI Act risk class, status and owner. Lifted out: one system’s classification, with its Annex III category and your role as provider.The AI register: every AI system with its type and EU AI Act risk class.

Policy library table with Title, Category and Status columns: Information Security Policy and Access Control Policy, both in the Security category and Published (v1), and Acceptable Use of AI, in the General category and Pending Approval.

Policy library Title column: Information Security Policy, Access Control Policy and Acceptable Use of AI, each with a short description.

Status column, same rows: Published (v1), Published (v1) and Pending Approval.

An AI policy, from draft through approval (5.2, A.2.2).

Your AI policy and the documents around it, versioned, with an approval workflow, version compare and restore, and PDF export.

Risk register titles: “AI Act high-risk obligations missed for grid AI”, “Critical ICT provider outage halts billing and metering” and “Customer chatbot gives incorrect tariff advice”, each with a short description.

AI risks, in your risk register (6.1).

Assess each risk against your appetite, then treat it with a plan or accept it formally. Each risk links to the AI systems it concerns.

AI competence and literacy (7.2, Art. 4) Define roles and the AI competences each one needs, assess people against them, and turn every gap into an action with training evidence attached.
Third parties in the AI life cycle (A.10) Send questionnaires with AI-generated questions to the vendors behind your AI systems through a supplier portal, and see who has answered.

Works with the EU AI Act

One AI life cycle. Two frameworks.

Annex A.6 covers the AI system life cycle in 9 controls, and much of it is what the EU AI Act asks of high-risk AI. Link a control to the requirements it meets in both, and its status and evidence count toward both.

ISO 42001 EU AI Act

The same requirements view, one source setting apart.

Requirements view with ISO 42001:2023 AIMS selected as the source: a compliance bar and clauses 4.1 to 5.2, from understanding the organisation and its context to the AI policy, each with an implementation status. — ISO 42001 clauses and EU AI Act obligations are both catalogues in the same requirements view, each with its own status. ISO 42001 clauses and EU AI Act obligations, in the same requirements view.

Requirements view with the EU AI Act selected as the source: a compliance bar and obligations from Art. 4 AI literacy to Art. 12 record-keeping, each with an implementation status of Compliant, In Progress or Gap. — ISO 42001 clauses and EU AI Act obligations are both catalogues in the same requirements view, each with its own status. ISO 42001 clauses and EU AI Act obligations, in the same requirements view.

Where A.6 meets the AI Act

A.6.1.3 Processes for responsible design and development Art. 17Quality management system Provider
A.6.2.4 AI system verification and validation Art. 15Accuracy, robustness and cybersecurity Provider
A.6.2.6 AI system operation and monitoring Art. 72Post-market monitoringArt. 26Deployer duties for high‑risk AI Provider · Deployer
A.6.2.7 AI system technical documentation Art. 11Technical documentation Provider
A.6.2.8 AI system recording of event logs Art. 12Record-keeping (logging)Art. 26Deployer duties for high‑risk AI Provider · Deployer

A starting point, not a crosswalk: Fidureon ships no pre-built mapping between the two, and which AI Act obligations apply depends on each system’s risk tier and your role. The AI Act’s obligations phase in from 2025 to 2028 — check the official timeline; our EU AI Act page summarises it and links to the Regulation.

Your links, your call Link controls by hand, or accept the suggestions Fidureon makes when you import controls.
One register, both frameworks The AI systems you classify for the AI Act are the AI systems in your ISO 42001 scope.

See one control count toward both, on your own AI systems. Book a demo

FAQ

ISO 42001 questions.

Does Fidureon certify us for ISO 42001?

No. An ISO/IEC 42001 certificate is issued by a certification body, usually an accredited one, after its own audit. Fidureon is where you build and run your AI management system, record your Statement of Applicability and keep the evidence, so that you are ready when the auditor arrives.

What does Fidureon cover in ISO 42001?

ISO/IEC 42001:2023: 27 requirements from the management-system clauses and all 38 Annex A controls in nine categories, with a Statement of Applicability you can export to CSV. The AI systems in scope live in the AI register, the same register you use for the EU AI Act.

Does Fidureon have an AI impact assessment workflow?

Not a dedicated one. ISO 42001 asks you to assess the impact of your AI systems (clause 6.1.4 and Annex A.5). In Fidureon those are requirements and controls like any other: you assign actions, attach your assessment as a document or as evidence, and record each system’s details, risks and human oversight in the AI register.

How does ISO 42001 relate to the EU AI Act?

The EU AI Act is law; ISO/IEC 42001 is a voluntary management-system standard, and certification to it is not the same as meeting the Act. They overlap a lot, especially in the AI system life cycle (Annex A.6). In Fidureon both frameworks use the same AI register, and you can link one control to requirements in both. The AI Act’s obligations phase in from 2025 to 2028 — check the official timeline before you plan around a date; our EU AI Act page summarises it.

We already run ISO 27001. Can we reuse that work?

Yes. ISO 42001 follows the same clause structure as ISO 27001, so much of your scope, policies, risk process, competence records and internal audit approach can be reused. A control can be linked to requirements in both frameworks, so its status and evidence count toward each. You make the links yourself, and Fidureon suggests them when you import controls from documents or spreadsheets.

Is there a free readiness check for ISO 42001?

Not as its own track. The free readiness check has two tracks, ISO 27001 and the EU AI Act. The EU AI Act track starts by finding the AI systems you use, which is also the first step of an ISO 42001 scope. Book a demo to see ISO 42001 on your own AI systems.

Your AIMS and your AI register, in one place.

See Fidureon on your own AI systems, or start the free readiness check on its EU AI Act track, which begins by finding the AI you use.