Artificial intelligence is already part of everyday operations in many organisations. It is used in productivity tools, decision-support systems, customer service, data analysis, and product and service development.
However, the speed at which these technologies are being adopted raises an important question: do organisations know where artificial intelligence is being used, what data is being processed, and what risks are involved?
According to the Global Cybersecurity Outlook 2026, 87% of respondents identified AI-related vulnerabilities as the fastest-growing cyber risk in 2025.
These concerns go beyond cybersecurity. The use of AI also raises challenges related to transparency, data quality, human oversight, accountability for decisions, and compliance with legal requirements.
ISO/IEC 42001:2023, the first international standard for artificial intelligence management systems, was developed to help organisations address these challenges by establishing requirements for the responsible and controlled use of AI.
Does your organisation know how it is using artificial intelligence?
A company may use AI across different departments without having a complete overview of the systems in place. Some tools are purchased by the organisation, others are embedded in existing software, and some may be adopted directly by individual teams.
This diversity makes it harder to understand what information is being shared, who is responsible for each application, and which controls are in place.
The first step towards effective AI governance is therefore to identify AI systems and use cases, understand their purposes, and assess the associated risks and impacts.
This is where ISO/IEC 42001 can make a difference.
The standard establishes requirements for an Artificial Intelligence Management System (AIMS), enabling organisations to define policies, responsibilities, processes, and controls suited to their specific circumstances.
It applies both to organisations developing AI solutions and to those using AI-based products or services.
From AI adoption to risk management
The risks associated with artificial intelligence depend on how the technology is developed and used.
An AI tool used to assist with document drafting, for example, presents different challenges from a system used to support recruitment decisions, assess customers, or analyse sensitive information.
Key considerations include data protection and quality, transparency of results, human oversight, reliance on suppliers, and potential impacts on individuals.
ISO/IEC 42001 enables organisations to address these issues within a management system, establishing criteria for assessing risks and impacts, defining controls, and monitoring their effectiveness.
This assessment should not take place only at the implementation stage. AI systems may be updated, begin processing new data, or be used for purposes different from those originally intended.
For this reason, management should cover the entire system lifecycle, from development or acquisition through to use, modification, and eventual retirement.
The aim is not to restrict the adoption of artificial intelligence, but to ensure that organisations can oversee its use and make informed decisions about the risks involved.
What is the relationship between ISO/IEC 42001 and the AI Act?
With the entry into force of the European Union's Artificial Intelligence Act (AI Act), AI governance has also acquired a regulatory dimension.
Although they are related, the AI Act and ISO/IEC 42001 serve different purposes.
The AI Act establishes legal obligations for certain AI systems and operators, taking into account factors such as risk level and the role played by the organisation.
ISO/IEC 42001 is a voluntary international standard that defines requirements for establishing and maintaining an artificial intelligence management system.
Implementing the standard can help organisations structure processes, assign responsibilities, assess risks, and gather relevant evidence to support compliance with regulatory obligations.
However, ISO/IEC 42001 certification does not, in itself, guarantee compliance with the AI Act. Legal compliance must be assessed against the specific requirements applicable to each organisation and the AI systems concerned.
What value does ISO/IEC 42001 certification provide?
Implementing ISO/IEC 42001 enables organisations to manage the use of artificial intelligence, clarify responsibilities, and establish mechanisms for risk assessment and control.
For organisations that already have management systems in place, such as ISO/IEC 27001, the standard also provides opportunities for integration, building on existing risk management, internal audit, and continual improvement processes.
Certification adds an independent assessment of the management system, enabling organisations to demonstrate conformity with ISO/IEC 42001 requirements.
As customers, business partners, and other stakeholders increasingly seek transparency regarding the use of artificial intelligence, this independent assessment can help strengthen confidence in the practices adopted.
ISO/IEC 42001 certification with APCER
APCER provides ISO/IEC 42001 certification services, drawing on expertise in management systems, technology, information security, risk, and compliance.
Through an independent assessment, certification enables organisations to demonstrate that they have an artificial intelligence management system that conforms to the requirements of the standard.
Would you like to learn more about ISO/IEC 42001 and the certification process?
