ISO/IEC 42001 AI Management System Software

CURRENT POSITION CHECKED: 26 AUGUST 2026 

A current AI governance programme must distinguish the management-system standard from impact-assessment guidance, certification rules and applicable law. These sources can reinforce one another, but they are not interchangeable. 

The current published AIMS requirements standard. It specifies what an organisation must establish, implement, maintain and continually improve when providing or using AI products or services. 

Current guidance for AI system impact assessments across the lifecycle, including foreseeable effects on individuals, groups and society. 

Requirements for bodies that audit and certify AIMS. It applies to certification and accreditation activity; it is not an implementation checklist for ordinary organisations. 

Enforcement powers and Article 50 transparency duties apply from 2 August 2026. Other high-risk obligations follow on the dates explained below. 

ISO/IEC 42001 certification does not by itself demonstrate compliance with the EU AI Act. Legal applicability depends on the organisation’s role, AI system, use, market, geography and other facts. 

A MANAGEMENT SYSTEM—NOT A PRODUCT CLAIM 

ISO/IEC 42001 uses a management-system approach. It asks the organisation to understand its context, lead and plan the AIMS, support and operate it, evaluate performance and improve. The standard is designed to be applicable to organisations that develop, provide or use AI systems. 

THE OPERATING STRUCTURE 

ISO/IEC 42001 follows the familiar management-system structure. The clauses should work together around real AI systems and decisions rather than exist as isolated policy documents. 

Identify internal and external issues, interested parties, legal and contractual requirements, organisational roles and the AI activities inside the AIMS boundary. 

Set direction, allocate responsibility, approve policy, provide resources and ensure AI governance is integrated into organisational processes. 

Address AI risks and opportunities, set measurable objectives, determine actions and manage planned changes to the AIMS. 

Control competence, awareness, communication, resources and documented information needed to operate the AIMS. 

Plan and control AI lifecycle activities, conduct impact and risk work, apply controls and manage outsourced processes. 

Monitor, measure, analyse and evaluate performance; conduct internal audit; and complete management review. 

Manage nonconformity and corrective action, learn from incidents and change, and continually improve AIMS suitability and effectiveness. 

ASSESS EFFECTS BEFORE AND DURING USE 

ISO/IEC 42005:2025 provides lifecycle guidance for assessing foreseeable impacts on individuals, groups and society. ISO/IEC 23894:2023 provides guidance on AI risk management. Zebsoft can connect both forms of analysis to the AIMS without pretending they are the same exercise. 

Describe intended purpose, users, affected people, operating environment, foreseeable misuse, dependencies and decision significance. 

Record beneficial and adverse effects, uncertainty, affected groups, failure modes, misuse, bias, privacy, safety, security and operational concerns. 

Apply approved criteria, determine controls, assign owners, record residual exposure and route risk acceptance to authorised people. 

Reassess when the model, data, provider, use, population, law, performance or operating environment changes materially. 

The system preserves inputs, reasoning, evidence, consultation, assumptions and approvals. Competent people determine assessment conclusions and whether the remaining risk and impact are acceptable. 

CONTROL THE COMPLETE AI LIFECYCLE 

AI governance fails when approval is treated as the end of the process. Models, data, suppliers, usage and legal expectations change. The control route must continue while the system is in use. 

01 

Record the need, intended use, accountable sponsor, expected benefit, affected parties and initial constraints. 

02 

Classify the system and complete proportionate impact, risk, privacy, security, safety and legal assessment. 

03 

Test against defined criteria, review evidence and limitations, record conditions and obtain authorised human approval. 

04 

Control access and use, communicate instructions, collect evidence, watch performance and route exceptions or incidents. 

05 

Reassess significant changes, withdraw approval when required, manage records and dependencies, and confirm controlled retirement. 

GENERATIVE AI NEEDS OPERATING CONTROLS 

A policy can state expectations, but it cannot prove how specific tools and uses are approved, monitored and changed. Generative AI requires controls around information, output, human review, disclosure and provider dependency. 

Define which services, models, integrations and use cases are permitted, restricted or prohibited and who may use them. 

Control whether personal, confidential, customer, regulated, export-controlled or intellectual-property material may be entered. 

Require authorised sources, preserve relevant inputs and references, and distinguish retrieved facts from generated language. 

Define competence, review depth, validation and approval before AI-assisted output influences operations, customers or public information. 

Apply disclosure, labelling or machine-readable marking where the organisation’s role, content and applicable law require it. 

Monitor terms, training-data commitments, hosting, retention, security, capabilities, limitations and material model updates. 

EU AI ACT: CURRENT ENFORCEMENT TIMELINE 

The EU AI Act entered force on 1 August 2024 and applies progressively. As of 26 August 2026, enforcement powers and Article 50 transparency duties are active. The organisation must determine its own role and which provisions apply. 

Prohibited-practice rules, relevant definitions and AI literacy obligations began applying. 

Governance rules and obligations for general-purpose AI models began applying. 

Enforcement powers and Article 50 transparency obligations began applying, subject to the Act’s detailed scope and limited transitional provisions. 

Annex III high-risk rules apply from 2 December 2027; rules for high-risk systems embedded in regulated products apply from 2 August 2028. 

Zebsoft can map applicable duties to owners, controls, evidence, reviews and actions. It cannot determine legal classification without the relevant facts or replace competent legal and regulatory interp retation.

THIS IS HOW WE SOLVE THE PROBLEM 

Most organisations already have AI policies, risk templates, supplier questionnaires and project approvals. The weakness is that the controls are separated from the systems, people and changes they are meant to govern. 

AI enters through many routes. Procurement, software updates, embedded features and employee tools can bypass a central register. 

Assessments become documents. Risk and impact conclusions are not linked to approval conditions, owners or monitoring.

Controls rely on follow-up. Reviews, supplier evidence, testing and actions live in email, spreadsheets or SharePoint.

Changes break prior assumptions. A model, provider, data source or use changes while the old approval remains visible.

Assurance becomes reconstruction. Teams assemble proof after a customer, auditor, regulator or incident asks for it.

Define the control. Set scope, trigger, responsible roles, required inputs, decision criteria, time limits and evidence. 

Communicate the requirement. Route current policy, conditions, restrictions, training and changes to authorised users and owners.

Operate the workflow. Require assessment, testing, approval, monitoring, incident response and change review at the right lifecycle point.

Assure the result. Connect dashboards and reports to current evidence, exceptions, human decisions, audit findings and management review.

Escalate what does not conform. Overdue work, control failure, unexpected performance and unauthorised use enter accountable action routes.

AI FOR AUTHORISED INTERROGATION AND ANALYSIS 

ZAP AI can help authorised users interrogate approved records, summarise current information and surface relationships or patterns that require attention. 

HUMANS REMAIN RESPONSIBLE 

Zebsoft does not use AI to invent policies, risks, impact assessments, control operation, evidence, approvals, conformity conclusions or certification decisions. 

Humans remain responsible for the decisions, work, approvals and consequences. AI may assist analysis; it does not acquire organisational accountability.

CERTIFICATION READINESS 

ISO/IEC 42006:2025 sets additional requirements for bodies that audit and certify AIMS. Zebsoft can help the organisation prepare and present controlled evidence, but certification remains an independent conformity-assessment decision. 

Confirm the organisational boundary, AI activities, sites, legal entities, products, services and accountable governance structure. 

Run the AIMS long enough to demonstrate genuine inventory, assessment, control, monitoring, audit, review and improvement activity. 

Complete internal audit and management review, address nonconformities and verify corrective-action effectiveness. 

Provide authorised records while the certification body determines samples, findings, competence needs and the certification conclusion. 

Zebsoft does not certify organisations and cannot guarantee certification. It helps responsible people demonstrate how the AIMS is controlled, operated, evaluated and improved. 

CONNECT GOVERNANCE WITHOUT COLLAPSING INTENT 

An AIMS can share organisational processes with other management systems, but each standard and legal duty retains its own scope, criteria and evidence. 

Connect AI assets, access, suppliers, incidents, vulnerabilities and information-security risk without treating security as the whole of AI governance. Explore ISO 27001 software. 

Relate personal-data use, lawful basis, DPIAs, rights, retention and processors to relevant AI systems and decisions. Explore GDPR software. 

Connect AI risk to business, operational, safety, security, regulatory and supplier contexts. Explore risk management software.

Use controlled design, supplier, validation, nonconformity, corrective-action and improvement processes where AI affects products or services. 

Use governance guidance to help governing bodies enable and direct the effective, efficient and acceptable use of AI. 

Use AI risk-management guidance to strengthen the way AI-specific risk is integrated into organisational activities and functions. 

Where useful, map the voluntary NIST AI Risk Management Framework and its Generative AI Profile without presenting them as legal or ISO certification requirements. 

MOVE FROM POLICY PACKS TO OPERATING GOVERNANCE 

Zebsoft can replace or connect fragmented spreadsheets, SharePoint lists, policy folders, ticketing tools and supplier files. Migration should improve control, not merely copy old disorder into a new database. 

01 

Locate inventories, assessments, policies, approvals, suppliers, incidents, actions, evidence and unofficial AI use. 

02 

Remove duplicates, identify obsolete records, resolve uncertain ownership and preserve required history. 

03 

Relate source fields and evidence to the new system structure, lifecycle states, controls and responsibilities. 

04 

Check completeness, permissions, relationships, workflow, reporting and representative migrated records. 

05 

Approve the new source of truth, communicate responsibilities, retire superseded routes and monitor adoption. 

The migration plan can be phased by AI risk, business unit or lifecycle state. Live high-impact systems and imminent regulatory duties should not wait behind low-value historical cleanup. 

PRACTICAL QUESTIONS 

Use the licensed standards, current regulator information and competent professional advice when determining exact requirements. 

It is the current international requirements standard for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System. 

No. Zebsoft supports implementation, operation, evidence, audit and improvement. An independent competent certification body reaches the certification decision. 

It is a separate 2025 guidance standard for AI system impact assessment. It complements ISO/IEC 42001 and can strengthen the organisation’s impact-assessment method. 

No. The organisation determines proportionate controls from context, use, effects, risk, obligations and lifecycle stage. It must consider relevant Annex A control objectives and justify its approach. 

Yes. The inventory and supplier processes can cover hosted tools, models, APIs and AI embedded in wider products, with controls reflecting the organisation’s actual role and influence. 

No. Certification can support structured governance and evidence, but legal compliance depends on the applicable provisions and facts of each organisation and AI system. 

Article 50 transparency duties and enforcement powers began applying on 2 August 2026. Annex III high-risk rules apply from 2 December 2027 and regulated-product high-risk rules from 2 August 2028. 

AI may help authorised users interrogate and analyse approved information. Humans remain responsible for assessments, controls, evidence, approvals, interpretations and decisions. 

Yes. Common processes can be connected while the AIMS and ISMS retain their own scope, specialist requirements, risks, controls and audit conclusions. 

See the official ISO/IEC 42001 page, ISO/IEC 42005 page, ISO/IEC 42006 page, the European Commission AI Act enforcement timeline, the NIST AI RMF and current ICO AI guidance.