ISO/IEC 42001:2023
ISO 42001 Standard Implementation
ISO/IEC 42001 is the first international certifiable standard for artificial intelligence management systems (AIMS). It defines how an organisation responsibly develops, procures and uses AI — with risk management, transparency and human oversight.
What is ISO/IEC 42001:2023?
Published in late 2023, ISO 42001 arrived at just the right time: organisations are adopting AI tools en masse, and regulation such as the EU AI Act is bringing concrete obligations. The standard provides a framework for using AI responsibly — without stifling innovation, but with clear answers to questions of bias, transparency, data protection and human oversight.
An AIMS is relevant both for those who develop AI and those who merely use it: a bank introducing AI-based credit scoring, a company using AI for candidate screening, or a software company building AI products — all have roles and responsibilities the standard governs.
Implementation phases
The real phases we guide every project through — from preparation to the certificate, which comes only at the end:
Standard requirements (clauses 4–10)
The steps follow clauses 4–10, with specific AI steps: an impact assessment and Annex A controls. Not sure whether you already meet these requirements? Check with the short self-assessment at the bottom of this page.
Context and role in the AI value chain
We establish whether you're a producer, provider or user of AI systems, and which internal and external obligations (including the EU AI Act) apply to you.
AI policy and responsibilities
Management adopts an AI policy with principles of responsible use and assigns roles for overseeing AI systems.
AI risk and impact assessment
Beyond a classic risk assessment, the standard requires assessing the AI system's impact on individuals and society — bias, discrimination, privacy.
Competence and awareness
Training teams that develop or use AI: model limitations, output verification, reporting problems.
AI lifecycle controls
Applying Annex A controls: data quality and provenance, model documentation, transparency towards users, human oversight, monitoring performance in operation.
Monitoring and internal audit
We measure the performance and incidents of AI systems, carry out the AIMS internal audit and the management review.
Improvement
Incidents and findings feed into improvements to models, data and processes.
The path to certification
Certification follows the standard two-stage model at an accredited body.
The prerequisite for everything: the system is implemented and applied in practice — every requirement of the standard met, the internal audit carried out and the management review completed.
The AI policy, an AI-system register, impact assessments and applicability of controls.
Checking application through interviews with teams and evidence of AI-system oversight in operation.
A certificate valid for 3 years.
Annual audits and recertification in the third year.
Benefits of Adopting the Standard
A systematic foundation for obligations under the EU AI Act and future domestic AI regulations.
Independent confirmation of responsible AI use sets you apart from competitors using AI 'blindly'.
Bias, hallucinations and data leaks through AI tools are managed before they become a media incident.
Among the first certified organisations in the region — a strong marketing and tender argument.
An illustrative, typical scenario we often hear from clients — it does not represent a specific, named client.
“We brought an AI tool into our work before we had given any thought to the risks — who checks the model's decisions, what happens if it gets something wrong, who is accountable. ISO/IEC 42001 forced us to build a register of AI systems, an impact assessment for each of them and real oversight of how the models behave in practice — for the first time we can answer the question of who is accountable if the AI gets it wrong.”
— a common scenario among our clients
Related standards
ISO 27001 is the natural foundation — they share a structure and approach to risk, and data security is a prerequisite for responsible AI. The NIST AI Risk Management Framework is the American counterpart, which maps onto AIMS controls, while EU AI Act obligations are largely covered by the standard's controls. ISO 27701 covers the privacy of data AI systems process.
ISO/IEC 42001 training — from a basic understanding of the standard to internal auditor training. Delivered at your premises, online or as a combination of both.
FAQ about ISO/IEC 42001:2023
Is ISO 42001 only for companies that develop AI?
No — the standard also covers organisations that merely use AI (purchased tools, AI features within software). Your role in the AI value chain determines which controls apply.
What's the connection to the EU AI Act?
The AI Act is a regulation with mandatory requirements by risk level; ISO 42001 is a management system that turns those obligations into a manageable, certifiable framework. They complement each other well.
How long does implementation take?
Usually 2 to 6 months, considerably faster if the organisation already has an ISO 27001 foundation. For large systems — over 500 employees, multiple locations or an integrated system of several standards — a project realistically runs beyond a year; we handle those clients too.
What is an AI system impact assessment?
An analysis of how an AI system affects individuals and groups — bias, discrimination, privacy, safety — with mitigation measures. A distinctive requirement of this standard.
How much does ISO 42001 implementation cost?
There is no fixed price that applies to everyone — the cost depends on the organisation's field of activity, its size and number of employees, the chosen standard and the current state of the system. Send us a short description of your organisation and we will prepare a free, tailored estimate.
Standards that fit together like a honeycomb
Each standard keeps its own shape, but together they form a single solid, integrated management system (IMS) — with no gaps or overlaps. Click a hexagon to open that standard.
More about the integrated management system
An integrated management system (IMS) combines two or more ISO standards — for example ISO/IEC 42001 with ISO 9001 or ISO 14001 — into one shared framework of documentation, objectives and internal reviews, instead of each standard living in its own parallel procedure.
A single structure (the High-Level Structure — HLS) shared by every modern ISO standard. Thanks to it, the quality policy, risk management, internal audits and management review can be common to several standards at once.
Each standard on its own addresses one part of the business — quality, environment, safety, information. When an organisation introduces several of them, separate systems quickly duplicate the same documentation and the same auditors.
Less duplicated procedure work, simpler management, stronger process oversight, more efficient use of resources and easier preparation for a combined certification audit.
ISO/IEC 42001 can be implemented on its own or as part of an integrated system — the decision depends on how many standards you're targeting and whether you're introducing them at once or gradually.
Check your organization's readiness
Answer a few questions and receive an indicative assessment of your organization's current level of readiness for ISO/IEC 42001.
This self-assessment provides an indicative readiness result only. It does not constitute certification, an official audit, or formal confirmation of compliance.
The EU, the US and other markets
ISO/IEC 42001 is the same standard wherever you certify it — what differs is the designation, the accreditation behind the certificate and what your customers ask for.
In the European Union the standard is adopted with an EN prefix, and what your buyer in the Netherlands, Germany or France looks at is not the prefix but the accreditation behind the certificate: a body accredited by a signatory of the international recognition arrangement (Global Accreditation Cooperation, formerly IAF) is recognised in other markets too. What EU partners and EU regulation expect is on the page about the EU market.
For companies with customers in the United States — supplier audits, security questionnaires and how ISO sits alongside SOC 2 — see the page about the US market.
Wherever your customer is, we run the project remotely in English — over Teams, WhatsApp or Viber, with documentation and records in English — and on site when that is easier.
Montenegro and the region: MEST ISO/IEC 42001:2023
When people ask about a MEST ISO/IEC 42001:2023 certificate (or a ISO/IEC 42001:2023 certificate), they mean the confirmation issued by an independent accredited certification body to an organisation whose system complies with every requirement of this standard. Montenegro's national edition of the standard carries identical content to the international edition — the same requirements, the same clauses, just under a national designation — which is why both designations turn up in tenders for the same standard.
Why do the designations differ if it's the same standard?
Every member country of the European and international standardisation system adopts the same standard into its own national catalogue and adds a national prefix — in Montenegro, that's MEST. The content, structure, clauses and every requirement an auditor checks during certification remain completely identical regardless of which designation appears on the document. That's why a certificate issued under one designation fully covers the other — it isn't two standards, but one and the same, simply under two names.
Our core activity is standards implementation and rollout: we prepare your organisation so the certification audit goes without surprises, and we explain terms like "ISO/IEC 42001:2023 certification" and "MEST ISO/IEC 42001 certificate" because that's exactly how clients search for them. What certification, accreditation, IAF and surveillance audits involve — read the Certification / ISO Certificate page, and about tender designations on the ISO Standards in Tenders page.
Montenegro is where we work from: our consultants are based in Podgorica, Budva and Bijelo Polje, documentation and training come in Montenegrin or in English, and the certificate itself is issued by an independent accredited certification body — not by us. We work on site in Serbia, Bosnia and Herzegovina, Croatia, North Macedonia, Albania and Kosovo as well — more about what we do in Montenegro.
Some of our references
More than 400 organisations in Montenegro and the region have gone through implementation with us — from banks and public bodies to manufacturing, IT, laboratories and hospitality.
These are only some of our clients. More about us →
Request a free consultation
We will assess the scope of work and propose a realistic plan and budget for your organisation. Call us or send an inquiry — we reply within 24 hours.