ISO/IEC 42001

ISO/IEC 42001 is the AI-era counterpart to ISO 27001: the first international standard for running artificial intelligence as a governed management system. As models move into regulated workflows, it gives an organization a certifiable way to show it assesses AI risk and impact, governs its data, and maintains transparency and accountability — not as a one-time pledge but as an audited, continually-improved process.

• The management-system pattern, applied to AI - Risk assessment, impact assessment, controls, and continual improvement, the same shape as ISO 27001, scoped to AI systems.
• Governance you can certify - A third-party certificate, which is quickly becoming a differentiator in AI-adjacent procurement.
• Early but rising - Published in 2023, it is the frame organizations reach for as AI governance moves from policy to proof.

I catalogue ISO 42001 because it showed up in a place worth noting: an ambient clinical-AI scribe (Heidi Health) carrying it as one of its trust attestations was, in the healthcare cohorts I scored, one of the only explicit AI-governance signals in the field. As agents and models take on more of the clinical and financial workflow, this is the standard that will separate ‘we use AI’ from ‘we govern the AI we use’ — and, like every certification, it is a posture signal that still has to be matched by machine-legible consent and control surfaces to matter to the agent itself.