August 2026. ISO/IEC 42001 for AI management systems is increasingly requested alongside ISO 27001, by enterprise customers, supervisors and internal AI initiatives. It is not a parallel universe: AI governance belongs in the same risk and improvement register as security.
Why ISO 42001 now?
The EU AI Act sets duties for high-risk AI; ISO 42001 offers an auditable management system for impact, data, transparency and human oversight. Certification is optional, but the framework helps due diligence and internal governance.
- inventory: which AI systems, models and datasets are in scope;
- risks: bias, privacy, security, chain (APIs, subprocessors);
- controls: human oversight, logging, change management for models;
- evidence: model cards, test results, approvals in management review.
Link to ISO 27001
Use one ISMS structure: scope, SoA, internal audit, CAP. Tag AI-specific controls in Annex A and ISO 42001. Link to ISO 42001 hub, ISMS and GDPR pages.
Roadmap for SMEs
- AI register: name, purpose, data, owner, customer impact.
- Gap vs AI Act + ISO 42001, prioritise high-risk use cases.
- Policy for generative AI (Copilot, ChatGPT): what may/may not go in prompts.
- Quarterly review in management review, metrics and incidents.
In 2026 procurement explicitly asks for AI governance alongside security questionnaires. One source of truth saves weeks per RFP.
Start small: one product line or internal chatbot as pilot. Document lessons before rolling out the full portfolio, auditors value phased implementation with rationale.