ISO/IEC 42001 certifies a management system, not a model

Procurement teams now routinely ask AI vendors whether they are certified to ISO/IEC 42001. The standard, published in 2023, sets requirements for an AI management system: the policies, roles, risk processes and controls an organisation uses to develop, provide or use AI responsibly. What a certificate attests is that an organisation has such a system, within a stated scope, and that an accredited certification body has audited it against the standard.

That is different from certifying a model. A certificate does not state that a particular model is accurate, unbiased or safe. It says something about how the organisation manages AI: that it has set an AI policy, assessed risks and impacts, assigned responsibilities, and put controls in place and checked that they operate. This is valuable, in the way a quality management certificate is valuable, and it is easily misread.

An auditor looks at a recognisable set of things. The scope of the system. The AI policy and the objectives behind it. How risks and impacts on people are assessed. The roles and competence of those responsible. The Statement of Applicability, which lists the Annex A controls the organisation has chosen to apply and justifies any it has excluded. Then evidence that the system actually operates: internal audit results and management review records.

This gives buyers something concrete to ask. Request the scope statement, and check whether the products you plan to use fall within it. Ask for the Statement of Applicability and read which controls were excluded and why. Confirm that the certification body is accredited. A certificate that covers one site or one product line says little about a different one.

For an organisation considering its own certification, the order of work matters. Begin with an inventory of the AI systems in use or development, each with a named owner and a recorded purpose. Most organisations discover they have more AI than they thought, and some of it has no owner. Certification follows from a system that already works, and it is much easier to audit a system that exists than to build one for the audit.

Certification is also not a safe harbour. It does not replace sector regulation or contractual obligations, and it does not remove the board's responsibility for how AI is used. It is better read as evidence of discipline. Three questions to put to any supplier holding the certificate: what is in scope, which controls did you leave out, and when were you last audited?