--- id: CP-377 slug: iso-42001-ai-management-system lang: en title: ISO 42001, the AI management system standard description: "ISO/IEC 42001 and AI at work: what the sources say about the EU regulation, the NIST framework and guidance for employees." canonical_url: https://startbrain.io/cyberpedia/en/articles/iso-42001-ai-management-system/ markdown_url: https://startbrain.io/cyberpedia/en/articles/iso-42001-ai-management-system.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "ISO 42001, the AI management system standard", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/iso-42001-ai-management-system/ (CC BY 4.0) wing: 6 theme: authorized_tools reflex: air-010 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/iso-42001-ai-management-system/ fr: https://startbrain.io/cyberpedia/fr/articles/iso-42001-management-ia/ de: https://startbrain.io/cyberpedia/de/articles/iso-42001-ki-managementsystem/ es: https://startbrain.io/cyberpedia/es/articles/iso-42001-gestion-ia/ sources: - "n": 1 title: AI Act publisher: European Commission url: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai accessed: "2026-11-03" - "n": 2 title: AI Risk Management Framework publisher: NIST url: https://www.nist.gov/itl/ai-risk-management-framework accessed: "2026-11-03" - "n": 3 title: Artificial Intelligence Risk Management Framework (AI RMF 1.0) publisher: NIST url: https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10 published: "2023-01-26" accessed: "2026-11-03" - "n": 4 title: NIST AI RMF Playbook publisher: NIST url: https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook published: "2022-07-08" accessed: "2026-11-03" - "n": 5 title: Guidelines for secure AI system development publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development published: "2023-11-27" accessed: "2026-11-03" - "n": 6 title: Intelligence artificielle | CNIL publisher: CNIL url: https://www.cnil.fr/fr/intelligence-artificielle accessed: "2026-11-03" --- # ISO 42001, the AI management system standard This entry covers ISO/IEC 42001, but the sources cited here do not describe it. None of them mentions its content, its timeline or its certification procedure, so nothing is asserted here on those points. The entry relies on what the sources say about neighbouring texts: the European AI regulation, the NIST AI RMF framework and the British security guidelines. They show what an AI governance framework is for, and what it changes for employees and for management. ## In 30 seconds - What it is: a standard about which the sources cited here say nothing, neither its content nor its purpose. - For employees: the European regulation has imposed AI literacy obligations since 2 February 2025 [1]. - For management: the neighbouring NIST framework is voluntary [2][3], whereas the European regulation has applied since 2 August 2026, with exceptions [1]. - The reflex: use an AI tool only within your organisation's rules, and ask what is authorised before putting data into it. ## Straight answers ### Is ISO 42001 mandatory? The sources cited here do not discuss it. They describe two different texts. The European AI regulation is a legal framework [1]. The NIST AI RMF, for its part, is designed for voluntary use [2][3]. For ISO 42001, this entry does not settle the question: the text of the standard must be consulted. ### How does it relate to the European AI regulation? Regulation (EU) 2024/1689 sets risk-based rules for developers and professional users of AI [1]. The Commission page states that harmonised standards are meant to ease the application of the rules, and reports the publication in the Official Journal, on 19 October 2026, of the first harmonised standard supporting the regulation [1]. It does not say which standard this is. ### How does it relate to the NIST AI RMF? The NIST AI RMF is a US framework published on 26 January 2023. It helps organisations that design, develop, deploy or use AI systems to manage risks [3]. It is voluntary and sector-agnostic [3]. Its companion playbook is organised around four functions: Govern, Map, Measure and Manage [4]. The NIST page states that version 1.0 is being revised [2]. ### Is certification required? No source cited here discusses certification. The angle of this entry (a voluntary certification that can help demonstrate compliance) therefore remains to be checked against the text of the standard. ## What it changes for employees An AI governance framework is mostly visible through usage rules. The sources cited here give reference points on the law, transparency and data. On the legal side, the European regulation's AI literacy obligations have applied since 2 February 2025 [1]. The Commission page points to a repository of exchanges on AI training, dated 4 February 2025 [1]. On transparency, the regulation provides that people must know they are talking to a machine when they use a chatbot. Some AI-generated content must be labelled, notably deepfakes [1]. According to the page, these transparency rules come into force in August 2026 [1]. On data, the CNIL publishes a poster titled "IA générative et vie privée", co-produced with the South Korean authority PIPC, to explain how to protect one's personal data when using AI [6]. The date given is 27 May 2026 [6]. Some uses bear directly on work: the regulation's list of high-risk uses names AI tools for employment and worker management, such as CV sorting for recruitment [1]. The regulation also bans emotion recognition in the workplace [1]. ## What it changes for management The NCSC guidelines, published on 27 November 2023, recommend building an organisation and leadership in which security by design is a business priority [5]. They are also aimed at managers, decision-makers and risk owners [5]. They break a system's life cycle into four stages: design, development, deployment, operation and maintenance [5]. Development covers supply chain security and documentation [5]. Deployment covers incident management [5]. NIST states that its framework and playbook can be used selectively: an organisation adopts as many suggestions as its sector or interests justify [4]. The playbook draws on good practice and research [4]. For high-risk systems, the regulation lists obligations: risk assessment and mitigation, dataset quality, logging, documentation, information for the professional user, human oversight, robustness and cybersecurity [1]. Professional users carry out human oversight and monitoring, and providers put post-market monitoring in place [1]. ## What the text says The sources cited here do not contain the text of ISO/IEC 42001. Here is what the neighbouring texts say. - The European regulation defines four risk levels: unacceptable, high, transparency, minimal or none [1]. - Nine practices are banned. The first eight have been banned since February 2025, and the ninth (systems that generate non-consensual sexual content or child sexual abuse material) will be in December 2026 [1]. - The NIST AI RMF aims to build trustworthiness considerations into the design, development, use and evaluation of AI products and services [2]. - On 26 July 2024, NIST published a generative AI profile, NIST-AI-600-1 [2]. ## Where implementation stands According to the Commission, the regulation entered into force on 1 August 2024 and has applied since 2 August 2026, with exceptions [1]. The governance rules and those on general-purpose AI models have applied since 2 August 2025 [1]. For high-risk systems in certain areas, including employment, the date is 2 December 2027. For those built into regulated products, it is 2 August 2028 [1]. This postponement results from a simplification text known as the "AI Omnibus", which entered into force on 27 July 2026 [1]. On the US side, NIST states that AI RMF 1.0 is being revised under the White House AI action plan [2]. It also published, on 7 April 2026, a concept note for a trustworthy AI profile in critical infrastructure [2]. What is not verified: the content of ISO/IEC 42001, its official link with the European regulation, and the conditions for certification. For these points, the standard itself or a source that describes it must be read. ## Sources 1. European Commission, "AI Act". https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai (accessed 3 November 2026) 2. NIST, "AI Risk Management Framework". https://www.nist.gov/itl/ai-risk-management-framework (accessed 3 November 2026) 3. NIST, "Artificial Intelligence Risk Management Framework (AI RMF 1.0)", 26 January 2023. https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10 (accessed 3 November 2026) 4. NIST, "NIST AI RMF Playbook", 8 July 2022. https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook (accessed 3 November 2026) 5. NCSC (UK), "Guidelines for secure AI system development", 27 November 2023. https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development (accessed 3 November 2026) 6. CNIL, "Intelligence artificielle | CNIL". https://www.cnil.fr/fr/intelligence-artificielle (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/iso-42001-ai-management-system/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.