Cyberpediaby Brain
ENDEFR

ISO 42001, the AI management system standard

ISO/IEC 42001 and AI at work: what the sources say about the EU regulation, the NIST framework and guidance for employees.

In 30 seconds

What it is
A standard about which the sources cited here say nothing, neither its content nor its purpose.
For employees
The European regulation has imposed AI literacy obligations since 2 February 20251.
For management
The neighbouring NIST framework is voluntary23, whereas the European regulation has applied since 2 August 2026, with exceptions1.
The reflex
Use an AI tool only within your organisation's rules, and ask what is authorised before putting data into it.

What it is

This entry covers ISO/IEC 42001, but the sources cited here do not describe it. None of them mentions its content, its timeline or its certification procedure, so nothing is asserted here on those points.

The entry relies on what the sources say about neighbouring texts: the European AI regulation, the NIST AI RMF framework and the British security guidelines. They show what an AI governance framework is for, and what it changes for employees and for management.

Straight answers

Is ISO 42001 mandatory?

The sources cited here do not discuss it. They describe two different texts. The European AI regulation is a legal framework1. The NIST AI RMF, for its part, is designed for voluntary use23. For ISO 42001, this entry does not settle the question: the text of the standard must be consulted.

How does it relate to the European AI regulation?

Regulation (EU) 2024/1689 sets risk-based rules for developers and professional users of AI1. The Commission page states that harmonised standards are meant to ease the application of the rules, and reports the publication in the Official Journal, on 19 October 2026, of the first harmonised standard supporting the regulation1. It does not say which standard this is.

How does it relate to the NIST AI RMF?

The NIST AI RMF is a US framework published on 26 January 2023. It helps organisations that design, develop, deploy or use AI systems to manage risks3. It is voluntary and sector-agnostic3. Its companion playbook is organised around four functions: Govern, Map, Measure and Manage4. The NIST page states that version 1.0 is being revised2.

Is certification required?

No source cited here discusses certification. The angle of this entry (a voluntary certification that can help demonstrate compliance) therefore remains to be checked against the text of the standard.

1What it changes for employees1 min

An AI governance framework is mostly visible through usage rules. The sources cited here give reference points on the law, transparency and data.

On the legal side, the European regulation's AI literacy obligations have applied since 2 February 20251. The Commission page points to a repository of exchanges on AI training, dated 4 February 20251.

On transparency, the regulation provides that people must know they are talking to a machine when they use a chatbot. Some AI-generated content must be labelled, notably deepfakes1. According to the page, these transparency rules come into force in August 20261.

On data, the CNIL publishes a poster titled "IA générative et vie privée", co-produced with the South Korean authority PIPC, to explain how to protect one's personal data when using AI6. The date given is 27 May 20266.

Some uses bear directly on work: the regulation's list of high-risk uses names AI tools for employment and worker management, such as CV sorting for recruitment1. The regulation also bans emotion recognition in the workplace1.

2What it changes for managementManagement1 min

The NCSC guidelines, published on 27 November 2023, recommend building an organisation and leadership in which security by design is a business priority5. They are also aimed at managers, decision-makers and risk owners5. They break a system's life cycle into four stages: design, development, deployment, operation and maintenance5. Development covers supply chain security and documentation5. Deployment covers incident management5.

NIST states that its framework and playbook can be used selectively: an organisation adopts as many suggestions as its sector or interests justify4. The playbook draws on good practice and research4.

For high-risk systems, the regulation lists obligations: risk assessment and mitigation, dataset quality, logging, documentation, information for the professional user, human oversight, robustness and cybersecurity1. Professional users carry out human oversight and monitoring, and providers put post-market monitoring in place1.

3What the text saysOfficial text1 min

The sources cited here do not contain the text of ISO/IEC 42001. Here is what the neighbouring texts say.

  • The European regulation defines four risk levels: unacceptable, high, transparency, minimal or none1.
  • Nine practices are banned. The first eight have been banned since February 2025, and the ninth (systems that generate non-consensual sexual content or child sexual abuse material) will be in December 20261.
  • The NIST AI RMF aims to build trustworthiness considerations into the design, development, use and evaluation of AI products and services2.
  • On 26 July 2024, NIST published a generative AI profile, NIST-AI-600-12.
4Where implementation stands1 min

According to the Commission, the regulation entered into force on 1 August 2024 and has applied since 2 August 2026, with exceptions1. The governance rules and those on general-purpose AI models have applied since 2 August 20251. For high-risk systems in certain areas, including employment, the date is 2 December 2027. For those built into regulated products, it is 2 August 20281. This postponement results from a simplification text known as the "AI Omnibus", which entered into force on 27 July 20261.

On the US side, NIST states that AI RMF 1.0 is being revised under the White House AI action plan2. It also published, on 7 April 2026, a concept note for a trustworthy AI profile in critical infrastructure2.

What is not verified: the content of ISO/IEC 42001, its official link with the European regulation, and the conditions for certification. For these points, the standard itself or a source that describes it must be read.

Fact sheet

Identifier
CP-377
Wing
6. Governance and GRC
Brain skill
Authorized AI Tools & Shadow AI (authorized_tools)
Brain reflex
air-010
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
6 sources checked on 3 November 2026
Sources6 sources
  1. European Commission, “AI Act”. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai (accessed 3 November 2026)
  2. NIST, “AI Risk Management Framework”. https://www.nist.gov/itl/ai-risk-management-framework (accessed 3 November 2026)
  3. NIST, “Artificial Intelligence Risk Management Framework (AI RMF 1.0)”, 26 January 2023. https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10 (accessed 3 November 2026)
  4. NIST, “NIST AI RMF Playbook”, 8 July 2022. https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook (accessed 3 November 2026)
  5. NCSC (UK), “Guidelines for secure AI system development”, 27 November 2023. https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development (accessed 3 November 2026)
  6. CNIL, “Intelligence artificielle | CNIL”. https://www.cnil.fr/fr/intelligence-artificielle (accessed 3 November 2026)

Cite this article

Brain, “ISO 42001, the AI management system standard”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/iso-42001-ai-management-system/

BibTeX 
@misc{brain_cp377_en_2026,
  author = {Brain},
  title = {ISO 42001, the AI management system standard},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/iso-42001-ai-management-system/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence