ISO 42001 anchors

Stefan Coetzeecreated 2026-05-12updated 2026-05-124 min readanchors
Vault note, not reviewed against the source. Written in the knowledge vault on 2026-05-12 by models working with Stefan Coetzee and published as it stands, with private addresses, e-mail addresses and an employer name redacted. Check claims against the primary source before relying on them.

Primary documents, operating bodies, audit providers, related standards, named voices, reference resources for the ISO 42001 cluster.

Primary normative documents

  • ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system. Published 18 December 2023. Available from iso.org (CHF 173 / ~€180 single-user PDF) and national standards bodies.
  • ISO/IEC 22989:2022 — Artificial intelligence concepts and terminology. Vocabulary reference.
  • ISO/IEC 23053:2022 — Framework for AI systems using ML. Useful terminology and ML lifecycle reference.
  • ISO/IEC 23894:2023 — AI risk management guidance. Companion to ISO 42001 risk content.
  • ISO/IEC 5338:2023 — AI system life cycle processes. Deep on the lifecycle concept.

Standards in development (relevant)

  • ISO/IEC 42005 — AI system impact assessment. Will deepen the impact-assessment content currently at policy level in 42001.
  • ISO/IEC 42006 — Requirements for bodies providing audit and certification of AI management systems. Will formalize certification body accreditation criteria.
  • ISO/IEC 27090 — AI security. Will bridge ISO 27001 and ISO 42001 security concerns.
  • ISO/IEC 27091 — AI privacy. Will bridge ISO 27701 and ISO 42001 privacy concerns.
  • ISO/IEC TR 5469:2024 — Functional safety and AI systems. Safety-critical AI context.

Owning body

  • ISO/IEC JTC 1/SC 42 — joint technical committee subcommittee on Artificial Intelligence. Established October 2017. Multiple working groups:
    • WG 1: Foundational standards
    • WG 2: Data
    • WG 3: Trustworthiness
    • WG 4: Use cases and applications
    • WG 5: Computational approaches and characteristics
    • JWG 1 (with SC 27): Trustworthiness — interdisciplinary work on AI security and privacy
    • Several joint working groups with other subcommittees

Chair leadership rotates; the subcommittee draws members from national bodies and liaison organizations worldwide.

Certification bodies (early adopters)

Bodies that started offering ISO 42001 certification in late 2024 / early 2025 (illustrative, not exhaustive):

  • BSI Group — UK origin, global. Early to market.
  • DNV — Norwegian origin, global.
  • TÜV Süd, TÜV Rheinland, TÜV Nord — German technical inspection bodies.
  • LRQA — global.
  • SGS — Swiss, global.
  • Schellman — US-origin, also offering combined SOC 2 + ISO 27001 + ISO 42001 audits.
  • A-LIGN — US-origin, similar combined offerings.
  • PECB — emerging accreditation in this space.

Accreditation status for ISO 42001 is still developing under ISO/IEC 17021-1; ISO/IEC 42006 (in development) will formalize the AIMS-specific certification body requirements. Buyers should expect more rigorous accreditation enforcement once 42006 is published.

  • NIST AI Risk Management Framework 1.0 (January 2023) + GenAI Profile (NIST AI 600-1, July 2024) — voluntary US framework. Four functions: Govern, Map, Measure, Manage. Complementary; mapping documents emerging.
  • EU AI Act (Reg 2024/1689) — regulatory; not a framework. ISO 42001 likely to be harmonized under it.
  • OECD AI Principles (2019, updated 2024) — voluntary international principles. Influence on national policies.
  • UNESCO Recommendation on the Ethics of AI (2021) — voluntary international principles.
  • Singapore Model AI Governance Framework (2020, GenAI extension 2024) — voluntary, widely-referenced practical guidance.
  • UK AI Action Plan / DSIT AI policy work — voluntary; pro-innovation regulatory approach.
  • OWASP LLM Top 10 (2023, 2024 revision / 2025 published Nov 2024) — operational application-security taxonomy.
  • MITRE ATLAS — adversarial threat landscape for AI systems.
  • MITRE AI-RMF mapping — bridges MITRE work and NIST AI RMF.

Sector-specific AI standards / guidance

  • Financial services: BIS (Bank for International Settlements) work, FSB (Financial Stability Board) papers, ESMA / ECB / Fed AI guidance.
  • Healthcare: FDA AI/ML SaMD guidance (USA), MHRA (UK), EMA (EU), IMDRF Working Group on AI/ML medical devices.
  • Automotive: extensions of UN R155 / R156 for AI-enabled vehicle systems; ISO/SAE work on AI-specific safety considerations.
  • Critical infrastructure: NERC CIP AI extensions in development, ENISA AI work for EU operators.

Named practitioners and reference voices

Standards work

  • Wael William Diab — long-standing JTC 1/SC 42 chair; widely interviewed on the standard's development.
  • Various SC 42 WG leads — convenors of working groups whose names appear in liaison documents.
  • The Open Group AI Forum — adjacent standardization work.
  • NIST AI team — Reva Schwartz, Apostol Vassilev, others. NIST AI RMF / AISI work.

Practitioner-side

  • Reid Blackman — AI ethics consultant, "Ethical Machines" author.
  • Cathy O'Neil — "Weapons of Math Destruction"; algorithmic bias frame.
  • Timnit Gebru, Margaret Mitchell — DAIR / Stochastic Parrots / Model Cards work.
  • Anthropic Constitutional AI team — RLAIF, Constitutional AI papers.
  • Yann LeCun, Yoshua Bengio, Geoffrey Hinton — AI risk landscape voices (varied positions).
  • Andrew Ng — practical AI risk framing.
  • Stuart Russell — "Human Compatible"; AI safety long view.

Critical voices

  • Emily Bender — linguist, critical of LLM capability claims; stochastic-parrots co-author.
  • Gary Marcus — critical of deep-learning-only AGI claims; advocate for hybrid approaches.
  • Various AI Safety Institute alumni — RAND, METR, Anthropic / OpenAI safety teams.

Audit and consultancy practitioners

  • Big Four AI risk consulting practices (KPMG, Deloitte, PwC, EY) — published guidance on ISO 42001 implementation.
  • Boutique AI governance consultancies emerging 2024-2026.

Reference resources

  • iso.org/standard/81230.html — ISO 42001 official page; PDF purchase.
  • NIST AIRC (airc.nist.gov) — NIST AI Resource Center, framework and playbook content.
  • JTC1/SC 42 SharePoint — working documents (committee access only).
  • AI Verify Foundation (Singapore) — open-source AI governance toolkit, references ISO 42001 alignment.
  • Various industry-specific compliance vendor platforms — Drata, Vanta, Secureframe, Tugboat Logic, others — adding ISO 42001 readiness modules through 2024-2025.

Regulatory and procurement-driver context

  • EU AI Act (Reg 2024/1689) — regulatory pressure. Risk-tier obligations 2026-2027.
  • EU GDPR (Reg 2016/679) — overlaps with ISO 42001 data handling; ISO 27701 PIMS extension complementary.
  • US Executive Orders on AI — EO 14110 (October 2023, rescinded January 2025), follow-on EOs through 2025-2026. NIST AI RMF as preferred reference for federal AI work.
  • UK NCSC + DSIT AI guidance — voluntary; pro-innovation framing.
  • Sector regulator publications — financial services regulators, healthcare regulators, transport regulators all publishing AI guidance increasingly.

See also