ISO/IEC 42001
Set up an AI management system that governs how your organisation develops, provides and uses AI.
ISO/IEC 42001: what it is and why it matters
ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an artificial intelligence management system. It is written for organisations that develop, provide or use AI-based products and services.
The standard follows the same management system structure as ISO/IEC 27001 and ISO 22301, so it can sit alongside systems you already run. Its subject is governance: policy, roles, risk and impact assessment, the AI system life cycle, data, and oversight of third parties.
Built for the people who carry the work
- AI, data and technology leaders who need a governance structure around AI use
- Risk, compliance and information security managers taking on AI oversight
- Internal auditors and consultants who assess AI governance
- Product owners who build or buy AI-enabled services
What you will be able to do
- Explain what an AI management system is and how its clauses form a management cycle
- Define the scope and context of an AI management system
- Plan AI risk assessment and AI system impact assessment activities
- Describe how Annex A controls support responsible AI use
- Prepare for internal audit and for review by a certification body
Subject outline
- 01
Context, scope and leadership commitment
- 02
AI policy, roles and responsibilities
- 03
Risk and impact assessment for AI systems
- 04
AI system life cycle and data management
- 05
Third-party and supplier relationships
- 06
Operation, monitoring and internal audit
- 07
Management review and continual improvement
How it supports real work
Building an inventory of AI systems and assigning an accountable owner to each
Writing an AI policy that product and engineering teams can follow
Connecting AI risk work to an existing information security or risk process
Training, examination and certification are different steps
ISO/IEC 42001 is certifiable at organisation level. Training builds understanding, but certification of an organisation is awarded after an audit by a certification body.
- Training builds knowledge. It does not certify your organisation.
- Organisational certification is awarded by certification bodies after an audit.
- Personal credentials, where they exist, are issued by third-party bodies under their own rules.
What is confirmed, and what people ask
Delivery information
Delivery details for this course have not been confirmed for publication, so none are listed here. Course length, schedule, language, delivery format and fees are confirmed per enquiry. Certification bodies set their own exam and eligibility rules, and we confirm the route to any certificate before you enrol.
Enquire About This CourseFrequently asked questions
Is ISO/IEC 42001 a law or regulation?
No. It is a voluntary international standard. Whether a law applies to your AI use is a separate legal question.
Can my organisation be certified against it?
Yes. Certification is carried out by certification bodies through an audit of your management system.
Does it replace ISO/IEC 27001?
No. They address different subjects, and because they share a structure they can be run together.
Does the course certify me personally?
Not automatically. Personal credentials depend on the issuing body. Ask us which route applies before you enrol.
Related courses
Related Valtrenix services
Request course information
Tell us who the training is for and what you want to achieve. We reply with confirmed details only, including what is currently available for ISO/IEC 42001.
- Individual and team training enquiries welcome
- No fees, dates or formats are published until confirmed
- We confirm the certification route before you enrol