ISO/IEC 42001:2023 is an international standard for AI management systems. It is voluntary, and organisations can have their set-up independently certified against it. If a customer, a board member or a supplier has mentioned it and you nodded along, this guide is for you. An AI register can supply the inventory, the owners and the evidence that kind of system is missing. Moustr is not certified to ISO/IEC 42001, and it does not certify you.
What this guide is not
It is not the standard. ISO sells the standard, and we have not reproduced any of it. What follows is a plain-English summary in our own words, and it is not a substitute for the real text.
It is not legal advice, and it is not a route to certification. Moustr does not certify compliance with ISO/IEC 42001 or any other framework. If you are thinking about certification, talk to a certification body. If you have a question about the law, talk to a lawyer.
What is an AI management system?
Read the phrase one word at a time. An AI management system is the set of people, rules and routines an organisation uses to run its AI on purpose. It covers who is responsible, how decisions get made, how risks are looked at, and how all of it is checked and improved.
The word that matters is system. A policy is a document that says what you intend. A system is what makes it happen on a Tuesday afternoon, with a named person, a record and a date. A policy is one part of a system. It isn't the whole thing.
ISO's own page describes the approach as Plan, Do, Check, Act. You plan, you do, you check, and you act on what you found. Then you go round again.
Is an AI policy the same as an AI management system?
No, though it's easy to write a policy and feel finished. That feels reasonable. The policy is real work, and it's a good start.
But picture the questions someone might ask next. Which AI systems do you use? Who owns each one? How was the risk looked at? What changed last quarter, and what did you do about it? A policy can't answer those. A working system can, because it keeps the records as it goes.
In short, an AI policy is not an AI management system.
What does an AI management system cover?
We're not quoting the standard, and we're not giving its clause numbers. In plain words, an AI management system is meant to answer questions like these:
- What are we governing, and for whom? Setting the boundary: which AI, which parts of the organisation, which people affected.
- Who owns it? Leaders commit, and named roles carry accountability.
- What could go wrong, and what matters? Looking at risk, and at the effect on people, and deciding what to do about each.
- Do people have what they need? Time, skills, awareness and controlled documents.
- Are the planned controls really carried out? Assessments and supplier records that show it.
- What about the data, and life after launch? Where data comes from and how good it is, and keeping an eye on each system after go-live, not only at approval.
- How do we know it works, and what happens when it doesn't? Measuring, internal review, management review, and fixing causes.
The standard also includes controls that organisations can draw on. To see how AI turns up in a company in the first place, read Nobody bought most of this.
Is ISO 42001 mandatory, and how does it relate to the EU AI Act?
No. ISO/IEC 42001 is voluntary, and the EU AI Act is a law, so they are separate. A management system built around the standard can support an organisation's AI governance work, but it doesn't replace the Act and doesn't by itself show that an organisation meets it. A customer or a tender may ask for it. For what the law asks of your organisation, see our EU AI Act guide and ask a lawyer.
How does certification work?
ISO doesn't certify organisations itself. Independent certification bodies do, and national accreditation bodies may accredit them. Certification is voluntary. A separate standard, ISO/IEC 42006, sets requirements for the bodies that audit and certify AI management systems. If you want a certificate, ask a certification body how its audits work.
Who is ISO 42001 for?
It is written for organisations that develop, provide or use AI, including AI from suppliers. So it isn't only for the companies building models. If your team uses AI tools that someone else made, you are in the picture too. Buying the AI doesn't mean the questions about it go away.
Four myths, answered
"We have an AI policy, so we have governance."
A policy is one part. A management system also has to run, be checked and get better.
"ISO 42001 is mainly for AI developers."
It is for organisations that develop, provide or use AI.
"An AI inventory means we're covered."
An inventory shows what exists. It doesn't show whether it's governed.
"Certification means no AI incident will happen."
Certification looks at the management system. It isn't a guarantee that every output will be safe or correct.
Where does an AI register fit in?
A register is a list of the AI an organisation uses, with an owner and key facts for each. Organisations working towards ISO/IEC 42001 may find a register useful, because it can help them see what they are governing before they decide how. ISO's own free explainer lists finding where AI systems are used among the practical first steps. A register is not the same as being certified, and having one doesn't mean you meet the standard. Our guide to building an AI register, register guide, shows what one can look like.
Where do you start?
You can start without a new tool and without a budget:
- Ask who in your organisation owns AI today, and write their names down.
- List the AI tools you know about, and mark the ones nobody has looked at.
- Read your AI policy, and ask what happens in practice for each line.
- Pick one tool and write down its owner, its purpose and the data that goes in.
- Set a date to look again.
If you already hold a list, you can check what your AI list can prove.
If you'd like to see how Moustr keeps that kind of record, how it works is the place to start. Its page describes the approach as "Not a project. Not an audit.": a small recurring cycle, owned by named people at defined cadences, that keeps the estate known and accountable.
Short answers to common questions
What is ISO 42001?
ISO/IEC 42001 is an international standard for AI management systems. It sets out what an organisation can put in place to run its AI on purpose.
What is an AI management system?
It's the set of people, rules and routines an organisation uses to run its AI. It covers who is responsible, how decisions get made, how risks are looked at, and how the whole thing is checked and improved. It is more than a policy document.
Is ISO 42001 mandatory?
No. It's a voluntary standard, not a law. An organisation can choose to work towards it, to be certified against it, or to do neither.
Is an AI policy the same as an AI management system?
No. A policy says what an organisation intends. A management system is what makes it happen, with named people, records and a routine for checking and improving. A policy is one part of it.
How does ISO 42001 relate to the EU AI Act?
They are separate. The EU AI Act is a law, and ISO/IEC 42001 is a voluntary standard. A management system built on the standard can support an organisation's AI governance work. This guide doesn't tell you what the law asks of your organisation. A lawyer can.
Who is ISO 42001 for?
Organisations that develop, provide or use AI, including AI made by suppliers.
What's the difference between being certified and using it as a guide?
Certification is an independent assessment against the standard. An organisation can also use the standard as a reference without being certified. Moustr does not certify compliance with ISO/IEC 42001.
Where should a small organisation start?
With a list of the AI in use and an owner for each item. Then ask the questions above, one tool at a time. A simple, true record is a better start than a thick binder.
Back to the nod
Next time someone mentions ISO 42001 you can say what it is. It's a voluntary standard for running AI as a system and not as a one-off policy. It isn't a substitute for the law, and it doesn't promise that nothing will go wrong. It asks whether you know your AI, whether someone owns it and whether you can show it.
If you'd like help seeing which AI you use, you can Start your 7 days. More guides are on our Resources page.
Sources
- ISO, ISO/IEC 42001:2023, standard for AI management systems, ISO's product page, read 28 October 2026. This guide describes the standard in our own words and does not reproduce it. ISO sells the standard.
- ISO, ISO/IEC 42001 explained, ISO's free explainer, read 29 October 2026.
- ISO, ISO/IEC 42006:2025, requirements for bodies that audit and certify AI management systems, ISO's product page, read 28 October 2026.
- Moustr, How it works, read 28 October 2026. Describes Moustr's own product.
Last updated: 2 November 2026
Moustr does not give legal advice and does not certify compliance with any law or framework. This guide is practical and for orientation only.
