ISO 42001 Certification: The Complete 2026 Guide

ISO 42001 certification is the first widely cited, certifiable mark for an Artificial Intelligence Management System. ISO/IEC 42001:2023 tells a certification body whether you established, run, and improve that AIMS. It does not mean Packets, a GRC tool, or a consultant can print a certificate. An accredited body issues it after Stage 1 and Stage 2. Management still signs the representations.

Packets' beachhead is AI-native Indian SaaS selling to US and EU enterprise without a dedicated security hire. In 2026 those buyers ask AI-governance questions in the same thread as ISO 27001. Software vendors including Vanta, Drata, Scrut, and Secureframe now list dedicated ISO 42001 support. That is why this hub publishes in Week 1, not after a year of SOC 2 explainers. An iso 42001 certification program still needs an owner. A framework tile in a tool is not the AIMS.

What iso 42001 certification actually covers

ISO 42001 is a management system standard: policies, objectives, and processes for responsible development, provision, or use of AI systems, using Plan-Do-Check-Act. Clauses 4 through 10 will look familiar if you already run ISO 27001. Annex A is a different catalog. It covers AI policy, organization, resources, impact assessment, lifecycle, data for AI, information for interested parties, use of AI, and third parties. Official overview: ISO/IEC 42001.

iso 42001 certification is voluntary. It is not a court finding under the EU AI Act. It can feed technical documentation and operating evidence that legal and procurement will ask for. It cannot replace counsel. See Packets' AI governance page for the product entry.

ISO 42001 vs ISO 27001 vs SOC 2

ISO 27001 protects information. ISO 42001 governs AI systems and their impact on people. You reuse audit cadence, document control, and management review. You do not reuse the Annex A list. Teams that already hold an ISMS recognize the pattern. Teams that only hold a SOC 2 report should not expect AI governance to appear as a leftover control. SOC 2 never covered impact assessments or data-for-AI quality. Sequence that decision on what comes after SOC 2 and the ISO 27001 hub.

If your product is the model, plan iso 42001 certification beside the ISMS, not as a sticker after the ISMS is "done."

What to put in place before you talk to a certification body

• AIMS scope: which AI systems, vendors, and use cases are in.
• Inventory that includes shadow LLM tools, not only the branded product model.
• AI policy that matches production, not a downloaded template.
• At least one documented AI system impact assessment on the system in live deals.
• Data-for-AI provenance and quality rules you can show.
• Internal audit and management review of the AIMS before Stage 2.
• A named owner. Packets can be that specialist. The tool cannot.

Stage 1 is typically a documentation and readiness review. Stage 2 tests whether the AIMS operates. Public write-ups often put the calendar in a range of months, not days, because you need operating evidence. Treat vendor timelines as vendor timelines. Confirm with the certification body you will actually use. Auditor wait times have been a real bottleneck in this category; book early.

How Packets implements iso 42001 certification work

Agents collect inventories, vendor records, and evidence at volume. A named Compliance Lead runs scope, workshops, impact assessments, and auditor coordination. That is compliance implementation, the same model as the ISMS. We do not certify you. Check Packets security for our own posture rather than assuming a 42001 logo we have not claimed here.

If you only want software, a GRC platform that added a 42001 module may be enough. Compare implementation ownership on Packets vs Scrut and the operating-model page tool vs consultant vs hire.

Frequently asked questions

Does iso 42001 certification satisfy the EU AI Act?

No. The Act is law. The standard is a management system. Certification can support evidence. It is not conformity by itself. Cluster posts will go deeper.

Can we skip ISO 27001 and only chase iso 42001 certification?

You can scope an AIMS alone. Enterprise reviewers will still ask how you protect training data, prompts, and access. Most AI-native teams should not skip the ISMS.

Is a readiness scorecard the same as certification?

No. A score is a lead magnet or an internal gap view. Use Packets' free audit score as a starting map, not as a certificate.

What should we do this week?

List AI systems and vendors. Name an owner. Contact Packets if that owner cannot be a full-time hire. Related: AI governance hub and platform AI governance.