ISO/IEC 42001 — the management system, and why it is not a legal shield
The AI management-system standard as a programme from Stage 1 to Stage 2. Genuinely useful, certifiable by an accredited body — and not a presumption of conformity with the EU AI Act.
ISO/IEC 42001:2023 is the AI management system standard: clauses 4–10 (context, leadership, planning, support, operation, performance evaluation, improvement) on the Annex SL spine every ISO management-system standard shares, plus 38 Annex A controls with implementation guidance in Annex B. It is voluntary and certifiable by an accredited certification body.
What it is good for
It is how you build the management system the EU AI Act assumes you have — the policy, the roles, the risk method, the AI impact assessment, the competence records, the internal audit, the management review. Much of it is work a high-risk provider is doing for Art. 17 anyway. A certificate is what a customer, an insurer or a tender will ask for.
What it is not
It is not a legal shield. No harmonised standard for the EU AI Act has been cited in the Official Journal, so no certificate — ISO/IEC 42001 or any other — gives you a presumption of conformity. The European standard that will matter, prEN 18286, is still in the CEN-CENELEC process. Nor does a voluntary standard open the Act's own reuse routes: Art. 17(3) lets a provider fold its quality management into a system sectoral Union law already requires, and ISO/IEC 42001 is not Union law. Veritome labels the standard voluntary and never renders a certificate as conformity.
Who certifies
Not us, and not anyone who sold you the management system. Accredited bodies certify under ISO/IEC 17021-1, and ISO/IEC 17021-1 §5.2.5 keeps consultancy and certification apart: a certification body may not provide management-system consultancy, and may not certify a system where its own consultancy would compromise its impartiality. Veritome prepares the records and gives your auditor a read-only seat (the Auditor role); the certificate comes from an accredited body, independently, and you record the body, the certificate reference and the surveillance date on the programme card.
In Veritome
Switch it on under Frameworks and a programme appears, in six phases with gates — Establish · Plan · Support · Operate · Evaluate & improve · Certification audit (see Programmes). Its clause 4–10 records are shared with the ISO/IEC 27001 programme, one record in both. Where your EU AI Act journey has already produced verified evidence, the crosswalk credits the requirements it maps to and the step arrives Done by overlap. The Statement of Applicability is generated from what you did, not typed into a blank sheet, and every Annex A control ends up implemented, assigned, or excluded with a written reason.
Price and timing. ISO/IEC 42001 is included from the Govern plan up — there is no per-framework fee. The Art. 17 quality-management obligations are never sold as an add-on — they are engine obligations inside the plan; what the programme adds is the certifiable system around them. The programme is not going out with the launch: while the cross-mapping is switched off it is absent from the rail, and the pricing page states the date it lands.