ISO/IEC 42001 — the management system, and why it is not a legal shield

ISO/IEC 42001:2023 is the AI management system standard: clauses 4–10 (context, leadership, planning, support, operation, performance evaluation, improvement) on the Annex SL spine every ISO management-system standard shares, plus 38 Annex A controls with implementation guidance in Annex B. It is voluntary and certifiable by an accredited certification body.

What it is good for

It is how you build the management system the EU AI Act assumes you have — the policy, the roles, the risk method, the AI impact assessment, the competence records, the internal audit, the management review. Much of it is work a high-risk provider is doing for Art. 17 anyway. A certificate is what a customer, an insurer or a tender will ask for.

What it is not

It is not a legal shield. The presumption of conformity under Article 40 attaches to a harmonised standard cited in the Official Journal. The first, EN 18286 (quality management system, Article 17), was cited on 14 October 2026; ISO/IEC 42001 is not that standard, so no ISO/IEC 42001 certificate gives you a presumption of conformity. Nor does a voluntary standard open the Act's own reuse routes: Art. 17(3) lets a provider fold its quality management into a system sectoral Union law already requires, and ISO/IEC 42001 is not Union law. Veritome labels the standard voluntary and never renders a certificate as conformity.

Who certifies

Not us, and not anyone who sold you the management system. Accredited bodies certify under ISO/IEC 17021-1, and ISO/IEC 17021-1 §5.2.5 keeps consultancy and certification apart: a certification body may not provide management-system consultancy, and may not certify a system where its own consultancy would compromise its impartiality. Veritome prepares the records and gives your auditor a read-only seat (the Auditor role); the certificate comes from an accredited body, independently, and you record the body, the certificate reference and the surveillance date on the programme's Certification facts tab.

In Veritome

Switch it on under Organisation → Frameworks and a programme appears under Frameworks in the rail, on its own page, in six phases with gates — Establish · Plan · Support · Operate · Evaluate & improve · Certification audit (see Programmes). The page has four tabs: Steps, Statement of Applicability, Clauses and Certification facts. Its clause 4–10 records are shared with the ISO/IEC 27001 programme, one record in both. Where your EU AI Act journey has already produced verified evidence, the step arrives Done, credited from your EU AI Act work. The Statement of Applicability is generated from what you did, not typed into a blank sheet, and every Annex A row ends up Done, in progress, or excluded with a written reason.

Price and timing. ISO/IEC 42001 is included from the Govern plan up — there is no per-framework fee. The Art. 17 quality-management obligations are never sold as an add-on — they are engine obligations inside the plan; what the programme adds is the certifiable system around them. The programme opens with the full launch, planned for late November 2026: until then, during the public beta, it is listed under Frameworks and on Programmes as a faded, inactive entry marked Available at launch, its programme page does not open, and the pricing page states the date it lands.