ISO 42001 for SMEs: What the AI Management Standard Means
ISO/IEC 42001 is the first international standard for AI management systems. Published 2023, it provides organisations a framework for responsible AI governance. What does this mean for SMEs — and how to implement?
What Is ISO/IEC 42001?
ISO/IEC 42001 is a management system standard — like ISO 9001 for quality or ISO 27001 for information security, but specifically for AI. It describes how an organisation builds, implements, operates and continuously improves an AI Management System (AIMS).
Key: ISO 42001 does not regulate AI technology, but governance processes — responsibilities, risk assessment, policies, audits. This makes it accessible to SMEs.
Core Requirements Overview
ISO 42001 follows HLS structure — familiar to ISO 9001 or 27001 users.
Determine internal and external factors. Identify interested parties and their requirements. Formulate AI policy.
Top management must actively support the AI management system. Approve AI policy, assign responsibilities.
Assess risks and opportunities from AI use. Define measurable AI objectives. Plan actions.
Develop and operate AI systems per defined processes. Include suppliers and partners in AI governance.
Measure AI performance. Conduct internal audits. Management review at least annually.
Address non-conformities. Continuous improvement of the AI management system.
4 Myths About ISO 42001
ISO 42001 applies to every operator of AI systems — including SaaS users.
SMEs can stay under €10,000 total cost with proper preparation.
With the right framework: 3–6 months realistic for simple AI environments.
ISO 42001 is voluntary. High-risk AI in EU AI Act requires its own conformity assessment.
Implementation in 6 Steps
Assess current state against ISO 42001. Use OCC Glossary as reference.
Which AI systems fall within scope? Document boundaries.
Write AI policy (1–2 pages). Set measurable AI goals (e.g., audit trail for all AI decisions).
Capture AI-specific risks: bias, data protection, dependencies, explainability.
Human-in-the-Loop for critical decisions. IIO Framework implements this systemically.
Choose accredited certification body. Stage 1 (document review) → Stage 2 (on-site audit).
Costs & Effort for SMEs
ISO 42001 vs. EU AI Act — What's What?
ISO 42001
- Voluntary international standard
- Management system (governance processes)
- Applies to all AI systems
- Certification possible
- Shows AI governance maturity
EU AI Act
- Binding EU regulation
- Product regulation (technical requirements)
- Applies only to high-risk AI and prohibited practices
- CE conformity assessment (not certification)
- ISO 42001 can be used as evidence