--- title: ISO 42001: The First AI Standard | daily.dev description: ISO/IEC 42001 is the first international management-system standard for responsible AI, covering governance processes rather than certifying individual models.... canonical: https://daily.dev/posts/iso-42001-the-first-ai-standard-ebz72ijul twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ISO 42001: The First AI Standard | daily.dev og:description: ISO/IEC 42001 is the first international management-system standard for responsible AI, covering governance processes rather than certifying individual models.... og:url: https://daily.dev/posts/iso-42001-the-first-ai-standard-ebz72ijul og:image: https://api.daily.dev/og/posts/EbZ72ijul.png og:image:alt: ISO 42001: The First AI Standard og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ISO 42001: The First AI Standard **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 5 min read · 0 upvotes · 0 comments ## Summary ISO/IEC 42001 is the first international management-system standard for responsible AI, covering governance processes rather than certifying individual models. It has mandatory clauses (context, planning, risk and impact assessments) plus a menu of 38 optional controls across nine areas, from which organisations select based on their risk profile. Certification requires internal and two-stage external audits, with UKAS having accredited BSI as the first certification body. The standard is voluntary, doesn't guarantee legal compliance with the EU AI Act or UK regulations, and doesn't certify vendors' downstream customers by association. Control A.6.2.4 requires pre-deployment verification and validation, making penetration testing and red teaming useful evidence of compliance. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does ISO 42001 certification actually require from an organization? It requires implementing a management system with mandatory clauses covering context, planning, resources, operations, performance, and improvement, plus AI-specific risk and impact assessments. Organizations also select applicable controls from a menu of 38 options across nine areas (policies, roles, resources, lifecycle, data, etc.), documenting their choices in a statement of applicability, rather than implementing all 38. _Teams scoping an AI governance rollout can track standards guidance like this on daily.dev._ ### Does being ISO 42001 certified mean I comply with the EU AI Act? No, ISO 42001 is voluntary and not fully aligned with the EU AI Act, so certification alone does not satisfy legal requirements. The EU AI Act can still apply to UK businesses selling to EU customers, similar to how GDPR applies extraterritorially, so certified companies should treat ISO 42001 as a foundation rather than a substitute for AI Act compliance. _Businesses weighing AI compliance obligations across jurisdictions can follow updates like this on daily.dev._ ### Who was the first certification body accredited to issue ISO 42001 certificates? BSI was the first certification body accredited by UKAS (the UK's national accreditation body) to issue ISO 42001 certifications, with the accreditation granted earlier in the year the standard's adoption accelerated. ISO/IEC 42001 itself was first published in December 2023 as the first international AI management system standard. _Anyone tracking which bodies can certify AI governance standards can follow this on daily.dev._ ## Similar posts on daily.dev - [How ISO 42001 Helps Organizations Manage AI Risk](https://daily.dev/posts/how-iso-42001-helps-organizations-manage-ai-risk-l4xbxrkv0) · Security Boulevard · 0 upvotes · 0 comments - [The Definitive Guide to ISO 42001](https://daily.dev/posts/the-definitive-guide-to-iso-42001-plvawhvgp) · Security Boulevard · 4 upvotes · 0 comments - [Dynatrace achieves ISO/IEC 42001 certification](https://daily.dev/posts/dynatrace-achieves-iso-iec-42001-certification-eevade7xp) · Dynatrace · 0 upvotes · 0 comments - [Aikido Achieves ISO 42001 Certification](https://daily.dev/posts/aikido-achieves-iso-42001-certification-pm8mk4ksi) · Aikido Security · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#compliance](https://daily.dev/tags/compliance), [#ai-security](https://daily.dev/tags/ai-security), [#ai-governance](https://daily.dev/tags/ai-governance) [View this post on daily.dev](https://daily.dev/posts/iso-42001-the-first-ai-standard-ebz72ijul) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ISO 42001: The First AI Standard","url":"https://daily.dev/posts/iso-42001-the-first-ai-standard-ebz72ijul","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/iso-42001-the-first-ai-standard-ebz72ijul"},"datePublished":"2026-10-16T09:36:38.207Z","dateModified":"2026-10-16T09:37:02.812Z","description":"ISO/IEC 42001 is the first international management-system standard for responsible AI, covering governance processes rather than certifying individual models....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/iso-42001-the-first-ai-standard-ebz72ijul","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,compliance,ai-security,ai-governance","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"ISO 42001: The First AI Standard"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/iso-42001-the-first-ai-standard-ebz72ijul#faq","mainEntity":[{"@type":"Question","name":"What does ISO 42001 certification actually require from an organization?","acceptedAnswer":{"@type":"Answer","text":"It requires implementing a management system with mandatory clauses covering context, planning, resources, operations, performance, and improvement, plus AI-specific risk and impact assessments. Organizations also select applicable controls from a menu of 38 options across nine areas (policies, roles, resources, lifecycle, data, etc.), documenting their choices in a statement of applicability, rather than implementing all 38. Teams scoping an AI governance rollout can track standards guidance like this on daily.dev."}},{"@type":"Question","name":"Does being ISO 42001 certified mean I comply with the EU AI Act?","acceptedAnswer":{"@type":"Answer","text":"No, ISO 42001 is voluntary and not fully aligned with the EU AI Act, so certification alone does not satisfy legal requirements. The EU AI Act can still apply to UK businesses selling to EU customers, similar to how GDPR applies extraterritorially, so certified companies should treat ISO 42001 as a foundation rather than a substitute for AI Act compliance. Businesses weighing AI compliance obligations across jurisdictions can follow updates like this on daily.dev."}},{"@type":"Question","name":"Who was the first certification body accredited to issue ISO 42001 certificates?","acceptedAnswer":{"@type":"Answer","text":"BSI was the first certification body accredited by UKAS (the UK's national accreditation body) to issue ISO 42001 certifications, with the accreditation granted earlier in the year the standard's adoption accelerated. ISO/IEC 42001 itself was first published in December 2023 as the first international AI management system standard. Anyone tracking which bodies can certify AI governance standards can follow this on daily.dev."}}]} ```