Artificial intelligence is no longer a technology used only by a limited number of specialist technology companies.
“`AI is increasingly becoming part of everyday business operations — from generative AI and customer support to visual inspection, anomaly detection, predictive maintenance, demand forecasting, design support and industrial automation.
As adoption expands, a new question is emerging:
How should organizations manage AI?
ISO/IEC 42001 was developed as an international framework for addressing this challenge.
Published in December 2023, ISO/IEC 42001 is the international standard for Artificial Intelligence Management Systems (AIMS). In Japan, the corresponding national standard, JIS Q 42001, was published in 2025, followed by the launch of accredited third-party certification in 2026.
But what exactly does ISO/IEC 42001 certify? Does it matter only to AI developers, or could manufacturers and companies simply using third-party AI also be affected?
To understand ISO/IEC 42001, it is useful to look beyond the standard itself and consider the broader transformation taking place around AI governance.
“`1. Why Is ISO/IEC 42001 Attracting Attention Now?
The growing attention around ISO/IEC 42001 is being driven less by the standard itself than by the rapid transformation of the AI landscape.
Generative AI has made advanced AI capabilities accessible even to organizations without dedicated AI development teams.
At the same time, manufacturers have already been deploying other forms of AI for applications such as visual inspection, predictive maintenance, quality assessment and demand forecasting.
AI is moving from being a specialized technology managed primarily by R&D teams to becoming part of mainstream business infrastructure.
Which AI systems are employees allowed to use?
What data can be entered into them?
How much reliance should be placed on AI-generated outputs?
When is human review required?
How should third-party AI providers be managed?
If an AI-related problem occurs, who is responsible?
The speed of AI adoption does not necessarily mean that organizational governance has developed at the same pace.
The challenge is shifting from “Can we implement AI?”
to “How do we manage the AI we have implemented?”
2. The Global Shift from “Using AI” to “Managing AI”
The same shift can be seen in AI policy and governance around the world.
The debate is no longer focused solely on technological development.
The European Union’s AI Act, for example, introduces a regulatory framework that addresses AI according to different levels and categories of risk.
At the international standards level, work is also progressing on AI risk management, AI management systems, AI system impact assessment and AI testing.
In other words, competition in AI is increasingly taking place on two fronts.
Organizations continue to compete over how quickly and effectively they can develop and deploy AI.
A new dimension of AI competition
At the same time, another question is becoming increasingly important: How can AI be governed in a way that supports trust?
3. How Far Has ISO/IEC 42001 Spread Globally?
ISO/IEC 42001 was published in December 2023.
Compared with long-established management system standards such as ISO 9001 and ISO/IEC 27001, it is still extremely young.
It would therefore be premature to describe ISO/IEC 42001 in 2026 as a certification standard that has already become established worldwide.
However, an important transition is taking place. Accreditation and certification infrastructures are being developed across markets, and organizations have begun obtaining third-party certification against ISO/IEC 42001.
The more significant point at this stage is therefore not simply the number of certificates issued.
It is that the international infrastructure required to conduct third-party certification against ISO/IEC 42001 is moving into practical operation.
ISO/IEC 42001 is not yet a globally mature certification scheme. It is a standard around which a global certification ecosystem is beginning to take shape.
4. What Is Happening in Japan?
Japan has also moved into the implementation phase.
In August 2025, JIS Q 42001:2025, the Japanese Industrial Standard corresponding to ISO/IEC 42001:2023, was published.
Japan subsequently established an accreditation framework for Artificial Intelligence Management Systems, and accredited third-party certification began in 2026.
In June 2026, Japan’s accreditation framework for AIMS also became part of the Asia-Pacific regional multilateral recognition arrangement.
Japan has moved from a stage in which an AI management standard simply existed to one in which an actual conformity assessment infrastructure — involving accreditation and certification — is operating.
Certification remains at an early stage.
Nevertheless, publicly available certification information already shows that scopes are not limited to companies providing AI services. They can also cover organizational use of AI for internal business operations.
“`5. What Exactly Is ISO/IEC 42001?
The full title of ISO/IEC 42001:2023 is:
Information technology — Artificial intelligence — Management system
ISO describes it as the world’s first AI management system standard.
Artificial Intelligence Management System
ISO/IEC 42001 establishes requirements for organizations to establish, implement, maintain and continually improve an Artificial Intelligence Management System.
Like ISO 9001 and ISO/IEC 27001, it is a management system standard.
Establish a policy.
Define responsibilities.
Assess risks and opportunities.
Implement appropriate controls.
Evaluate performance.
Correct problems and continually improve.
ISO/IEC 42001 is therefore not primarily a technical specification for AI technology. It is a standard addressing how an organization manages AI.
“`6. ISO/IEC 42001 Does Not Certify That an AI System Is “Safe”
This distinction is fundamental.
If an organization obtains ISO/IEC 42001 certification, it does not mean that every AI system developed or used by that organization has been certified as safe.
The central subject of third-party certification is the organization’s AI management system.
The assessment therefore focuses on whether responsibilities have been established, risks have been identified, appropriate controls have been implemented, AI-related impacts are considered, performance is evaluated, and corrective and continual improvement processes are in place.
Evaluating an AI system itself and evaluating the management system of the organization responsible for that AI are not the same thing.
7. What Does ISO/IEC 42001 Manage?
At the heart of ISO/IEC 42001 is a risk-based approach to the development, provision and use of AI.
An important feature of AI management is that organizations may need to consider not only AI as an IT system, but also the impacts that AI can have on individuals, organizations and society.
For an organization using generative AI, this could translate into very practical questions: Which AI tools may employees use? What information may be entered into them? Who checks AI-generated outputs? How are changes made by an external AI provider monitored? Who responds when an AI-related issue occurs?
ISO/IEC 42001 provides a management framework for addressing such questions systematically.
8. Who Is ISO/IEC 42001 For?
ISO/IEC 42001 is not limited to companies that develop foundation models or other AI technologies.
It can apply to organizations of any size and across industries that develop, provide or use AI systems.
Organizations developing AI models or AI systems.
Organizations providing AI-enabled products or services.
Organizations using AI for business operations, decision-making or automation.
It may also be relevant to organizations integrating AI into products and services or managing AI systems supplied by third parties.
“We do not develop AI, so ISO/IEC 42001 does not concern us” is not necessarily correct. The more important question is what role the organization plays in relation to AI.
9. What About Companies That Only Use AI?
This is likely to be one of the most important questions for many organizations.
Can a company fall within the scope of ISO/IEC 42001 even if it only uses externally provided AI?
Potentially, yes.
An organization does not need to develop its own AI model to face AI management issues. Once third-party generative AI or another external AI service becomes part of business operations, questions arise around governance.
Which AI services are approved?
What data can employees enter?
How may AI outputs be used?
When is human verification required?
How are external AI providers managed?
However, this does not mean that every organization using AI needs ISO/IEC 42001 certification.
The risk profile of a company using generative AI only to draft internal text is very different from that of a company relying on AI for quality decisions or other high-impact business processes. The key issue is not simply whether AI is being used, but what role AI plays in the business and what risks and impacts arise from that role.
“`10. What Does ISO/IEC 42001 Mean for Manufacturers and IoT Companies?
From this perspective, ISO/IEC 42001 may also become relevant to manufacturers.
AI is already being used across manufacturing for a wide range of applications.
A manufacturer may develop some AI systems internally, integrate AI supplied by another company, or provide AI-enabled products to customers.
One organization may therefore hold several roles at the same time.
For example, using AI-based visual inspection only within a factory creates a different risk and responsibility profile from selling equipment that uses AI to make quality-related decisions for customers.
The same caution applies to IoT. Simply manufacturing an IoT product does not automatically make ISO/IEC 42001 necessary or relevant.
The key question is whether AI is involved, what function it performs, and what responsibility the organization has for managing it.
11. What Is the Value of ISO/IEC 42001 Certification?
There is an important distinction between implementing ISO/IEC 42001 and obtaining third-party certification.
Using ISO/IEC 42001 and obtaining certification are not the same thing.
An organization can use ISO/IEC 42001 to establish and improve its AI management system without obtaining certification. Certification is voluntary.
Third-party certification, however, can provide independent evidence that an organization’s AIMS, within a defined certification scope, has been assessed against the requirements of the international standard.
This may provide an objective reference when explaining AI governance to customers, business partners, procurement teams, overseas counterparties or other stakeholders. Certification may therefore contribute to corporate communication and trust.
Understanding What Certification Does Not Mean
Its meaning should not be overstated.
× “This company provides safe AI.”
× “This company has superior AI technology.”
× “This company will never experience an AI incident.”
Certification concerns the conformity of an AI management system within a defined scope.
There is an important distinction between having a certificate and creating business value from certification.
Organizations need to ask why they would seek certification, who they need to communicate with, and what they want the certification to demonstrate.
12. How Is ISO/IEC 42001 Different from ISO/IEC 27001?
A useful comparison is ISO/IEC 27001, the international standard for Information Security Management Systems (ISMS).
The two standards share familiar management system concepts, including policies, responsibilities, risk assessment, controls, internal audits, management review and continual improvement.
| Comparison | ISO/IEC 27001 | ISO/IEC 42001 |
|---|---|---|
| Primary focus | Information security | Responsible development, provision and use of AI |
| Typical concerns | Confidentiality, integrity and availability of information | AI risks and impacts, data, transparency, accountability and human oversight |
| Common approach | Risk-based organizational management and continual improvement | |
For example, information leakage associated with the use of an AI service may be closely related to ISO/IEC 27001.
Questions such as how AI-generated decisions affect people, how AI impacts are assessed, and how humans oversee AI decisions are more directly associated with ISO/IEC 42001.
The two standards should therefore not be viewed as competitors. For organizations using AI, information security and AI governance can overlap while remaining distinct management domains.
“`13. Could ISO/IEC 42001 Follow a Similar Path to ISO/IEC 27001?
The history of ISO/IEC 27001 offers an interesting comparison.
As internet technologies and information systems became embedded in business, organizations increasingly found themselves being asked:
“How do you manage information security?”
Customers began reviewing security controls. Information security became part of contractual requirements. Procurement and tender processes started evaluating it. Companies began assessing the security capabilities of suppliers and outsourced service providers.
Against this background, ISO/IEC 27001 certification became one of the common ways for organizations to demonstrate to third parties that information security was being managed systematically.
“How do you manage information security?”
“How do you manage AI?”
As AI becomes more deeply embedded in business operations, customers and business partners may increasingly move beyond asking whether an organization uses AI and begin asking how that AI is governed.
If buyers of AI-enabled products, users of AI services and companies outsourcing work to AI-enabled suppliers begin assessing AI governance systematically, ISO/IEC 42001 certification could become one way to provide objective evidence.
Structurally, this would resemble part of the adoption path seen with ISO/IEC 27001.
But it would be premature to assume that the outcome will be the same.
ISO/IEC 27001 has a long history and addresses information security, an issue relevant to virtually every modern organization. ISO/IEC 42001 is much younger, and the degree of AI dependence varies considerably between companies and industries.
AI-specific regulation, technical testing and impact assessment are also developing in parallel.
ISO/IEC 42001 could develop an adoption pattern similar to ISO/IEC 27001 in some markets.
But it is far too early to conclude that it will follow the same trajectory.
One of the most important indicators may not be the raw number of certificates issued. It may be whether ISO/IEC 42001 begins appearing in customer requirements, procurement criteria, supplier assessments and contractual expectations.
“`The Value of ISO/IEC 42001 Will Depend on How Organizations Use It — Not Simply on Obtaining Certification
When organizations begin considering ISO/IEC 42001, there is a risk of starting with the wrong question:
“Should we obtain certification?”
A more useful starting point is to understand exactly what ISO/IEC 42001 certification means — and what it does not mean.
ISO/IEC 42001 does not certify the performance or absolute safety of an AI system. It provides a framework for organizations to manage the risks and impacts associated with developing, providing and using AI, and third-party certification can provide independent assessment of that management system.
Only after understanding this distinction does the more strategic question become meaningful:
“How could our organization use ISO/IEC 42001?”
Potential uses may include:
- explaining AI governance to customers;
- responding to business partner requirements;
- supporting entry into overseas markets;
- demonstrating governance within supply chains;
- structuring internal AI management; and
- communicating an organization’s approach to responsible AI.
The value will not be the same for every organization.
A company using AI only for limited internal tasks is in a very different position from a manufacturer selling AI-enabled products globally. Certification also brings costs and ongoing management requirements.
The question should therefore not be:
“We use AI, so should we get certified?”
It should be:
“What would independent certification help our business achieve?”
There is a useful lesson here from ISO/IEC 27001. The certificate itself did not create information security. Third-party certification became valuable because organizations increasingly needed to manage information security systematically and explain that management to customers, partners and markets.
ISO/IEC 42001 may develop in a similar way.
Certification alone is not a source of market competitiveness. However, if AI governance increasingly becomes part of procurement, business relationships and market trust, organizations that understand what ISO/IEC 42001 represents — and use it appropriately — may be able to turn certification into one element supporting competitiveness.
How does our organization use AI?
What risks arise from that use?
What do customers and markets expect from us?
How could ISO/IEC 42001 support our internal AI governance?
What value could third-party certification demonstrate — and to whom?
Certification is not the objective. It is one possible management and business tool.
It remains too early to know whether ISO/IEC 42001 will eventually achieve adoption comparable to ISO/IEC 27001.
But as AI becomes part of mainstream business infrastructure, the distinction may increasingly shift from companies that simply “use AI” to companies that can demonstrate that they “manage AI responsibly and can explain how they do so.”
If that happens, the differentiator will not simply be whether an organization holds an ISO/IEC 42001 certificate. It will be whether the organization understands what the standard means and knows how to use it to strengthen trust, governance and market competitiveness.
“`Sources
“`International Organization for Standardization (ISO), ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system
International Organization for Standardization (ISO), ISO/IEC 27001, Information security management systems
ISMS Accreditation Center (ISMS-AC), Public information on the Artificial Intelligence Management System (AIMS) conformity assessment scheme
ISMS Accreditation Center (ISMS-AC), Public information on the publication of JIS Q 42001:2025
European Union, Regulation (EU) 2024/1689 — Artificial Intelligence Act
“`About this article: This article provides general information based on publicly available information as of September 2026.
“`Standards, regulations, accreditation schemes and certification requirements may be revised or updated. Organizations should refer to the latest official standards, legal texts and accreditation or certification scheme information when making decisions regarding implementation, certification or regulatory compliance.
“`
コメント