Start for free Start for free

ISO 42001

ISO 42001 is an international standard for managing how a company builds and uses AI. A certificate shows an outside auditor checked the company's AI governance process, not that any AI product is safe.

What is ISO 42001?

ISO 42001, formally ISO/IEC 42001:2023, is an international standard for running an AI management system. A management system is the set of policies, roles, risk checks and reviews a company uses to control how it builds and uses AI.

A company can be audited against the standard by an outside certification body and, if it passes, receive a certificate. It works much like ISO 27001, which does the same for information security.

Some vendors list it on their trust centers. Zendesk's Trust Center, for example, lists "ISO 42001:2023: AI Management System" and says its AI practices have been "independently audited" against a formal AI management system.

What it proves

  • The company runs its AI work, from design through deployment and monitoring, under a formal management system.
  • That system includes documented ways to spot and handle AI risks.
  • An outside auditor checked that the system exists and is followed, within the certified scope.

What it does not prove

  • That a specific AI feature is accurate, fair or safe.
  • That the vendor does not train AI on your data. That is a contract question, covered on our page about AI training on customer data.
  • That every product is covered. The certificate applies only to the scope the audit included.
  • That the vendor's AI providers are certified too.

Why it matters to you

ISO 42001 can save you time in a vendor risk assessment. A certified vendor has shown it treats AI risk as a managed process, not an afterthought. But a certificate is a starting point. The contract and AI terms still decide what happens to your data, and those can change after the audit.

What to check

  • Ask for the certificate and confirm which products, sites and teams are in scope.
  • Check the issue and expiry dates, and who issued it.
  • Check whether the AI features you use launched before or after the audit.
  • Read the vendor's AI terms for training, retention and subprocessors, since the certificate does not answer those.
  • Ask which outside model providers power the vendor's AI and how the vendor oversees them.

How Venpo helps

Venpo monitors your vendors' trust centers, AI terms and other public legal pages and emails you when certification claims or AI data rules change. The Fine Print Scan answers, for each vendor, whether it trains AI on your data and how long it keeps it.

Start for free

Frequently asked questions

Is ISO 42001 the same as ISO 27001?

No. ISO 27001 covers information security management, while ISO 42001 covers how a company governs its AI. A vendor can hold one, both or neither.

Does ISO 42001 mean a vendor won't train AI on my data?

No. The certificate covers the vendor's AI management process, so check its contract and AI terms for training rules.

Is ISO 42001 required by law?

It is a standard companies choose to adopt, not a law. Customers may still ask for it in security reviews.

Related terms

Security and Compliance ISO 27001 ISO 27001 is an international standard for running an information security management system: the policies, people and processes a company uses to manage security risk. A vendor certified to it has passed an audit by an independent certification body. Security and Compliance SOC 2 SOC 2 is an independent audit report on a vendor's security controls, written by a CPA firm under AICPA standards. It shows what an auditor tested and found for specific systems over a specific period, not a blanket promise that your data is safe. Vendor Documents Trust Center A trust center is a vendor's page or portal for security, privacy and compliance information, such as SOC 2 reports, certificates, subprocessor lists and security policies. Some documents are public, and others need sign-up or an NDA. Vendor Management Vendor Risk Assessment A vendor risk assessment is a check of how much risk a vendor brings, based on the data it gets, how much you depend on it and what its documents promise. You do it before you sign and again when something important changes. Laws and Regulations EU AI Act The EU AI Act is the European Union law that sorts AI systems by risk and sets duties for the companies that build them (providers) and use them (deployers). Its obligations apply in stages, and the 2026 AI Omnibus pushed the high-risk deadlines to December 2027 and August 2028.

Sources

Last reviewed