FRAMEWORKS / READINESS / AI governance
ISO/IEC 42001
Governance for AI systems: use cases, accountability, impacts, and risk management.
SCOPE & APPLICABILITY
What the framework actually requires
AI management system standard. Any certification is assessed independently.
What matters in practice
Requirements depend on scope. These are the areas to evaluate, not a guarantee of certification or regulatory compliance.
AI system and use-case inventory
Map AI uses and accountable roles.
Risk and AI impact assessments
Assess impact, risks, and relevant controls.
Owners, policies, and lifecycle
Operate controls, incident reporting, and ongoing review.
An operational path, not a checkbox exercise
Translate requirements into accountable activities, evidence and reviewed controls.
Map AI uses and accountable roles.
Assess impact, risks, and relevant controls.
Operate controls, incident reporting, and ongoing review.
APPLICABILITY
Who should assess this framework?
For organisations developing, providing or using AI systems that want a formal AI risk management approach. Appropriate controls depend on use cases, impact and responsibilities.
BEYOND CHECKLISTS
Why this matters
AI governance is more than a policy. Teams need a reliable inventory of AI systems, knowledge of input data, accountable change approvals, and ways to identify unintended outcomes.
EVIDENCE & OPERATIONS
What your organisation should be able to evidence
This is a practical starting point, not an exhaustive set of regulatory obligations or a substitute for an independent audit.
- 01 AI system inventory, use cases and owners
- 02 AI policy, objectives and management approvals
- 03 Risk and impact assessments for affected people
- 04 Data, model, testing and human oversight procedures
- 05 External AI provider and component due diligence
- 06 Incident, change, review and corrective action records
FAQ
Frequently asked questions
Practical distinctions worth understanding before starting your programme.
Is ISO 42001 the same as the EU AI Act?
No. ISO/IEC 42001 is an AI management system standard; the EU AI Act is EU legislation. Controls can support governance but do not replace a legal scope assessment.
Do we need to develop our own AI models?
Not necessarily. Organisations using third-party AI may still have governance responsibilities depending on their role and use case.
Do documents alone result in certification?
No. The management system must be operated and independently assessed. Certification is decided by the competent certification body.
FURTHER READING
Explore related resources
Use original ZebraByte articles and guides to explore security programmes, privacy governance and readiness.
Framework descriptions are educational. Applicability, service availability and any independent assessment require confirmation for your organisation.
Important scope boundary
ZebraByte can discuss readiness, technical controls and programme management. A regulator, qualified auditor or certification body makes the applicable independent determination. Support for a particular framework is subject to the agreed service scope.
Related frameworks and programmes
Need a scope assessment for your organisation?
Share your sector, systems and contractual requirements. We can outline the next practical steps and clarify whether this framework is relevant.