AI Policy
Document declaring principles, scope and responsible parties. It is the anchor of the AIMS.
ISO/IEC 42001: govern the AI of your organization
The first certifiable standard for AI management systems: how your organization develops, provides or uses artificial intelligence, with evidence and human oversight.
Where each thing is resolved
- Standard
- ISO/IEC 42001:2023
- Entry
- Indicative diagnosis of AI governance. This standard does not enter through a quote.
- Path and status
- They are published on the standard's page, with its source and its date. This page does not duplicate them.
- Scope of this path
- Initial guidance and separate training. It is not a gap analysis, pre-audit or conformity assessment.
Five key clauses
ISO/IEC 42001:2023 sets requirements for an AI management system (AIMS). Each clause opens up what the organization has to be able to show.
What an organization has to be able to show
- Formal AI Impact Assessment per AI system
- AI governance with roles, policies and responsibilities
- Management of the AI system's lifecycle (development, deployment, monitoring, retirement)
- Traceability of training data and models
- Due diligence of third-party AI vendors
- Transparency toward end users and interested parties
Who requires itBankingHealthcareTelecommunicationsPublic sectorExporters of AI-based services
Organizations that develop AI products, integrate third-party models, use AI in critical decisions, or need to prepare governance evidence for regulatory and client requirements.
G-CERTI knowledge base by standard · ISO/IEC 42001:2023 · 2026-09-09
Measure your starting point
Eight statements to review the scope, responsibilities, risks, and evidence of AI governance. The answers remain in the browser of the person who enters them.
Inventory
An inventory of AI systems and use cases under the organization's responsibility exists.
Purpose and responsible parties
Each AI system has a documented purpose, owner and limits of use.
Risks and impacts
Risks and impacts are assessed before introducing or changing an AI system.
Data and suppliers
There are criteria for data, suppliers, third-party models, and human oversight.
Record-keeping
Relevant decisions, changes, incidents, and exceptions are recorded.
Competencies
The people who operate or oversee AI know their responsibilities.
Monitoring
Performance is monitored and action is taken when deviation, harm, or unintended use appears.
Management review
Leadership reviews objectives, risks, and evidence of AI governance.
What it says
- Where the starting point is. Brings together in one place the inventory of systems, purpose and responsible parties, risk and impact assessment, data and vendor criteria, decision records, competencies, monitoring and management review.
- What information is worth gathering. Points to the topics on which the organization does not yet have organized evidence, so the next conversation can start there.
- An indicative reading, with its band. The percentage and its band are an indicative reference of what was declared.
What it does not say
- Whether the system complies with the standard. The result comes from what someone declares about their own organization, without examined evidence or independent contrast.
- Whether the organization is ready for an audit. Completing the questionnaire does not prepare, does not advance, and does not anticipate the outcome of any later evaluation.
- Nothing about a certificate issued. A management system certificate is verified by its code in the verifier, which is another document, another record and another page.
The useful reading is done by a person
The questionnaire organizes the starting point, but does not examine evidence or know the organization's context. That reading is done by a member of the team, with the scope and AI systems in view. The questionnaire's answers are not attached on their own: the person writing decides what to share.
The answers stay in the browser of whoever writes them: they are not sent, not saved, and no result is published. Sharing information with G-CERTI is a separate decision, with its own form.
The regulations that require it
The European AI Regulation already applies its transparency obligations as of August 2, 2026. For an exporter, this is an indirect market requirement. The standard is mapped against that framework, not a replacement for it: it does not grant a presumption of conformity.
- European UnionRegulation in forceAI Act (Regulation 2024/1689)
Its application is gradual and depends on the system's category. ISO/IEC 42001 can help organize governance evidence, but it does not replace legal assessment.
- United StatesVoluntary frameworkNIST AI Risk Management Framework
Voluntary framework for managing AI risks; also confirm applicable federal and state obligations.
- BrazilBill in progressPL 2338/2023
Legislative bill in process; verify its status in official sources before asserting obligations.
- ArgentinaIndicative referenceRecommendations for trustworthy AI
Indicative reference; confirm the applicable framework and sector obligations in force.
- GlobalPrinciplesOECD AI Principles + NIST AI RMF
Complementary voluntary reference frameworks.
The standard is mapped against each framework; it does not replace it or grant a presumption of conformity. Record of paths and positioning by standard · 2026-08-13
Training to audit ISO/IEC 42001
Three academic paths on artificial intelligence governance: interpreting the requirements, auditing the system from the inside, and covering both in an integrated way. The path is academic and does not implement an organization's system.
Training in AI management on ISO/IEC 42001
Interpret the requirements of the AI management system and translate them into policy, roles, impact assessment and lifecycle.
Internal auditor of AI management systems
Plan and carry out internal audits of the AIMS: evidence, findings and follow-up.
ISO/IEC 42001 diploma program
The integrated path: implementation and internal audit in a single payment, with two academic certificates.
TrainingAcademic training and practice
G-CERTI Formación works on interpretation, exercises and internal audit through a common program. It does not design or implement an organization's system within this path.
CertificationSubsequent certification, if applicable
An organization that later inquires about certification enters through a different file. Before quoting, scope and impartiality are reviewed; any incompatible advisory work blocks the certification path.
GovernanceHow the separation is maintained
The policy that keeps the two files, their teams and their decisions separate is published in the Trust Center.
See the separation policyTraining develops capabilities to interpret requirements and practice internal auditing. It does not certify an organization's system and does not decide its verification: these are separate processes, with separate files and teams, and having taken the course does not anticipate any outcome.
Academic portfolio of G-CERTI Formación · 2026-09-02
The most frequently asked questions
Can it be relevant if the company uses AI but does not develop it?
Yes, it can be relevant when an organization uses its own or third-party AI systems. Applicability and scope depend on the use, the context, the responsibilities and the associated impacts.
Does it cover the European Union's AI Act?
ISO/IEC 42001 can relate to the AI Act and other regulatory frameworks, but it does not replace applicable legal assessment.
Is it compatible with ISO/IEC 27001?
Both standards follow a compatible management system structure. Integrating them can reduce duplication when the scope and processes allow it; the actual effort depends on the context and the available evidence.
Does this path assess the conformity of an AI system?
No. This path offers initial guidance and separate training. It is not a gap analysis, pre-audit, conformity assessment, technical preparation or a certification offer.
Does taking training on the standard advance the organization's certification?
No. Training develops capabilities to interpret requirements and practice internal auditing. It does not certify an organization's system and does not decide its verification: these are separate processes, with separate files and teams.
Where is the status of ISO/IEC 42001 published?
On the standard's page, with its path, its source and its date. This page does not duplicate it.
Start with the diagnosis
The self-assessment brings together scope, responsible parties, risks and evidence in one place. It helps decide what information to move forward with; conformity is determined in an audit.