Artificial intelligence management systems

An organization may develop an AI model, integrate a third-party service or use AI within an existing operation. Those roles create different responsibilities and dependencies. ISO/IEC 42001 addresses an AI management system within an organization’s context, including organizations providing or using AI-based products and services. The technical question is how AI activities are governed and improved. It is distinct from asking whether a particular model is accurate, suitable for a clinical task or lawful in a specified decision process.

ISO Open Data identifies the document as requirements and guidance for establishing, implementing, maintaining and improving an AI management system. Its scope covers organizations of different sizes and types, rather than prescribing one model architecture or one testing benchmark. The management-system boundary therefore matters. A certificate about an organization’s defined AI activities should not be read as certification of every generated output, every future model update or every application that a customer builds using the service.

Selected records: ISO/IEC 42001:2023 (edition 1, publication record 2023-12-18). The selected record is the first edition published in 2023. Related AI vocabulary, risk, evaluation and sector documents have separate purposes and edition histories. A future revision, a national adoption or a certification scheme may follow a different timetable. The publication record does not establish which edition a particular legal instrument or contract names. The records were checked on 19 October 2026 in ISO Open Data.

Consider a company introducing an AI-assisted document review service. The provider, integrator and user need a clear understanding of intended use, input information, human review and changes to the service. Technical evaluation can examine whether the system performs acceptably on representative material; management evidence shows who decides what is acceptable, handles incidents and authorizes changes. A revised model or a new use outside the original context can require a fresh evaluation. Governance records should connect these decisions to the deployed service.

The NIST AI Risk Management Framework is intended for voluntary use and supports consideration of trustworthiness in AI design, development, use and evaluation. It is a separate instrument rather than an adoption of ISO/IEC 42001 into every U.S. legal framework. Sector rules and application-specific duties still need identification. Neither publication by ISO/IEC nor use of NIST guidance grants an organization government approval for medical, employment, financial or other regulated AI decisions.

Which AI activities and organizational units are covered? Are intended uses, affected parties and third-party dependencies identifiable? Can technical evaluation records be connected to release and change decisions? How are limitations communicated, incidents handled and significant changes assessed? An assurance review should distinguish policies from evidence of their use. It should also identify who controls training data, model updates, integration and operational decisions. A supplier’s general assurance statement cannot supply facts about an application or user population outside the reviewed scope.

The key finding is that management-system assurance and AI-system evaluation answer complementary questions. A well-managed process does not guarantee that a model will perform acceptably on unfamiliar data or in a high-consequence use. A good benchmark result does not demonstrate adequate governance over future changes. This overview does not establish application-specific risk classifications, determine legal conformity or certify an AI model. Such conclusions require the actual use, applicable legal instruments and technical evidence suitable for the affected population and operating context.

Software product quality connects technical properties to evaluation scenarios; information security management considers protection of information. Risk management supplies a general organizational perspective. These references help separate management arrangements, system-specific evaluation and application-specific obligations. A reader assessing an AI service needs all three relationships rather than an assumption that a certificate about the provider answers every question about the model’s outputs.

Official sources and selected bibliographic facts were checked on 19 October 2026. Licensed ISO Open Data provides the requirements-and-guidance scope. The NIST source is a separately published voluntary framework. Neither source is used to claim regulatory approval or guaranteed AI performance. ISO metadata is attributed to the iso_deliverables_metadata dataset under ODC-By 1.0. The explanation and examples are original NCQM analysis. Send a correction request identifying the reference, statement and supporting official evidence.