Cybersecurity in the Era of AI · Part 3 — ISO/IEC 42001: Building & Certifying the AI Management System

This is Part 3 of Cybersecurity in the Era of AI, and it is where the governance of Part 1 and the regulatory obligations of Part 2 become a durable, certifiable system rather than a set of one-off projects. ISO/IEC 42001:2023 is the world's first AI management system standard — the AI analogue of what ISO/IEC 27001 is for information security — and it gives organizations a structured, auditable way to govern AI responsibly across its lifecycle. If Part 1 gave AI risk an owner and Part 2 told you what the law requires, Part 3 is the management system that runs the risk assessments, controls, impact assessments and continual improvement on an ongoing basis, and — crucially — lets you demonstrate to customers, partners and regulators that your AI is governed to a recognized standard. In a market increasingly nervous about AI, a 42001 certification is becoming what a 27001 certification became for security: table stakes for trust.

The strategic value is that 42001 does not compete with the rest of this program — it operationalizes it. The governance operating model, inventory and risk classification from Part 1 are the raw material of the management system; the AI Act obligations from Part 2 map onto its controls; and the secure-development practices of Parts 5–6 are among the controls it governs. Build the AIMS well and you get one management system that serves your governance, much of your AI Act compliance, and your customer-facing assurance at once — the same leverage that makes an integrated 27001/42001 program far cheaper than running each in isolation.

Scope of this phase

Every part of this program is scope-bounded so you know exactly when you are done.

• In scope: the structure of an ISO/IEC 42001 AI Management System (AIMS); the management-system clauses (context, leadership, planning, support, operation, evaluation, improvement); the Annex A controls and how to select and implement them; the AI system impact assessment; and the path to certification, including how 42001 integrates with an existing ISO 27001 system.
• Explicitly out of scope (later parts): the discovery of unsanctioned AI that the AIMS scope must account for (Part 4); and the technical security controls for AI development and deployment (Parts 5–6) that the AIMS governs but does not itself implement.
• Definition of done: the exit checklist at the end of this part. When every box is ticked, you have a functioning AIMS with a Statement of Applicability, impact assessments for your high-risk AI, and a credible path to certification.

Like every modern ISO management-system standard, 42001 is built on the Plan–Do–Check–Act cycle and the common "Annex SL" high-level structure, which is why it slots so cleanly alongside ISO 27001. If you have run a 27001 system, the shape will be deeply familiar; the novelty is entirely in the AI-specific content — the controls, the impact assessment, and the AI-risk lens.

The management system: the clause structure

The core of 42001 is clauses 4–10, the same backbone every ISO management system shares, instantiated for AI:

• Context (clause 4): understand the organization, the internal and external issues around its AI, the interested parties (customers, regulators, affected individuals) and their requirements — and, critically, define the scope of the AIMS (which AI systems and activities it covers).
• Leadership (clause 5): top management commits, sets an AI policy, and assigns roles and responsibilities — the Part 1 operating model, formalized.
• Planning (clause 6): assess AI risks and opportunities, set objectives, and — the AI-specific heart — plan how AI risks and the impacts of AI systems on individuals and society are addressed.
• Support (clause 7): the resources, competence, awareness, communication and documented information the system needs.
• Operation (clause 8): run the processes — including the AI risk assessment and the AI system impact assessment — and control the AI lifecycle.
• Performance evaluation (clause 9): monitor, measure, audit internally, and review at management level.
• Improvement (clause 10): correct nonconformities and continually improve.

The through-line is continual improvement: the AIMS is not a document you produce once but a cycle you run, which is exactly what makes it a credible answer to a technology and regulatory landscape that keeps moving.

Annex A: the controls

Where clauses 4–10 define the management system, Annex A provides the catalogue of AI-specific controls you select from to treat the risks you identified — the 42001 equivalent of 27001's Annex A. The controls are organized into groups covering the AI lifecycle and its governance, and you choose which apply based on your risk assessment, documenting the result in a Statement of Applicability (SoA). The main control areas:

Each area maps recognizably onto obligations you have already met elsewhere in this program — the impact assessment and lifecycle controls from Part 1, the transparency and human-oversight requirements from the AI Act in Part 2, the data and supplier governance that good security already practises. That overlap is the point: the SoA becomes the single place where your governance, your AI Act obligations, and your customer assurances are reconciled into one control set.

The AI system impact assessment

The distinctive engine of 42001 (and a requirement that echoes the AI Act's) is the AI system impact assessment — a structured evaluation of how an AI system could affect individuals, groups and society, conducted before deployment and revisited as the system or its context changes. It goes beyond a security or privacy assessment to ask about fairness, bias, transparency, human oversight, and the consequences of the system being wrong. For a high-risk system (as classified in Parts 1–2), this assessment is the artifact that ties everything together: it documents the risks, the mitigations, the residual risk and who accepted it. A lightweight record keeps it usable and auditable:

system: AI-017  # support ticket auto-classifier
affected: ["customers", "support agents"]
potential_harms:
  - "misrouting delays a vulnerable customer's urgent issue"
  - "bias: certain dialects/languages classified less accurately"
human_oversight: "agent reviews before priority is acted on (advisory only)"
data_governance: "training data reviewed for representativeness; PII minimized"
mitigations: ["confidence threshold routes low-confidence to human", "quarterly bias eval"]
residual_risk: low
accepted_by: head-of-support
review: "every 6 months or on model change"

This is the same lifecycle discipline as Part 1, now formalized as a controlled record the certification auditor will expect to see — and the same document that evidences your AI Act human-oversight and risk-management obligations.

The path to certification

Certification follows the familiar ISO route, which is a large advantage if you already hold 27001. You build the AIMS (scope, policy, risk assessment, SoA, controls, impact assessments), operate it long enough to generate records (internal audits, management review, evidence the controls run), then engage an accredited certification body for a two-stage audit — Stage 1 reviews readiness and documentation, Stage 2 tests the system in operation — after which certification is maintained through surveillance audits. The single biggest accelerator is integration: 42001 shares its management-system backbone with 27001, so an organization with a mature ISMS can extend it into an AIMS rather than build a parallel system — shared leadership, risk process, internal audit, and management review, with AI-specific controls and impact assessments layered on. Run them as one integrated management system and the marginal cost of the AI certification is a fraction of a standalone effort.

Definition of done — ISO/IEC 42001 exit checklist

You are ready for Part 4 when every one of these is true:

• Scope defined: the AIMS scope is documented — which AI systems and activities it covers — informed by the Part 1 inventory.
• Management system in place: clauses 4–10 are addressed — context, leadership and AI policy, planning, support, operation, evaluation and improvement — with top-management commitment and assigned roles.
• Risk assessment & SoA: an AI risk assessment drives a Statement of Applicability that selects and justifies the Annex A controls, with implemented controls or a treatment plan for gaps.
• Impact assessments: AI system impact assessments exist for high-risk systems, documenting harms, mitigations, residual risk and acceptance, on a review cycle.
• Records & audits: the system is operating and generating evidence — internal audits and a management review have run at least once.
• Integration & certification path: the AIMS is integrated with any existing ISO 27001 system where sensible, and a path to accredited certification (Stage 1/Stage 2) is planned.

Tick every box and your AI governance is a running, auditable management system rather than a collection of good intentions — certifiable, defensible to a regulator, and demonstrable to a customer. Skip the impact assessments or the SoA and you have documentation without a system; the value of 42001 is precisely that it makes governance operational and continual.

What's next

Part 4 — Shadow AI turns from the AI you govern to the AI you may not even know you have. A management system is only as good as its scope, and the uncomfortable truth is that much AI use in most organizations is unsanctioned — employees using consumer AI tools, teams calling model APIs off the books — none of it in your inventory, your risk classification, or your AIMS scope. Part 4 shows how to discover shadow AI, assess the risk it carries (chiefly data leakage), and bring it into governance without resorting to bans that simply drive it further underground. It ships next month.

If you would like experienced hands to build and certify your AIMS — define the scope, run the risk assessment and impact assessments, author the Statement of Applicability, and integrate it with your existing ISO 27001 system — that is exactly what Axelia's consultants do, and ISMShed runs the AIMS as continuous, framework-mapped evidence across ISO/IEC 42001, the EU AI Act, ISO 27001, NIS2, DORA and GDPR, so one system serves your certification and your regulatory obligations at once. Operationalize your governance now, and the rest of the program becomes controls the AIMS governs.