"Trust our AI" isn't a strategy.
ISO 42001 is the proof buyers want.

ISO/IEC 42001:2023, published December 2023, is the world's first international standard for an AI management system (AIMS) — how an organization establishes, maintains, and improves the governance around how it builds and uses AI. It's becoming the credential enterprise customers and procurement teams ask for as evidence you govern AI responsibly.

The reason to certify is usually commercial before regulatory: an accredited certification is independent, third-party proof of AI governance maturity that shortens vendor reviews and differentiates you in deals where buyers are nervous about AI risk. Because it follows the same Annex SL structure as ISO 27001, it integrates with an existing ISMS rather than standing up a separate program.

No — and the distinction matters. The EU AI Act is a law; for in-scope organizations its obligations are a legal requirement. ISO 42001 is a voluntary management-system certification — a governance maturity and commercial signal. They're complementary but not interchangeable, and you should never represent the certification to customers or regulators as EU AI Act compliance.

That said, it's the strongest practical foundation: there's substantial overlap between its 38 Annex A controls and the Act's high-risk requirements, and several core articles have direct counterparts. Build the AIMS first as the backbone, then classify your AI against the Act's risk tiers and gap-analyze anything high-risk. Note the Act's high-risk timelines are still moving — a simplification package is under consideration — so we treat regulatory dates as current-but-subject-to-change and keep the program anchored on durable governance.

Less than you'd fear, because the two share the same Annex SL backbone — context, leadership, planning, support, operation, performance evaluation, improvement — so the management-system machinery from ISO 27001 (governance, internal audit, management review, document control, corrective action) carries over to the AIMS.

What's genuinely new is the AI-specific substance in Annex A: an AI policy and roles, an AI system inventory, the AI Impact Assessment that evaluates societal and ethical risk rather than just security, AI lifecycle management, data and training-data governance, and responsible-AI principles like bias, explainability, human oversight, and drift. Mature ISO 27001 programs reuse the management layer and focus effort on the AI risk and lifecycle domain — exactly where the standard earns its separate existence. We scope to leverage what you have rather than rebuild it.

It follows the familiar ISO management-system path. You scope the AIMS and inventory your AI systems; build the management system and AI Impact Assessment; implement your selected Annex A controls and run an internal audit; then an accredited certification body conducts a Stage 1 documentation audit and a Stage 2 implementation audit. Passing Stage 2 yields certification, maintained over a three-year cycle with annual surveillance and recertification in year three.

A first certification commonly takes on the order of ten to twelve months depending on governance maturity and how many AI systems are in scope; organizations with a strong existing management system move faster. As with every ISO standard, the biggest determinant of timeline is scope and the quality of your documentation and evidence — which is where readiness work pays off before the certification body arrives.