Article · November 4, 2026
ISO/IEC 42001: AI Governance Ahead of the AI Act
ISO/IEC 42001: standard overview, 38 Annex A controls, alignment with ISO 27001 and the AI Act Omnibus, certification process, and initial steps.
Published on December 18, 2023, ISO/IEC 42001 is the only certifiable standard for an artificial intelligence management system (AIMS). With AI Act transparency obligations applying since August 2, 2026, and high-risk AI requirements taking effect on December 2, 2027, ISO 42001 is becoming the governance foundation that clients and auditors are already demanding.
What the Standard Covers
ISO 42001 governs how an organization develops, provides, or uses AI, regardless of its size. It does not certify the security of a specific model, but rather the governance system that surrounds it (CyberSaint).
It shares the common Harmonized Structure of ISO management standards (Clauses 4 to 10), such as ISO 27001 or ISO 9001. Its key distinction lies in the AI system impact assessment (Clause 6): it evaluates consequences for individuals and groups, not just business risk.
Annex A outlines 38 controls across nine control categories. As with ISO 27001, you select applicable controls and justify any exclusions in a Statement of Applicability (SoA):
| Objective | Domain | Controls |
|---|---|---|
| A.2 | Policies related to AI | 3 |
| A.3 | Internal organization | 2 |
| A.4 | Resources for AI systems | 5 |
| A.5 | Assessing impacts of AI systems | 4 |
| A.6 | AI system life cycle | 9 |
| A.7 | Data for AI systems | 5 |
| A.8 | Information for interested parties | 4 |
| A.9 | Use of AI systems | 3 |
| A.10 | Third-party and customer relationships | 3 |
Source: CyberSaint.
Category A.10 is often overlooked until late in the process: it covers third-party AI you procure or integrate into your tools, which typically outnumbers in-house developed systems.
ISO 42001 and ISO 27001: Same Structure, Different Focus
ISO 27001 protects information through 93 controls; ISO 42001 governs AI behavior and its consequences through 38 controls. An organization already certified to ISO 27001 will find that it already covers most of Clauses 4, 5, 7, 9, and 10. The core effort lies in Clause 6 and Annex A.
Certification bodies offer integrated audits covering both standards (CyberSaint).
ISO 42001 and the AI Act: Complementary, Not Equivalent
ISO 42001 certification does not grant a presumption of conformity with the AI Act; that would require a harmonized standard cited in the Official Journal of the EU (CyberSaint). However, it delivers the foundational governance the regulation presumes: defined roles, impact assessments, lifecycle monitoring, and third-party risk management.
The AI Act timeline was updated by the "AI Omnibus", Regulation (EU) 2026/1744, published in the Official Journal on July 24, 2026, and entered into force on July 27 (K&L Gates via Mondaq):
| Deadline | What Applies |
|---|---|
| August 2, 2026 | Transparency: informing users they are interacting with AI, labeling deepfakes and certain generated content |
| December 2, 2026 | Two new prohibited practices (realistic generated intimate imagery, CSAM) |
| December 2, 2027 | Standalone high-risk AI under Annex III (employment, education, credit, critical infrastructure, etc.) |
| August 2, 2028 | High-risk AI embedded into regulated products (medical devices, machinery, toys) |
Rules governing general-purpose AI (GPAI) models remain on their original timeline, and the European AI Office has received expanded investigative powers (K&L Gates via Mondaq). The postponement offers extra time, not an exemption.
How Domyno helps
One source of truth, agents that prepare the work, and a dedicated expert who reviews it.
Achieving Certification
Certification follows the standard path: a documentation review (Stage 1), an implementation audit (Stage 2), followed by annual surveillance audits across a three-year cycle. Expect a timeline of 6 to 12 months, including at least three months of operational run-time to generate monitoring evidence and complete an internal audit.
Ensure that the certification body is accredited under ISO/IEC 42006:2025, which establishes competence requirements for AI auditors (CyberSaint).
Where to Begin
- Inventory all your AI systems, including procured solutions or AI embedded in SaaS tools.
- Classify each system according to AI Act risk tiers.
- Define a realistic AIMS scope: an overly broad scope is the leading cause of implementation failure.
- Conduct risk assessments and impact assessments for every system within scope.
- Draft the Statement of Applicability for the 38 controls.
- If already ISO 27001 certified, extend your existing ISMS rather than building a siloed management system.
How Domyno Supports Your Journey
AI governance cannot be managed through spreadsheets, and that is where Domyno makes the difference: an exceptionally comprehensive platform built to adapt to your workflows. With the custom framework, you can unify ISO 42001, AI Act requirements, and your internal AI ethics charter into a single framework tailored to your organization.
The control plan translates your Statement of Applicability into tracked actions: every selected control has an assigned owner, deadline, and audit trail. Risk assessments, vendor risk management (essential for procured AI), policies, and incident management leverage the same foundation as your ISMS.
Domyno's AI saves you valuable time, while a dedicated compliance expert assists you in defining your scope and preparing for your certification audit.