The ISO 42001 Family: How the AI Standards Fit Together

ISO/IEC 42001 is the certification standard for AI management systems, but it doesn't stand alone. Around it sits a family of companion standards, each going deeper on a specific aspect. Once you have the overview, you know where to look something up instead of getting lost.

The central standard: the "what"

ISO/IEC 42001 defines the requirements for the management system, in other words what has to be in place: policy, roles, risk assessment, controls, improvement. It is the only standard in the family you can actually get certified against.

The companion standards: the "how" and "how deep"

• ISO/IEC 42005, AI System Impact Assessment: how to evaluate the consequences for affected people and for society.
• ISO/IEC 23894, AI risk management: deepens the risk work and ties into the generic risk standard ISO 31000.
• ISO/IEC 22989, Terminology and concepts: the shared vocabulary that ISO/IEC 42001 refers to.
• ISO/IEC 23053, Framework for AI/ML systems: the technical vocabulary for the architecture.
• ISO/IEC 38507, Governance implications of AI: the perspective of top management.
• ISO/IEC 42006, Requirements for bodies certifying AIMS: relevant for accreditation, not for the organization being audited.

And the standards for the auditor?

Two further standards are less about content and more about method. ISO 19011 provides the audit methodology for management systems, while ISO/IEC 17021-1 sets the requirements for certification bodies. They don't define what makes a good AI system, but how cleanly an organization is audited and certified.

Rule of thumb: ISO/IEC 42001 says WHAT an AI management system needs. The companion standards say HOW to do the individual parts well. ISO 19011 and ISO/IEC 17021-1 say how the whole thing is audited.

What this means in practice

For an audit or an implementation you don't need the entire library. ISO/IEC 42001 is the anchor; you reach for ISO/IEC 23894 and ISO/IEC 42005 when risk and impact assessment need real depth; ISO/IEC 38507 helps the leadership level. What matters is knowing the right standard for the right question, and that is precisely part of an auditor's competence.