In short: often yes, but as infrastructure, not as an obligation. ISO/IEC 42001:2023 is the first international standard for an AI management system (AIMS): voluntary and certifiable. For an SME its real value is readiness for the AI Act — it builds the governance backbone that the Regulation requires anyway. But adopting it is not equivalent to being compliant with the AI Act. Below are the facts from the ISO catalogue, then our reading.
The facts · fields 1–10
01 · Name
«Information technology — Artificial intelligence — Management system». Common abbreviation: ISO 42001. It defines an AI Management System (AIMS). It is the world's first international standard dedicated to an AI management system. The official title is in English; ISO does not publish an official Italian translation of the text (any national UNI/CEI adoption is ⚠️ [to verify]).
ISO · official catalogue 42001
02 · Type of source
Published jointly by ISO and IEC, developed by the technical committee ISO/IEC JTC 1/SC 42 (Artificial intelligence). It is not a legislative act: it is a technical standard adopted on a voluntary basis.
ISO · catalogue 42001 (committee JTC 1/SC 42)
03 · Nature
Adoption is not imposed by law; however, an organisation can obtain a certification of conformity issued by an accredited certification body (third-party audit). It adopts the Harmonized Structure (Annex SL) — the high-level structure common to ISO management-system standards (e.g. ISO/IEC 27001, ISO 9001), built on the PDCA (Plan-Do-Check-Act) cycle of continual improvement.
ISO/IEC Directives Part 1, Annex SL · ISO catalogue 42001
04 · Subject matter
It specifies the requirements to establish, implement, maintain and continually improve an AIMS. It provides a structured approach to govern the risks and opportunities associated with the development, provision and use of AI systems (policies, roles, risk and impact assessment, controls, oversight, improvement). It does not address the technical merits of the individual application, but its organisational governance.
ISO · official catalogue 42001
05 · Who it applies to
To every organisation, of any size and sector, that provides or uses AI-based products or services (public or private, for-profit or non-profit). Independent of the type of system (predictive ML, generative AI, agentic systems). Adoption is a choice of the organisation, not a personal-scope obligation defined by law.
ISO · official catalogue 42001
06 · Key dates
Publication of the first edition (Edition 1) of the standard.
The exact day of publication and the document's page count: ⚠️ [to verify] on the ISO catalogue (the full text is paywalled; the catalogue record confirms year 2023 and edition 1).
ISO · catalogue 42001 (2023 edition)
07 · Authorities / bodies
ISO and IEC are private, non-governmental standardisation bodies; they do not supervise or impose penalties. Conformity is attested — on a voluntary basis — by accredited certification bodies under the national accreditation bodies (in Italy: ACCREDIA — ⚠️ [to verify] the existence of accreditation schemes specific to ISO/IEC 42001). A certification body is not a public authority and certification is not an administrative act.
ISO · nature of ISO/IEC as standardisation bodies
08 · Status
An active and certifiable standard. It constitutes the current international reference for AI management systems. Any subsequent editions or technical corrigenda: ⚠️ [to verify] on the ISO catalogue as at the date of consultation.
ISO · official catalogue 42001
09 · Relationship with other rules
ISO · catalogue 42001 (Harmonized Structure / relationship with ISO MSS)
10 · Official source
Primary source to cite: the official ISO catalogue. Transparency note: the full text of the standard is paywalled; NomotecnIA's verification is limited to the data in the official catalogue record (name, edition, year, committee, scope). The individual clauses/controls (Annex A, specific requirements) are not verifiable free of charge against the primary source and are not reproduced here.
Open the official source on ISO
Primary source · ISO (official catalogue)
Fields 11–12 · our own synthesis
These are not legal obligations, but the operational steps to adopt the AIMS.
Positioning note (NomotecnIA): NomotecnIA can support readiness towards ISO/IEC 42001 (gap analysis, documentation framework, audit preparation), but it is not a certification body and does not issue ISO/IEC 42001 certification: that is issued exclusively by an independent accredited body.
In depth
What an AIMS really is, why it is a «bridge» towards the AI Act, and why certification must be requested only from an accredited body.
From the rule to your company
The AI Entry Assessment evaluates whether the AIMS is worthwhile for your organisation and how to integrate it with the AI Act and the GDPR: gap analysis, documentation framework, audit preparation — without duplicating the work.