ISO/IEC 42001 for teams that build with AI.
ISO/IEC 42001:2023 is the management system standard for artificial intelligence. Zairen runs it on the same evidence, risk, and audit workflow as your other frameworks, on every plan.
What the standard asks for
ISO/IEC 42001 sets requirements for an AI management system (AIMS): the policies, roles, processes, and records an organization uses to develop, provide, or use AI systems responsibly. Clauses 4–10 cover context, leadership, planning, support, operation, performance evaluation, and improvement, including an AI risk assessment, a risk treatment plan with a Statement of Applicability, and AI system impact assessments.
Annex A: 38 controls across 9 areas
Annex A lists 38 reference controls in 9 areas, A.2 to A.10: policies related to AI, internal organization, resources for AI systems, assessing impacts of AI systems, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships. You decide which controls apply and justify any you exclude in your Statement of Applicability.
Built on the structure you already run
ISO/IEC 42001 follows the same harmonized management-system structure as ISO 27001, so internal audits, management reviews, nonconformities, document control, and the risk process work the same way. If you already run an ISMS, most of that machinery carries over; the new work is AI-specific: impact assessments, data and life-cycle controls, and responsible-use policies.
Same platform, every plan
ISO/IEC 42001:2023 is included on every Zairen plan, alongside ISO 27001, SOC 2, and PCI DSS, with the same platform features: evidence collection, the risk register, the policy registry, tasks, and reports. Plans differ by team size, scan volume, AI credit, and integrations, never by which standard you're certifying against. See pricing.
Is Zairen certified to ISO/IEC 42001?
No. Zairen helps you run and evidence your own AI management system; certification comes from an accredited certification body that audits you. We don't hold an ISO/IEC 42001 certificate ourselves, and our trust page shows where our own certifications stand.
Do we need ISO 27001 before ISO/IEC 42001?
No. ISO/IEC 42001 can be certified on its own. Because both standards share the same management-system structure, teams that run them together can reuse their audit, review, and risk processes.
Can we run ISO/IEC 42001 alongside ISO 27001, SOC 2, or PCI DSS?
Yes. All of them sit in the same control library on every plan, so evidence you already collect can back overlapping controls instead of being gathered twice.
Which plan includes ISO/IEC 42001?
Every plan, from Starter to Enterprise. See pricing.
Who is ISO/IEC 42001 for?
Any organization that develops, provides, or uses AI systems, whatever its size or sector, including teams that only use third-party AI models in their product.