Skip to main content
SecureAI Guard

ISO/IEC 42001 for LLM applications

What ISO/IEC 42001:2023 certifies, how it differs from ISO/IEC 27001, and what an LLM deployment has to produce to survive the audit.

Published ·4 min read·SecureAI Guard
ISO 42001
certification
governance
compliance

*ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system* is the first AI management system standard, and the only AI-specific framework in common use that an accredited body can certify** you against. That single property is why it appears in procurement questionnaires next to SOC 2 and ISO/IEC 27001 and why the NIST AI RMF, which is better known, does not: a buyer's third-party risk process needs a certificate, and NIST does not issue one.

It certifies a management system, not a product. There is no such thing as an ISO 42001-certified model, an ISO 42001-certified API or an ISO 42001-compliant guardrail. A vendor claiming any of those has misread the standard, and it is a useful tell.

Source and currency. Checked on 12 August 2026 against the ISO catalogue entry, which is the authority for the designation and scope. The standard itself is not free; the catalogue page carries the abstract.

What it actually is

If you have been through ISO/IEC 27001, the shape will be familiar. 42001 uses the same Annex SL harmonised structure — context, leadership, planning, support, operation, performance evaluation, improvement — with a set of AI-specific controls in its annexes. An organisation with a working 27001 ISMS is usually closer to 42001 than it expects, because the machinery of internal audit, management review, corrective action and a Statement of Applicability is already running.

The substantive difference is what the controls are about:

ISO/IEC 27001ISO/IEC 42001
ObjectInformation securityThe organisation's use and provision of AI
Core questionIs information confidential, available and intact?Is this AI system's purpose defined, its impact assessed, its data governed and its behaviour overseen?
Distinctive artefactsRisk treatment plan, Statement of ApplicabilityAI system impact assessment, AI system lifecycle records, data-for-AI governance, human oversight arrangements
CertifiableYesYes

The two are complementary and are frequently certified together, sharing one integrated management system. 27001 does not cover 42001's ground: an impeccable ISMS says nothing about whether anyone assessed what your model does to the people it is used on.

What an LLM deployment has to be able to show

Four things reliably decide whether an LLM application survives a 42001 audit, and three of them are records that either exist from the beginning or cannot be reconstructed:

A defined intended purpose per system, and evidence it has not drifted. Agentic systems drift by design — a tool is added, a corpus is extended, and the system is now doing something its impact assessment did not consider. The auditable answer is a change process attached to the tool set and the corpus, not a yearly re-read of a document.

An AI system impact assessment that was actually used. Auditors distinguish an assessment that changed a decision from one that was written after the design was frozen. The tell is whether anything in the system looks different because of it.

Data governance for the material that reaches the model. For a RAG application this means the retrieval corpus specifically: where each document came from, who may see it, and what enforces that at query time. An index built by crawling everything the organisation owns has, by construction, no access control, and that is a data governance finding before it is a security one.

Records of operation. Which models were called, what policy applied, what was blocked and why, and who reviewed it. This is the clause most LLM programmes fail on, and they fail on it retrospectively: the audit asks for six months of evidence and the logging was switched on last month.

Where the boundary sits between a product and a certificate

Say this out loud in an evaluation, because both sides waste time otherwise:

  • A control layer cannot make you certifiable. Certification requires policies, defined roles, an internal audit programme, management review and a named accountable person. Those are organisational and no software supplies them.
  • What it can do is produce the operating records the audit asks for, in a form that can be exported and attached to a Statement of Applicability, so that "we enforce this" is evidenced rather than asserted. An inline control on the request path is the only place in a typical architecture where those records can be captured completely, because it is the only component every model call goes through.
  • A vendor's own certification is a separate question from yours. If you need your suppliers certified, ask the supplier directly. Our own status — what we hold, what we do not, and the dates — is on the trust page, stated plainly including where the answer today is "not yet".

If you are deciding what to do first

For most organisations the sequence that wastes the least effort is: run the programme by the NIST AI RMF because it is free and tells you what to actually do; get the operating records in place early, because they are the artefact you cannot backfill; and pursue 42001 certification when a customer's procurement process requires it, at which point most of the work is already done and what remains is the management-system scaffolding.

Primary sources