ISO/IEC 42001:2023 · AI management system
ISO 42001 Implementation and Certification
We implement ISO/IEC 42001, the international standard for managing AI responsibly, and get you ready for certification. We map your AI systems, assess their risks and impacts, put the policies and controls in place, and prepare you for the certification body’s audit.
Based in Dubai? See our ISO 42001 certification in Dubai.
Based in Abu Dhabi? See our ISO 42001 certification in Abu Dhabi.
Based in Sharjah? See our ISO 42001 certification in Sharjah.
- 23+ years in UAE cybersecurity
- 500+ clients
- 99% client satisfaction
What is ISO 42001?
ISO/IEC 42001:2023 is the international standard for an AI management system (AIMS). Published in December 2023, it sets requirements for how an organisation governs the AI systems it develops, provides or uses, including risk and impact assessment, data, transparency and supplier controls. It is the first AI management standard an organisation can be certified against.
| Standard | ISO/IEC 42001:2023, Artificial intelligence — Management system |
|---|---|
| Published | December 2023 |
| Applies to | Any organisation that develops, provides or uses AI systems, of any size and in any sector |
| Structure | Requirements in clauses 4 to 10, the same structure as ISO 27001, plus 38 Annex A controls in 9 areas |
| Certification | By an accredited certification body. ISO/IEC 42006:2025 sets the rules those bodies must follow |
| Related standards | ISO/IEC 42005:2025 (AI system impact assessment) and ISO/IEC 23894 (AI risk management guidance) |
| UAE context | The Central Bank’s February 2026 guidance note on AI, and a new federal authority for AI and data created in June 2026 |
Is ISO 42001 right for you?
It is worth implementing if any of these describe you:
- You build AI products or AI features that you sell to enterprise or government customers
- Customers, tenders or investors are asking how you govern AI
- You use AI in decisions about people, such as credit, hiring, claims or patient care
- You are a bank or insurer applying the Central Bank’s guidance note on AI
- You sell into the EU and need to show how you manage AI risk under the EU AI Act
- You already hold ISO 27001 and want to extend it to cover AI
ISO 42001 is voluntary, and no UAE law requires certification as of October 2026. It gives you a recognised, auditable way to show customers and regulators that your AI is under control.
What ISO 42001 implementation involves
The standard combines management system requirements with AI-specific controls. The work falls into eight areas.
Scope and AI inventory
Identify every AI system in scope and your role for each one: developer, provider or user (Clause 4).
Leadership and AI policy
An AI policy, objectives and clear roles and responsibilities, owned by top management (Clause 5, Annex A.2 and A.3).
AI risk assessment
A repeatable method to identify, analyse and treat risks from your AI systems, linked to your wider risk management (Clause 6).
AI system impact assessment
Assess how each AI system could affect individuals, groups and society, and act on the results (Clause 6.1.4, Annex A.5).
AI system lifecycle
Controls from requirements and design through verification, deployment, monitoring and retirement (Annex A.6).
Data for AI
Data quality, provenance and preparation for training and operating AI systems (Annex A.7).
Transparency and responsible use
Information for users and affected people, intended use and human oversight (Annex A.8 and A.9).
Suppliers and customers
Clear responsibilities with AI vendors, model providers and customers across the AI supply chain (Annex A.10).
How we get you to ISO 42001 certification
A fixed sequence, so you always know what happens next and what you will have at the end of each stage.
- 1
Scoping call
We review how you build or use AI, your certification goal and deadline, and any ISO 27001 system we can build on.
Week 0 · free
- 2
AI inventory and gap assessment
We list your AI systems and roles, then check your current practice against clauses 4 to 10 and the Annex A controls.
Weeks 1–3
- 3
Risk and impact assessments
AI risk assessment and AI system impact assessments for the systems in scope, with treatment plans your leadership approves.
Weeks 3–6
- 4
Build the management system
AI policy, objectives, procedures, lifecycle and data controls, supplier requirements and the statement of applicability.
Weeks 4–10
- 5
Operate and audit internally
The system runs and produces records, then we carry out an internal audit and support your first management review.
Weeks 10–14
- 6
Certification audit support
We help you choose an accredited certification body and support you through the stage 1 and stage 2 audits.
Weeks 14–18
Most organisations are ready for certification in 3 to 5 months. With ISO 27001 already in place, 2 to 3 months is common.
What you get
- AI system inventory and scope statement
- Gap assessment against clauses 4 to 10 and Annex A
- AI policy and AI objectives
- AI risk assessment and treatment plan
- AI system impact assessments
- Statement of applicability for the 38 Annex A controls
- AI lifecycle and data management procedures
- Supplier and third-party AI requirements
- Internal audit report and management review pack
- Certification audit readiness pack
Choose how we work with you
ISO 42001 gap assessment
3–4 weeksBest for: Knowing exactly where you stand
- · AI inventory
- · Gap report against the standard
- · Roadmap to certification
Implementation to certification
3–5 monthsBest for: Getting certified end to end
- · Everything in the gap assessment
- · Full management system and controls
- · Internal audit and certification support
Extend ISO 27001 to AI
2–3 monthsBest for: Organisations already certified to ISO 27001
- · Integrated management system
- · AI-specific controls and assessments
- · Combined audit readiness
Customers asking how you govern AI?
A 30-minute call is enough to scope your AI systems and tell you how far you are from ISO 42001 certification.
ISO 42001 vs ISO 27001
The two standards share the same management system structure, so they work well together. They manage different risks.
| Topic | ISO/IEC 27001 | ISO/IEC 42001 |
|---|---|---|
| Focus | Information security | Responsible development and use of AI |
| Main risks | Confidentiality, integrity and availability of information | AI risks to the organisation, individuals, groups and society |
| Annex A | 93 security controls | 38 AI controls in 9 areas |
| Key assessments | Information security risk assessment | AI risk assessment and AI system impact assessment |
| Structure | Clauses 4 to 10 | Clauses 4 to 10, so the two can run as one integrated system |
| Certification | Accredited certification body | Accredited certification body, following ISO/IEC 42006 |
What affects cost and timeline
You get a written scope and quote after the scoping call. These are the factors that move it:
- AI systems in scope
- The number and complexity of the AI systems you develop, provide or use.
- Your role
- Developing AI needs more lifecycle and data controls than using third-party AI tools.
- Existing management systems
- ISO 27001 or ISO 9001 can be extended, which shortens the project.
- Data sensitivity
- Personal, health or financial data increases the depth of the impact assessments.
- AI suppliers
- The number of model providers and AI vendors to assess and contract with.
- Certification fees
- Certification body audit fees are paid to the certification body, separately from our work.
Why organisations choose Intello for ISO 42001
23+
years in UAE cybersecurity
500+
clients served
99%
client satisfaction
AI and security under one roof. Our AI consulting and cybersecurity teams work together, so AI controls are also secure controls.
One management system, not two. We integrate ISO 42001 with your ISO 27001 system so audits and records are shared.
Independent of the certifier. We prepare you; an accredited certification body audits you. That keeps the certificate credible.
Dubai-based team. We work on site with your product, data and compliance teams across the UAE.
Frequently asked questions
What is ISO 42001?
ISO/IEC 42001:2023 is the international standard for an AI management system. It sets requirements for how an organisation governs the AI systems it develops, provides or uses, covering policy, roles, risk and impact assessment, the AI lifecycle, data, transparency and suppliers. Organisations can be certified against it.
Is ISO 42001 certification mandatory in the UAE?
No. As of October 2026, no UAE law requires ISO 42001 certification. However, the Central Bank issued a guidance note on responsible AI for licensed financial institutions in February 2026, a new federal authority for AI and data was created in June 2026, and customers increasingly ask for AI governance evidence. ISO 42001 gives you a recognised way to provide it.
Who should implement ISO 42001?
Any organisation that develops, provides or uses AI systems. It is most valuable for AI product companies selling to enterprise and government, for banks, insurers and healthcare providers using AI in decisions about people, and for organisations already certified to ISO 27001.
How long does ISO 42001 certification take?
Most organisations are ready for the certification audit in 3 to 5 months. If you already hold ISO 27001, 2 to 3 months is common, because the management system structure is shared.
How does ISO 42001 certification work?
An accredited certification body audits you in two stages: stage 1 reviews your documentation and readiness, stage 2 checks the system is working in practice. Certificates normally run for three years with annual surveillance audits. ISO/IEC 42006:2025 sets the requirements those certification bodies must meet.
Can ISO 42001 be combined with ISO 27001?
Yes. Both follow the same clause structure, so policies, internal audits, management reviews and document control can be shared. Many organisations run them as one integrated management system and combine the audits.
Do we need ISO 42001 if we only use AI tools and do not build them?
It can still apply. The standard covers organisations that use AI as well as those that develop it. Using third-party AI tools brings supplier, data and transparency risks that the standard helps you manage, with a lighter set of lifecycle controls.
What is an AI system impact assessment?
It is an assessment of how an AI system could affect individuals, groups of people and society, for example through bias, errors or misuse. ISO 42001 requires it for systems in scope, and ISO/IEC 42005:2025 gives guidance on how to carry it out.
Related services
Related insights
- Top 10 ISO 42001 Consultants in the UAE
- Why ISO 42001 Is Important for Businesses in the UAE
- ISO 42001 Certification in the UAE: Cost, Timeline and Steps
- Why AI Governance Matters Now — and What ISO 42001 Means for Businesses in the UAE
- Ethical AI Governance: Building Responsible AI Systems in Regulated Industries
- AI in Compliance Automation: Beyond Rule-Based Systems
Get a clear view of your ISO 42001 readiness
Tell us a little about how you build or use AI and we will set up a free 30-minute readiness check.
What happens next
- 1We reply within one business day
- 2A 30-minute call to scope your AI systems
- 3A written scope, timeline and quote
Prefer to talk now? Call +971 55 355 6787
Last reviewed: October 2026. This page is general guidance, not legal advice.
Sources: ISO/IEC 42001:2023, AI management system (ISO) · ISO/IEC 42006:2025, requirements for AIMS certification bodies (ISO) · Guidance Note on the Responsible Adoption and Use of AI and Machine Learning by Licensed Financial Institutions, 11 February 2026 (CBUAE Rulebook)