Skip to content
Optim-AI

AI governance

ISO/IEC 42001 for SMEs: when the standard is worth the effort, and when it is not

Up to date as of 10 October 2026. ISO/IEC 42001 is an international standard published in December 2023. It sets out the requirements for an artificial intelligence management system. It is voluntary. Certification is issued by a third-party body, not by a consultancy. It does not amount to compliance with the EU AI Act. For an SME, it is mainly justified if you sell AI-based products or services to customers who require it. In other cases, a few governance rules are often enough. Optim-AI helps you prepare for certification, in a dedicated project. We do not certify.

The standard

What ISO/IEC 42001 is

ISO/IEC 42001:2023 is entitled “Information technology — Artificial intelligence — Management system”. It is aimed at organisations that develop, provide or use AI systems, whatever their size.

It does not cover a model or a piece of software. It covers the way the company organises its decisions about AI: policy, roles, risk analysis, impact assessment, monitoring, improvement.

Its structure follows that of the other ISO management system standards, including ISO/IEC 27001 for information security. The clauses have the same numbers and the same titles: context, leadership, planning, support, operation, evaluation, improvement. An Annex A lists reference controls. The company chooses those that apply and justifies its exclusions.

In France, the standard is available from AFNOR under the reference NF EN ISO/IEC 42001, March 2026 edition.

Certification. It is optional. It is issued by a certification body, after an initial audit, followed by surveillance audits. The requirements for these bodies are set by ISO/IEC 42006, published in 2025. In France, accreditation of these bodies is the responsibility of COFRAC. Before choosing a body, check on cofrac.fr, or with the relevant European accreditation body, that its scope of accreditation does cover ISO/IEC 42001.

The link with ISO 27001. If you are already ISO 27001 certified, you have a common foundation: management review, internal audit, document control, risk analysis. ISO 42001 adds topics specific to AI, such as system impact assessment or data quality. The two systems can be run together.

Limits

What it is not

  • It is not a legal obligation. No legislation requires SMEs to be ISO 42001 certified.
  • It is not compliance with the EU AI Act. The EU AI Act grants a presumption of conformity to harmonised standards whose references are published in the Official Journal of the European Union (Article 40). To our knowledge, as of 10 October 2026, no harmonised standard under the AI Act is cited in the Official Journal, and ISO/IEC 42001 is not one of them. Harmonised standards are being prepared by the European committee CEN-CENELEC JTC 21. The most advanced, prEN 18286, covers the quality management system required of providers of high-risk AI systems. The Commission presents it as a draft, open to public enquiry since 30 October 2025. ISO 42001 certification helps you organise your compliance. It does not demonstrate it requirement by requirement.
  • It is not a guarantee about your tools. The certificate attests that your organisation follows a management system. It does not certify that a given AI system is reliable or risk-free.

The EU AI Act timeline, up to date as of 10 October 2026. Regulation (EU) 2024/1689 was amended by Regulation (EU) 2026/1744, known as the “Digital Omnibus”. That text has been in force since 27 July 2026. The obligations for high-risk systems in Annex III, such as screening job applications or access to credit, apply from 2 December 2027. Those for systems built into regulated products (Annex I) apply from 2 August 2028. These dates are fixed. They do not depend on the publication of harmonised standards. The details, use by use, are on our page EU AI Act for SMEs.

When to go ahead

When it is worth the effort for an SME

Certification takes management time, documentation and recurring audits. It is justified when it meets a real demand.

  • You sell an AI-based product or service to large accounts. Their supplier questionnaires may ask how you govern AI. A certificate answers some of these questions in a standard way.
  • You operate in a regulated sector. Health, finance, insurance, human resources: your customers or your supervisory authorities expect documented risk management.
  • You are already ISO 27001 certified. The additional effort is smaller, because the framework already exists.
  • You develop systems likely to be classified as high-risk under the EU AI Act. The standard does not exempt you from anything. It does, however, provide a framework for organising the work.

When to wait

When it is not worth it

  • You use AI only as an office tool. Writing assistant, meeting summaries, translation. The main risk then lies in the data your teams enter into it. Clear usage rules address it more directly than a full management system.
  • Nobody is asking you for it. Without a requirement from a customer or a market, the certificate has little commercial use.
  • You do not yet have an inventory of your uses. Certifying a system whose scope you do not know makes no sense. The inventory comes first.

Without certification

Where to start without aiming for certification

The foundations of the standard are useful even if you never go as far as the certificate. They match what any management team should know about AI in its company.

  1. Take stock of actual uses.

    Which tools, for which tasks, with which data. Including those adopted without approval.

  2. Appoint the people responsible.

    Who decides to adopt a tool, who monitors the risks, who responds in the event of an incident.

  3. Write usage rules.

    Which data must not leave the company, which tools are authorised, what human review is required.

  4. Review the risks.

    Rank each use by severity and likelihood, then decide on a response: keep, control, stop.

If certification becomes necessary later, this work forms its foundation.

Our role

Optim-AI's role

Our role is to help you prepare for certification. The certificate itself is issued by an accredited body that you choose.

We carry this out in a dedicated preparation project. It is part of our “Custom projects” service, after the audit, and builds on its deliverables.

The three advisory services are described on the Services page.

Optim-AI does not certify. We are not a certification body. As with the audit, our work issues neither a label nor a certificate. Optim-AI does not carry out the certification audit and does not choose the body on your behalf.

Preparation

Our preparation method

The method starts from the deliverables of our AI audit. It maps them to the requirements of an AI management system, in the order of clauses 4 to 10 of the standard. These clauses follow the structure common to ISO management system standards (formerly “Annex SL”). Some audit deliverables cover a requirement. Others are only a starting point. We specify which at each step.

The work that goes beyond the audit forms the dedicated preparation project: AI policy, impact assessment, statement of applicability, preparation of the internal audit and the management review, gap analysis.

  1. Set the context and the scope (clause 4).

    The map of actual AI uses, declared and undeclared, and the inventory of sensitive data describe the starting point. With you, we derive the scope of the management system from them: which activities, which tools, which sites. We also specify your role for each system: you develop it, provide it or use it.

  2. Engage management and write the AI policy (clause 5).

    The AI usage rules, ready to be attached to the company's internal regulations, serve as the basis. The AI policy is drafted with management, which approves it. Roles are assigned: who decides to adopt a tool, who monitors the risks, who responds in the event of an incident.

  3. Assess and treat the risks (clause 6).

    The list of risks ranked by severity and likelihood becomes the risk assessment. The countermeasures plan becomes the risk treatment. Two pieces of work are added to the audit. First, the impact assessment of each AI system on the people concerned. Second, the selection of the Annex A controls that apply to you, with the justification for exclusions: this is the statement of applicability. The objectives of the management system are set at this step.

  4. Organise support (clause 7).

    We list the competences required and the awareness actions for teams. We put in place the control of the required documents: policy, risk assessment, statement of applicability, usage rules, records.

  5. Implement (clause 8).

    The target architecture shows what stays in-house, what goes to a third party, and why. The action plan, sequenced over 3, 6 and 12 months, sets the order of the work. The selected controls are applied and recorded.

  6. Monitor and evaluate (clause 9).

    The steering indicators and the review schedule from the audit are used for monitoring. We help you organise the internal audit programme and prepare the first management review.

  7. Improve (clause 10).

    Nonconformities found lead to corrective actions. The action plan is reviewed at each management review.

  8. Analyse the gaps, then hand over.

    Before the certification audit, we compare your system with the requirements of the standard, clause by clause, and with the selected Annex A controls. You receive the list of remaining gaps and the actions to close them. You then engage the certification body of your choice. Check beforehand that its scope of accreditation covers ISO/IEC 42001.

You can stop after any step. The documents produced belong to you.

The duration depends on the scope and on what already exists, for example ISO 27001 certification. It is defined during the first conversation.

Frequently asked questions

Questions from business leaders

What is ISO 42001, in one sentence?
An international standard that describes how an organisation governs the AI it develops, provides or uses: policy, roles, risks, monitoring and improvement.
Does an SME have to be ISO 42001 certified?
No. No legal obligation requires it. The question mainly arises if your customers require it or if you sell AI-based solutions.
Does ISO 42001 certification make you compliant with the EU AI Act?
No. The presumption of conformity is reserved for harmonised standards cited in the Official Journal of the European Union. To our knowledge, as of 10 October 2026, none is, and ISO/IEC 42001 is not one of them. Certification can help you structure your approach.
Can Optim-AI certify us?
No. Optim-AI is not a certification body. Only an accredited body issues the certificate. We help you prepare your AI management system beforehand, up to the gap analysis.
How does preparation with Optim-AI work?
It is a dedicated preparation project, which follows the AI audit. It starts from the audit deliverables: actual uses, sensitive data, ranked risks, usage rules, action plan. We complete them to cover clauses 4 to 10 of the standard, then we measure the remaining gaps before the certification audit. The duration depends on the scope.

Sources

The texts consulted

Page up to date as of 10 October 2026. The text of the standard is not quoted. We found no harmonised standard cited in the Official Journal under the EU AI Act. No certification body is named: check its scope of accreditation on cofrac.fr.

AI audit for SMEs and mid-sized companiesActual uses, exposed data, risks and countermeasures plan.EU AI Act for SMEsObligations and timeline, up to date as of 10 October 2026.Risks and controlThe five real risks and their countermeasures.The methodDiagnostic, audit, projects.ServicesDiagnostic, audit, custom projects.ContactA first thirty-minute conversation, with no commitment.

Next step

Find out whether ISO 42001 is worth the effort for you

The first conversation lasts thirty minutes, with no commitment. It is used to frame your need and what to look at first.

Book 30 minutesTake the AI maturity test