ISO 42001 certification
Govern how your company uses AI
A management system for AI, what you use it for, what could go wrong, and who's accountable.
What ISO 42001 is
ISO/IEC 42001 is an international standard for an AI management system: a structured way to govern how an organization develops and uses artificial intelligence.
Like ISO 27001, it is a certifiable management system standard rather than a technical checklist. It asks what you use AI for, what could go wrong, who is accountable, and what evidence shows the system operates.
It is the newest standard here and buyer literacy is still low. What is real is the demand behind it: enterprise buyers are adding AI-governance questions to security reviews, and few vendors can answer them.
Who needs ISO 42001
You build AI features into your product, or use AI systems in ways your customers ask about. A security questionnaire has started asking how you govern AI, and you do not have a documented answer.
How TrustLynce helps with ISO 42001
AI system inventory
Record what you use AI for, where it sits in your product, and what data it touches.
Impact assessment
Assess what could go wrong for the people affected, and record how it is mitigated.
Accountability
Name who owns each AI system and the decisions it participates in.
Reuse your ISMS
It is a management system standard like ISO 27001, so much of the structure you already run carries over.
ISO 42001 questions
Only if your buyers are asking. Demand is emerging rather than established: the honest position is that it is early, and being early is the advantage.
Same management system structure, different subject. If you run an ISMS, the scaffolding is familiar and much of it is reusable.
Yes, by an accredited certification body, not by trustlynce.
No. They are different instruments: one is a voluntary standard, the other is law. A management system helps you evidence governance, but it is not a compliance route for the Act.
No. It applies to how you use AI, not to whether you build it. Most organizations in scope are using AI systems rather than developing them.
Other frameworks
Evidence collected for one framework carries into the next.
SOC 2
The one your buyers ask for
ISO 27001
Recognised worldwide
HIPAA
Protect health information
GDPR
Handle EU personal data
PCI DSS
Take card payments safely
NIST CSF
A common security language
CMMC
Work with the DoD
Custom
Your own control set
ISO 27701
Privacy extension to ISO 27001
DORA
EU financial operational resilience
NIS 2
EU critical infrastructure cybersecurity
CCPA / CPRA
California comprehensive privacy
FERPA
Student education privacy standard
FDA 21 CFR Part 11
FDA electronic records & signatures
HDS Certification
French health data hosting certification
SOX ITGC
IT controls for public companies
HITRUST CSF
Assurance healthcare buyers ask for
FedRAMP
Sell cloud services to US agencies
NIST SP 800-53
The federal security control catalog
NIST SP 800-171
Protect CUI on federal contracts
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.