ISO/IEC 42001 is an international standard for managing artificial intelligence responsibly, published on 18 December 2023. Herbst Group is pursuing certification to it, together with ISO/IEC 27001:2022, in one integrated system. We are not yet certified. A-LIGN, our appointed independent accredited certification body, will test the system as it runs. Stage 1 is targeted for the first quarter of 2027.
What ISO/IEC 42001 is
ISO/IEC 42001 sets requirements, and gives guidance, for establishing, implementing, maintaining and continually improving an AI management system. It is written for organisations that provide or use AI-based products or services. It applies to any organisation, regardless of size, type and nature. It shares the harmonised structure of other ISO management system standards. It can therefore run inside the same system as ISO/IEC 27001. Its Annex A sets out reference control objectives and controls. They cover matters such as AI policy, roles, data quality, information for users, logs and human oversight. They also cover relationships with suppliers and customers. Accredited certification bodies audit and certify organisations against it.
Its companion in our system, ISO/IEC 27001:2022, was published on 25 October 2022. It sets requirements for an information security management system, including the assessment and treatment of information security risks. It applies to all organisations regardless of type, size or nature.
Why a young firm takes this on
We began operating in 2023, the year ISO/IEC 42001 was published. The governance of AI is new for every organisation. We learn every day, and we write down what we decide, with the date.
The standards describe the same order. They ask an organisation to establish a management system, implement it, maintain it and continually improve it. Both apply to any organisation, regardless of size. ISO/IEC 27001 lets no organisation claim conformity while leaving out a requirement of its Clauses 4 to 10. A certification audit tests the system as it runs, in two stages.
When a policy changes, we issue a new version for signature. One scope will cover all four Herbst companies and every contracted member of the team. We have defined our role as both a deployer and a provider of AI. We are designing each control to have a named owner who does not audit it. In the system we are building, a formal management review will turn what we learn into signed decisions.
Bringing ISO/IEC 42001 into the same system moved our original timing, and we chose that deliberately. One scope, one set of controls, one audit cycle. We chose to be evaluated so that clients can check our learning rather than take our word for it.
What changes for a client
- The standard requires our use of AI to sit inside a defined system. That means an AI policy, assigned roles, and controls over data quality, logs, human oversight and suppliers.
- A qualified consultant reviews all AI-generated content before it reaches you, and no clinical decision is delegated to AI.
- Your data is not used for model training under our commercial API terms.
- An independent auditor will test the system against both standards.
- Our progress is public: if a target moves, we publish the change on our trust page first.
What our certification body does and does not do
Our certification body is accredited by the ANSI National Accreditation Board (ANAB) for ISO/IEC 27001 and ISO/IEC 42001 certification. It will audit our management system against both standards and will decide whether to certify it. It does not design, build or run our management system. It states that it offers no ISO management consulting. It does not audit clients to whom it has given non-audit services. It handles appeals and complaints under ISO/IEC 17021-1, and someone outside the audit team looks into appeals.
What "pursuing" means, and the next milestone
Pursuing means we have committed to certification and the work is under way. We hold no certificate and make no claim of compliance. Certification follows two audit stages. Stage 1, the documentation review, is targeted for the first quarter of 2027. Stage 2, the certification audit, is targeted for mid-2027. These are targets. If one moves, we publish the change on our trust page first.
Frequently asked questions
Is Herbst Group certified to ISO/IEC 42001?
Not yet. We are pursuing certification, and Stage 1 is targeted for the first quarter of 2027.
Why pursue both standards at once?
They share one structure, so one integrated system gives us one scope, one set of controls and one audit cycle.
Does ISO/IEC 42001 apply to a small firm?
Yes. It applies to any organisation, regardless of size, type and nature.
Does the certification body help you prepare?
No. It audits and certifies; it states that it offers no ISO management consulting.