AI governance is the set of decisions, roles and controls that keep an organisation's use of artificial intelligence lawful, safe and aligned with its objectives. Since December 2023 it has an international reference: ISO/IEC 42001, the first management system standard for AI. In the European Union it also has a legal backbone: the EU AI Act. This guide explains how the two fit together and where to start.
What AI governance covers
Most organisations already use AI without having decided to: in office suites, CRM and HR tools, code assistants and customer-facing chatbots. AI governance answers five practical questions:
- Inventory: which AI systems do we build, buy or use, and for what purpose?
- Accountability: who approves a new AI use case, and who answers for its outcomes?
- Risk: what can go wrong for the organisation and for the people affected, and how likely is it?
- Controls: data quality, human oversight, transparency, security, supplier management, monitoring.
- Evidence: how do we prove to customers, auditors and regulators that the controls work?
ISO/IEC 42001 in brief
ISO/IEC 42001:2023 specifies the requirements for an AI management system (AIMS). It follows the same harmonised structure as ISO/IEC 27001 and ISO 9001, so it can be integrated with an existing ISMS or quality system rather than built from scratch.
| Part | What it contains |
|---|---|
| Clauses 4-10 | Certifiable requirements: context and scope, leadership and AI policy, planning (AI risk assessment, risk treatment, AI system impact assessment), support, operation, performance evaluation and improvement |
| Annex A | 38 reference controls grouped by objective: policies, internal organisation, resources, impact assessment, AI system life cycle, data, information for interested parties, use of AI systems, third-party relationships |
| Annex B | Implementation guidance for each Annex A control |
| Annexes C and D | Potential AI-related objectives and risk sources, and use of the AIMS across domains and sectors |
As with ISO/IEC 27001, a Statement of Applicability records which Annex A controls apply and why. Organisations can be certified by an accredited certification body; people can be certified as Foundation, Lead Implementer or Lead Auditor.
Companion standards
- ISO/IEC 22989: AI concepts and terminology
- ISO/IEC 23894: guidance on AI risk management
- ISO/IEC 42005: AI system impact assessment
- ISO/IEC 42006: requirements for bodies that audit and certify AI management systems
The EU AI Act timeline
The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages. The Digital Omnibus on AI, in force since July 2026, postponed the high-risk deadlines but left the earlier obligations untouched.
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited AI practices; AI literacy (Article 4) |
| 2 August 2025 | Obligations for general-purpose AI models; governance and penalties framework |
| 2 August 2026 | Transparency obligations (Article 50) and most remaining provisions; national supervision starts |
| 2 December 2027 | High-risk AI systems listed in Annex III (as rescheduled by the Digital Omnibus) |
| 2 August 2028 | High-risk AI systems that are safety components of products under Annex I |
Fines reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for most other infringements.
How ISO/IEC 42001 helps with the AI Act
ISO/IEC 42001 is not a harmonised standard under the AI Act, so certification does not by itself create a presumption of conformity. It is, however, the most practical way to build what the Act expects in day-to-day operations: an AI inventory, risk and impact assessments, documented roles, human oversight, supplier controls, logging and monitoring, and continual improvement. When harmonised standards are published, an organisation that already runs an AIMS adapts existing processes instead of starting again.
ISO/IEC 42001 or ITIL AI Governance?
They answer different questions and work well together. ISO/IEC 42001 defines what a certifiable management system must contain. ITIL® AI Governance (Version 5) is about how AI is governed inside digital products and services: decision rights, the ITIL AI Capability Model, the AI Governance Improvement Model, shadow AI and human oversight. Service and product teams usually start with ITIL AI Governance; compliance, risk and audit teams with ISO/IEC 42001.
A six-step roadmap
- Map your AI. Build an inventory of AI systems in use or development, including those embedded in purchased software.
- Classify the obligations. For each system, identify your AI Act role (provider, deployer, importer, distributor) and risk category.
- Set the governance. Approve an AI policy, assign accountabilities and define how new use cases are approved.
- Assess risks and impacts. Run AI risk assessments and AI system impact assessments; choose the Annex A controls and write the Statement of Applicability.
- Build competence. AI literacy is an obligation under Article 4; implementers and auditors need deeper, certified skills.
- Monitor and improve. Set metrics, run internal audits and management reviews, and prepare for certification if it is a goal.
Measure your starting point for free
Two free self-assessments by GoToCertify run in your browser, with no account and nothing stored on a server: the EU AI Act self-assessment (58 requirements mapped to ISO/IEC 42001) and the ISO/IEC 42001 readiness assessment (65 requirements, clauses 4-10 and the 38 Annex A controls). Read more in our news on the EU AI Act self-assessment.
Training and certification paths
| Course | For whom | Duration | Exam |
|---|---|---|---|
| ISO/IEC 42001 Foundation | Anyone who needs to understand the standard | 2 days | GTC, 40 questions, 60 minutes |
| ISO/IEC 42001 Lead Implementer | Those who build and run the AIMS | 4 days | GTC, 80 questions, 180 minutes |
| ISO/IEC 42001 Lead Auditor | Internal and external auditors | 5 days | GTC, 80 questions, 180 minutes |
| ITIL® AI Governance (Version 5) | Product, service, DevOps and risk managers | 2 days | Official ITIL exam, 90 minutes |
All courses are available online, in-house and blended, in English or Italian. See the AI Governance courses or contact us for a dedicated edition.
This guide is for information only and is not legal advice. Check dates and obligations against the official texts on EUR-Lex.
ITIL® is a registered trademark of PeopleCert group. ISO/IEC 42001 is published by ISO and IEC.
