AI ISO standards: 42001, 23894, 22989 and 27001 explained
A practical scope map for AI management, risk guidance, terminology and information security.
Prepared on 20 Oct 2026 for editorial review. Product specifications and company research results are not asserted unless verified.
ISO/IEC 42001: AI management systems
ISO/IEC 42001:2023 specifies requirements for an organisational AI management system. Start by defining which teams, services and AI activities are within scope, with leadership responsibilities and documented objectives.
Prepare an AI inventory, risk and impact assessments, relevant controls, review evidence and corrective actions. Management-system conformity does not establish the accuracy or safety of every individual AI output.
ISO/IEC 23894: AI risk management guidance
ISO/IEC 23894:2023 provides guidance for managing AI-related risks. Identify stakeholders, intended use, foreseeable harms and sources of uncertainty, then record analysis, treatments and monitoring responsibilities.
It is guidance, not the same requirements standard as 42001. Use it to structure risk work; do not describe it as a stand-alone AI product certification.
ISO/IEC 22989: concepts and terminology
ISO/IEC 22989:2022 establishes AI concepts and terminology. Align definitions across procurement, engineering and governance documents so teams distinguish models, systems, data and lifecycle responsibilities consistently.
ISO/IEC 27001: information security management
ISO/IEC 27001:2022 specifies information security management system requirements. Coordinate AI access controls, supplier review, information handling and incident procedures with the organisation’s security programme while keeping each management-system scope clear.
Create a scoped evidence register
For each relevant requirement or control, record an owner, evidence location, review date and unresolved action. Obtain the licensed standards and qualified advice for formal implementation or assessment.
These summaries are educational drafts, not the full standards text, legal advice or evidence that KaribuTech or BluFountain is ISO certified. Any certification statement would need an independently verifiable certificate and scope.