By 2026, AI is used across everyday software delivery, from requirements and code generation to testing, documentation, analytics, and production workflows. For buyers, widespread AI use makes it harder to verify how a vendor governs AI. A demo or security questionnaire can show what a solution does, but it reveals much less about how AI is governed across teams, tools, projects, and production environments.
ISO/IEC 42001, published in December 2023 as the first international standard for artificial intelligence management systems, specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System, or AIMS.
For a certified organization, the AIMS has been assessed against defined requirements for governing AI-related risks, responsibilities, operations, monitoring, and continual improvement.
How AI Governance Works in Production
AI introduces additional variables into software delivery.
Hosted models and third-party AI services can change outside the application team’s normal release cycle. Outputs can vary across similar inputs. Changes in prompts, data, retrieval sources, configurations, or external services can affect system behavior even when the surrounding application code remains unchanged.
These characteristics increase the importance of traceability, responsibility, monitoring, change control, and risk assessment throughout the lifecycle.
Greater AI autonomy makes governance more demanding. Gartner predicts that more than 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value, and inadequate risk controls. ISO/IEC 42001 provides a structured framework for managing the risk-control part of that challenge.
The principle extends beyond agentic AI. Enterprise AI can involve client data, vendor-developed software, cloud infrastructure, external models, APIs, internal business systems, and multiple technical teams. Governance has to remain connected to that environment as the technology and its use change.
ISO’s guidance on ISO/IEC 42001 identifies leadership, AI policies and objectives, risk management, data governance, lifecycle controls, transparency, performance evaluation, monitoring, and continual improvement among the core elements of an AIMS.
For vendor evaluation, those requirements are most useful when they can be traced to evidence in the operating environment.
What a Buyer Should Expect Behind the Certificate
ISO/IEC 42001 covers a broader management system than any short checklist can represent. Several areas are particularly useful when evaluating how AI governance reaches software delivery.
| Management Area | What It Means in Practice | Evidence a buyer can examine |
| Governance and accountability | Responsibilities, decision authority, objectives, and escalation paths are defined. | AI policies, responsibility model, approval, and escalation structure. |
| Risk and impact management | AI-related risks are identified, assessed, treated, and revisited as conditions change. | Risk criteria, assessments, treatment decisions, and impact-assessment records. |
| Data and lifecycle management | AI systems are governed throughout development, deployment, operation, modification, and end-of-use. | AI inventory, data controls, lifecycle records, and change procedures. |
| Monitoring and evaluation | The organization evaluates whether AI systems and governance controls continue to operate as intended. | Monitoring criteria, review records, performance evidence, and internal audit findings. |
| Continual improvement | Findings, incidents, monitoring results, and changes lead to corrective action. | Corrective action records, management reviews, and updated controls. |
These management areas can take different forms in practice. ISO/IEC 42001 gives organizations flexibility in how they implement its requirements.
One company may use a centralized AI inventory. Another may maintain connected systems covering models, data, risks, approvals, and lifecycle records. Stronger evidence comes from the ability to trace governance decisions through operating records and show how established processes are applied in practice.
The relevance of that evidence also depends on the boundaries of the certified management system.
Understanding Certification Scope
The certification scope defines the organizational and operational boundaries of the AIMS assessed. ISO/IEC 42001 requires an organization to determine those boundaries, while the certification documentation states the scope covered by the certification.
A certificate, therefore, does not automatically mean that every AI product, business unit, delivery activity, or client project associated with the organization falls within the same certified scope.
Major technology companies illustrate how this works. AWS states that its ISO/IEC 42001 certification covers specified AI services, including Amazon Bedrock, Amazon Q Business, Amazon Textract, and Amazon Transcribe. IBM describes its certification as applying to the AIMS supporting its Granite language models.
Once the scope is clear, the practical question is how governance extends across the proposed work, including its models, data, integrations, and delivery responsibilities. This provides a more consistent basis for comparing how different vendors apply formal AI governance to client delivery.
How ISO/IEC 42001 Can Differentiate Vendors
Asking for ISO/IEC 42001 certification can help distinguish vendors that have subjected their AI management systems to third-party assessment.
BCG announced in January 2026 that it was among the first 100 organizations worldwide to achieve ISO/IEC 42001 certification. Early adopters also included major technology organizations. AWS described itself as the first major cloud service provider to announce accreditation to ISO/IEC 42001 for AI services. Anthropic is positioned itself as one of the first frontier AI labs to achieve the certification. IBM later announced certification for the AIMS supporting its Granite models.
Certification adds third-party assessment to vendor policies, governance statements, and questionnaire responses by providing external evidence that the AIMS has been assessed against ISO/IEC 42001 within its certified scope.
Certification remains one part of vendor evaluation. Scope, project fit, technical capability, security, architecture, and regulatory requirements need to be assessed alongside it.
Intetics’ certification process offers a practical example of what that formalization involves inside a software engineering organization.
What Certification Changed at Intetics
Intetics achieved ISO/IEC 42001 certification in March 2026. It complements the company’s existing ISO 9001 certification for quality management and ISO/IEC 27001 certification for information security management.
Preparation took approximately four months and produced 29 new policies and procedures and 10 dedicated AI-governance registers.
One practical finding was the need for a consolidated view of AI tools and infrastructure. Information about resources used in AI development already existed across different parts of the Intetics knowledge-management environment. The certification process brought that information together into a common register for stronger visibility, governance, and control.
The audit also included a detailed technical examination of a real client solution. Intetics engineers walked the auditor through the full design of a computer-vision system and explained how each component worked in practice.
This example reflects the Intetics certification experience and should not be treated as a universal audit procedure for every organization seeking ISO/IEC 42001 certification.
The AIMS establishes the management framework. Delivery practices show how that framework reaches day-to-day engineering decisions.
How Intetics Applies Governance in Delivery
Within the flexibility allowed by the standard, Intetics uses its own control model for AI-assisted development.
The workflow separates Navigator, Driver, and Reviewer roles, followed by Human Approval.
The Navigator defines scope, architecture, risks, constraints, and completion criteria. The Driver implements the change and produces supporting evidence. The Reviewer independently checks the work, including edge cases, security assumptions, rollback readiness, and alignment with the specification. Human Approval remains the final gate for merging, revising, or rejecting the change.
Explicit handover artifacts make the work easier to inspect, reproduce, and approve. The full model is described in Intetics’ Engineering Maturity for AI-Native Software Delivery.
For Intetics clients, this creates a defined path from scope and implementation through independent review and final approval, with supporting evidence retained at each stage.
Operational controls are one layer of assurance. The certification also needs to be understood within the boundaries of what ISO/IEC 42001 establishes.
What the Certificate Covers
ISO/IEC 42001 establishes an organizational management framework for AI. Three boundaries are important when interpreting what the certification shows.
Regulatory compliance. ISO/IEC 42001 can support compliance through governance, risk management, documentation, monitoring, and continual improvement. Legal obligations depend on the applicable regulation, the AI system, its intended use, and each organization’s role.
Under the EU AI Act, as amended by Regulation (EU) 2026/1744, relevant Chapter III requirements for high-risk AI systems classified under Article 6(2) and Annex III apply from 2 December 2027, while those for systems classified under Article 6(1) and Annex I apply from 2 August 2028. The applicable provisions are available in the EU legislation published through EUR-Lex.
Individual system performance. Certification does not establish that a particular model is sufficiently accurate, fair, robust, or suitable for a specific business use. Those characteristics still require evaluation against the intended use, relevant data, acceptable error levels, affected users, and foreseeable failure conditions.
Ongoing certification status. Management system certification includes ongoing surveillance and recertification. Current certification provides evidence that the AIMS remains subject to external certification oversight.
Together, these boundaries define the assurance certification that can be provided and the areas that require additional due diligence.
Using ISO/IEC 42001 in Vendor Evaluation
ISO/IEC 42001 gives procurement, technology, security, and risk teams a structured input into AI vendor evaluation.
Used alongside technical due diligence, security review, architecture assessment, model evaluation, contractual controls, and regulatory analysis, it helps show how AI governance is formalized at the organizational level and applied to the proposed delivery environment.
FAQ
It shows that the vendor operates an Artificial Intelligence Management System that has been assessed against the requirements of ISO/IEC 42001 within its certified scope. For clients, this provides a clearer framework for understanding how governance, responsibilities, risk management, monitoring, and continual improvement are handled across AI-enabled delivery.
Certification provides evidence that the vendor has established processes for identifying AI-related risks, assigning responsibilities, monitoring AI systems, managing changes, and taking corrective action. This gives client teams a more structured basis for assessing how AI governance will operate across the project.
Coverage depends on the defined scope of the vendor’s certified AIMS. Companies should establish how the proposed work is governed within that management system and which processes and controls will apply to the engagement.
ISO/IEC 42001 gives procurement, technology, security, and risk teams a common framework for examining AI governance. It can support evaluation of certification scope, responsibilities, risk management, monitoring, corrective action, and the division of responsibilities across the client, software vendor, cloud provider, and model provider. Technical, security, contractual, and regulatory due diligence remain important alongside certification.
Certification can support compliance work through structured governance, risk management, documentation, and monitoring. Legal obligations depend on the AI system, its classification, intended use, and each organization’s role under the regulation. ISO/IEC 42001 provides governance infrastructure that can support compliance without establishing legal compliance by itself.
ISO/IEC 42001 does not prescribe one universal review workflow for every AI system. Oversight and controls should reflect the organization’s context, AI use, and associated risks. Intetics uses a Navigator, Driver, Reviewer, and Human Approval model as one implementation approach for AI-assisted software development.
Yes. Intetics announced its ISO/IEC 42001:2023 certification in March 2026, alongside its ISO 9001 and ISO/IEC 27001 certifications. For clients, the certification provides evidence that Intetics operates an independently assessed AI management system covering governance, risk management, monitoring, and continual improvement.
