AI governance frameworks: Compare
A learning aid, not legal advice.
| Dimension | ISO/IEC 42001:2023 AI management system certifiable standard |
|---|---|
| Nature | Depth 2 of 3. A requirements standard: voluntary to adopt, but an organisation can be certified against it by an independent certification body. ISO/IEC 42001:2023, abstract; ISO AI management systems page |
| Where and to whom it applies | Depth 2 of 3. Any organisation that provides or uses AI, in any country; the organisation sets the boundaries of its own management system. Clause 4.3 (Determining the scope of the AIMS) |
| Roles addressed | Depth 1 of 3. Addresses the organisation as a whole; top management assigns roles, responsibilities and authorities. Clause 5.3 |
| Risk approach | Depth 3 of 3. A defined AI risk assessment and risk treatment process, repeated at planned intervals or when significant changes are proposed. Clauses 6.1.2, 6.1.3, 8.2, 8.3 |
| Inventory and documentation | Depth 2 of 3. Documented information is required throughout, and the scope statement fixes which AI systems the management system covers. Clauses 4.3 and 7.5 |
| Risk or impact assessment | Depth 3 of 3. Requires both AI risk assessment and an AI system impact assessment on individuals, groups and societies. Clauses 6.1.2, 6.1.4, 8.4 |
| Human oversight | Depth 2 of 3. Under review |
| Transparency and notices | Depth 2 of 3. |
| Data governance | Depth 2 of 3. Under review |
| Testing, robustness and security | Depth 2 of 3. Under review |
| Monitoring and incident reporting | Depth 2 of 3. Monitoring, measurement and evaluation, plus nonconformity and corrective action; no duty to report to an outside authority. Clauses 9.1 and 10.2 |
| Assurance and enforcement | Depth 3 of 3. Internal audit and management review, and third-party certification by bodies that meet ISO/IEC 42006:2025. Clauses 9.2 and 9.3; ISO/IEC 42006:2025 |
| Effort to implement | Depth 3 of 3. Heavy: a full management system (policy, objectives, competence, documented processes, internal audit, management review) and, if certified, external audits. Clauses 4 to 10 |
| Key dates | Depth 1 of 3. Published 2023-12 (first edition). An implementation guidance project (ISO/IEC 42003) is at an early stage; no amendment to 42001 was found. ISO/IEC 42001:2023 page; ISO/IEC AWI 42003 page |
A learning aid, not legal advice. Where AI SENTINEL is mentioned, it supports or maps to the dimension; it does not certify anything. Dates are those the official texts state on the date shown.