ISO/IEC 42001:2023 is a paid international standard, so there is no free official PDF and we do not host or copy it. It sets requirements for an AI management system: the policies, roles and routines an organisation keeps running to use AI responsibly. You can buy it from ISO or the IEC store. This page explains what it covers, based on public pages.
01Is there a free ISO 42001 PDF?
Not an official one. ISO/IEC 42001 is sold by ISO and by the IEC, and the IEC store listed it as a paid publication when we read it on 24 October 2026, at CHF 225 in English or French. Prices and editions change, so check the store page. ISO's own page is here: ISO/IEC 42001:2023 on iso.org. Our tools could not open that page directly, so we checked the IEC listing instead.
We do not host the standard, quote it at length or share a copy, and this page is not a substitute for it. Be careful with sites that offer a free PDF of a paid standard. We cannot vouch for any such copy, and a file you did not get from the publisher may be incomplete, out of date or altered.
02What is ISO/IEC 42001?
It is Edition 1.0, published on 18 December 2023, and runs to 51 pages. It sets requirements and gives guidance for building, running, maintaining and steadily improving an AI management system. It is meant for any organisation, of any size or type, that provides or uses products or services that include AI. The stated aim is to help organisations develop, deliver or use AI responsibly while meeting their goals and stakeholder expectations (IEC listing).
A management system is not software. It is the set of written policies, assigned roles, planning, checks and reviews that an organisation repeats over time. The word 'system' means the routine, not a tool you install. Two organisations with the same AI product could run very different management systems, because the standard asks about how the organisation behaves, not about which model it picked.
03What does it ask an organisation to do?
A published commentary from the consultancy Advisera lists the main clauses of the standard (Advisera). We have not seen the full text, so treat this as a summary of a secondary source.
- Context (clause 4): understand the organisation and who is affected by its AI.
- Leadership (clause 5): top management owns an AI policy.
- Planning (clause 6): assess and treat AI risks, and assess the effect of AI systems on people and society.
- Support and operation (clauses 7 and 8): resources, skills, documented information, and and running the controls.
- Evaluation and improvement (clauses 9 and 10): monitor, audit, review and fix.
- Annex A: a reference list of 38 controls in nine groups that an organisation can choose from.
The impact assessment is the part most different from older management standards. Advisera reads clause 6.1.4 as asking you to assess and write down how an AI system could affect people and society, including through misuse, and clause 8.4 as asking for repeat assessments after major changes, with records kept.
04How is it different from the NIST framework?
Both are voluntary and neither is law. The NIST AI Risk Management Framework is free, and organises AI risk work into Govern, Map, Measure and Manage. ISO/IEC 42001 is paid, and is written as a standard with requirements for a management system. Many organisations read about both. Stanford's 2026 AI Index reports ISO/IEC 42001 cited by 36% of surveyed organisations as an influence on their responsible AI practice, and the NIST framework by 33% (Stanford HAI).
05What does the standard not do?
It is not a law, and the IEC listing does not say that following it satisfies any particular law. Whether it helps with a rule such as the EU AI Act is a question for a lawyer or the regulator, and this page is general information, not legal advice.
We are not a standards body, auditor or certifier, and we are not affiliated with ISO, the IEC or any certification body. We issue no certificates and make no claim that anyone meets this standard. Anyone who wants a formal certificate should ask the publisher or a certification body about the process.
?What is not known
- We could not open ISO's own page with our tools, so the price, preview options and edition on iso.org may differ from the IEC listing we read.
- We describe the clause structure from a consultancy's commentary, not the full text, and commentators differ on details such as how Annex A is classed.
- Whether following the standard helps with specific laws is not settled by the listing we read; regulators may say more.
QQuestions people ask
Can I read ISO 42001 online without paying?
ISO and the IEC decide what previews they offer, and these can change. Check the publisher's page. We do not post any part of the text.
Does reading this page make my organisation compliant?
No. This page explains the standard in outline and is not a compliance guide. Meeting a standard means doing what it requires, and any certificate comes from a body that audits you.
Is ISO 42001 required by the EU AI Act?
The IEC listing we read does not say so. The AI Act has its own text and its own timeline, and a lawyer can say how a standard relates to it.
Last checked October 24, 2026. Rules and settings change, so open the source to see the current version.
- ISO/IEC 42001:2023, AI management systems ISO The official ISO store page, which we link for readers to buy the standard; our tools could not open it.
- ISO/IEC 42001:2023 listing IEC Webstore Store listing used for the publication date, edition, page count, scope and the fact that it is sold.
- ISO 42001 requirements: clauses and structure Advisera Consultancy commentary used for the clause outline, the Annex A count and the impact assessment clauses.
- NIST AI Risk Management Framework NIST Official page for the free, voluntary NIST framework we compare with.
- The 2026 AI Index Report, Responsible AI chapter Stanford HAI Source of the survey shares citing ISO/IEC 42001 and the NIST framework.
General information, not legal, medical, financial or investment advice. We are not affiliated with any company, agency or standards body named here. See our editorial policy and corrections, or tell us about a mistake at [email protected].