FerentinFerentin
Home/Glossary/ISO/IEC 42001

Glossary

What is ISO/IEC 42001?

The international standard, published by ISO and IEC in December 2023, that specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. It is the first certifiable management-system standard for AI and applies to any organization that develops, provides or uses AI systems.

In depth

ISO/IEC 42001 follows the same harmonized structure as ISO/IEC 27001, so the two can run as one management system. Its clauses 4 to 10 cover context and scope, leadership and AI policy, planning (including AI risk assessment and AI system impact assessment), support, operation, performance evaluation (including internal audit and management review) and improvement. Annex A lists 38 controls in nine areas: AI policies, internal organization, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems, and third-party and customer relationships. An organization records which controls apply, and why, in a Statement of Applicability. Certification is awarded by an accredited certification body after a two-stage audit, first of the documentation and then of the system in operation, and runs on a three-year cycle with annual surveillance audits.

Why it matters

Customers, regulators and procurement teams increasingly ask organizations to show how they govern AI, not just to state it. ISO/IEC 42001 gives a recognized, auditable answer and a structure that can be run alongside an existing security management system. Like any management system, it is certified on evidence of operation: an inventory of AI systems, records of what they did, proof that intended-use boundaries were enforced, and controls on AI suppliers. Ferentin publishes a control-by-control mapping of how its platform supports an ISO/IEC 42001 AI management system.

Common use cases

  • Preparing for ISO/IEC 42001 certification
  • Extending an ISO/IEC 27001 security management system to cover AI
  • Structuring AI risk and AI system impact assessments
  • Answering AI governance questions in customer and vendor assessments
  • Producing operating evidence for Annex A controls such as event logging and intended use

How Ferentin handles it

Ferentin is the trust layer for AI agents. The platform centralizes identity, policy enforcement and audit across LLMs, MCP servers and AI tools. ISO/IEC 42001 is one of the primitives this trust layer is designed around. See the platform overview for how it fits into the service edge, control plane and observability plane.

Related terms

AI Management System (AIMS)

The policies, roles, processes and records an organization uses to govern the AI systems it develops, provides or uses: setting AI objectives, assessing AI risks and impacts, controlling how AI is deployed and used, monitoring it in operation and improving over time. The term comes from ISO/IEC 42001, which specifies the requirements for one. Like an information security management system, an AIMS is judged on whether it actually operates, so it depends on evidence: an inventory of AI systems, records of what they did and proof that policies were enforced.

AI Agent Governance

The set of policies, controls and monitoring practices that determine what AI agents are allowed to do within an organization. Governance includes defining which tools agents can access, what actions they can take, setting approval workflows and maintaining audit trails of all agent decisions.

Shadow AI

AI applications, agents, models, MCP servers and browser or editor extensions that people in an organization use without the security team’s knowledge or approval. Shadow AI is the AI-era successor to shadow IT, with higher stakes: these tools read source code, documents and customer data, and increasingly act on the user’s behalf.

AI Observability

The ability to monitor, trace and understand the behavior of AI systems in production. AI observability includes logging inference requests, tracking token usage, monitoring latency, auditing policy decisions and providing dashboards for real-time visibility into AI usage across an organization.

Policy Enforcement

The runtime evaluation and application of security rules to AI requests. Policy enforcement can include checking user identity, validating permissions, applying token or rate limits, filtering content and blocking unauthorized actions, all before a request reaches the AI service.

Add the trust layer to your AI stack

Zero trust policy enforcement from prompt to tool call. Get started in minutes.

Get Started FreeBook a Demo