ISO 42001: What an Audit Actually Asks You to Evidence

01 What the certificate actually says

The UK government has said the same thing about its own tool built on the standard. DSIT's AI Management Essentials self-assessment draws on ISO/IEC 42001, the NIST AI Risk Management Framework and the EU AI Act, and it opens by declaring what it will not do. The tool "is not designed to evaluate AI products or services themselves" [ DSIT AIME 2024 ] . It evaluates the organisational processes behind those products. The department that wrote the UK's AI security policy drew the governance boundary itself.

So why bother? Because the certificate answers a real question. Procurement teams, insurers and regulators want to know whether AI decisions inside your organisation are owned by named people, assessed against a defined process, and reviewed on a cycle. Before ISO 42001 there was no common way to prove that. Now there is. Just know which question you have answered.

02 Clause by clause: the evidence pack

ISO 42001 follows the harmonised management-system structure, clauses 4 to 10. If you have been through ISO 27001 the shape will be familiar. Here is what each clause puts on the auditor's sampling list.

One caveat on sourcing. ISO sells the full standard, so the free official preview stops after clause 4 [ ISO/IEC 42001:2023 ] . We summarise the clause 5 to 10 requirements below from the purchased standard. Check them against your own copy before you build the evidence pack.

Annex A sits alongside as "Reference control objectives and controls", and it is normative. Annex B gives implementation guidance for those controls [ ISO/IEC 42001:2023 ] . Your Statement of Applicability is where you say which Annex A controls apply, which do not, and why. It is the single document an auditor will spend the most time on, because it is where an organisation's honesty about its own AI risk becomes visible.

Look down that column of evidence and count the test results. There are none. Every item is a record that a process ran.

03 Where the clauses touch testing

Four clauses come closest to security testing, and each stops in the same place. Clause 6.1.2 asks you to assess AI risk. Clause 6.1.3 asks you to treat it. Clause 6.1.4 asks you to assess the impact of your AI system on individuals and society. Clause 9.1 asks you to monitor and measure. In operation, clauses 8.2 to 8.4 repeat the first three against the live system.

Now walk one risk through it. You record prompt injection as a risk in 6.1.2. You treat it in 6.1.3 with an input filter and a system-prompt instruction. You write it into the Statement of Applicability. You review it at management review. The audit passes. At no point did anyone send a payload. Your evidence proves you thought about prompt injection. It says nothing about whether your filter stops it.

That gap is not theoretical for UK firms. The Bank of England and FCA survey of AI in UK financial services found 75% of firms already using AI, and 46% of respondent firms reporting only partial understanding of the AI technologies they use, against 34% claiming complete understanding [ Bank of England and FCA 2024 ] . A third of all AI use cases were third-party implementations. 55% carried some degree of automated decision-making. A management system documents risks that nearly half of surveyed financial firms admit they do not fully understand.

04 What a red team proves instead

The UK government runs its own AI red team, and its results explain why the paperwork cannot stand alone. The AI Security Institute has evaluated more than 30 state-of-the-art models since November 2023. Its finding is blunt: "Our team has found universal jailbreaks, techniques that override safeguards across a range of harmful request categories, in every system we tested" [ AISI Frontier AI Trends Report 2025 ] . Every system. A national institute tested frontier models there, well upstream of your enterprise deployment. The lesson still travels.

Testers can also measure improvement in a way no document can. AISI recorded a 40x increase in the expert time needed to find biological-misuse jailbreaks between two leading systems released six months apart. Universal attacks eventually succeeded against both. That number is the shape of real AI security evidence: a bound, measured by attack, that moved. Meanwhile model completion rates on apprentice-level cyber tasks rose from 9% in late 2023 to 50% by 2025, and the first model to complete expert-level cyber tasks was tested in 2025. The attacker side of the equation is getting cheaper every quarter.

The NCSC has said the quiet part about the headline AI risk. Prompt injection attacks against generative AI applications "may never be totally mitigated in the way SQL injection attacks can be", and effort should turn to "reducing the risk and impact of prompt injection and driving up resilience across AI supply chains", favouring secure design over silver-bullet solutions [ NCSC 2025 ] . Read that against clause 6.1.3. If a class of risk cannot be eliminated, only bounded, then a treatment plan is a claim about where the bound sits. The only way to know the bound holds is to attack the system and find out.

Run all three and the artefacts stop competing. The certificate carries the governance. The pen test carries the infrastructure. The AI security engagement carries the model and the agents that act on its output. Each one covers what the others structurally cannot see.

05 The UK stack around the standard

UK accreditation for this standard is now live. UKAS announced on 15 January 2026 that it had granted BSI the first accreditation for certification of AI management systems to ISO/IEC 42001:2023, against ISO/IEC 17021-1, confirming that the certification body "has the competence, impartiality and consistent approach needed to certify organisations against this new standard" [ UKAS 2026 ] . BSI dated its own announcement of accreditation from UKAS and the Dutch body RvA 17 November 2025 [ BSI 2025 ] . UKAS had already reported, on 5 September 2025, that a first tranche of seven certification bodies was nearing completion, with 12 more organisations progressing applications [ UKAS 2025 ] . Note what accreditation covers. It covers the auditor. Your AI stays out of scope.

DSIT's assurance roadmap puts the market around this in numbers. Over 524 companies operate in the UK AI assurance market, worth roughly £1.01 billion GVA in 2024 and employing an estimated 12,500 people. DSIT projects £18.8 billion GVA by 2035 if barriers to AI adoption are addressed [ DSIT assurance roadmap 2025 ] . The roadmap lists technical auditing, bias auditing, risk assessment, management systems certification and governance auditing as separate services. It also weighs how to build trust in the assurance firms themselves, and warns that certifying their processes "can be lengthy and costly" and "may risk inferring consensus where it does not exist". The government applies that caution to the assurance market it is growing. Apply the same caution to your own certificate.

For the technical half, the UK already has its own instrument. The DSIT Code of Practice for the Cyber Security of AI, published 31 January 2025, sets 13 principles. Principle 3 asks you to evaluate the threats to your AI system and names data poisoning, model inversion and membership inference. Principle 9 asks you to conduct appropriate testing and evaluation [ DSIT Code of Practice 2025 ] . ETSI TS 104 223 turns those principles into provisions you can hold someone to. Provision 5.2.5-1: developers "shall ensure that all models, applications and systems that are released to System Operators and/or End-users have been tested as part of a security assessment process". Provision 5.2.5-2.1: operators and developers "should use independent security testers with technical skills relevant to their AI systems" [ ETSI TS 104 223 ] . We walk through that expectation in detail in what Principle 9 now expects you to test.

06 What to do this quarter

You will spend months getting certified. You can find out in weeks whether your AI holds. Do the second one first, because its output feeds the first. A real finding sharpens a risk assessment far faster than a workshop does.

Here is the outcome we hand you. We attack your deployed AI the way an attacker will, then give you the proven exploit paths, the guardrails that close them, and a retest that confirms the fix held. That report does two jobs at once. Your auditor gets clause 9.1 monitoring evidence with a result in it. Your board gets an answer to the only question that matters after the certificate is framed: does it hold? Book a free audit and we will show you what your AI exposes before someone else does.