26 Oct 2026 ISO 42001: what test evidence your AI management system needs

In short: ISO 42001 is the international standard for managing AI responsibly in your organisation. It asks you to know the risks of your AI systems, control them and check that the controls work. That last part needs evidence about how the AI actually behaves: test results, monitoring results and what you did about failures. Testing produces most of that evidence.

Search for ISO 42001 and you mostly find certification bodies and training courses. They explain the standard well and tell you how to get certified. What they rarely explain is the part that worries teams most once the audit gets close. The auditor doesn’t only want to see policies. They want proof that your AI system does what you say it does, and keeps doing it. That proof doesn’t come from a policy document. It comes from testing.

What is ISO 42001?

ISO 42001, officially ISO/IEC 42001:2023, is the first international standard for an AI management system. It was published in December 2023. It sets requirements for how an organisation sets up, runs and keeps improving the way it manages AI. It applies to companies that build AI systems and to companies that use them. If you know ISO 27001 for information security, the structure will feel familiar. You set policies and goals, assess risks, put controls in place, check whether they work and improve. That cycle is often called Plan, Do, Check, Act. What is new is the focus. ISO 42001 deals with risks that are specific to AI, such as unfair outcomes, lack of transparency and systems that change their behaviour over time. It also asks you to assess the impact your AI systems can have on people and society.

How does ISO 42001 relate to the EU AI Act?

ISO 42001 is a voluntary standard, and the EU AI Act is a law. They point in the same direction, but they are not the same thing. The AI Act sets legal duties, mainly for high-risk AI systems, such as risk management, data checks, documentation, accuracy testing and monitoring after go-live. ISO 42001 gives you a way to organise that kind of work across all your AI systems, high-risk or not. A well-run management system makes it much easier to show that you meet the AI Act. But a certificate does not make you compliant with the law by itself. For the legal side, see what the EU AI Act asks of software teams. Many organisations use both together: the law tells them what must be true, the standard helps them prove it in a structured way.

What evidence does an auditor want to see about your AI system?

An auditor wants evidence that your AI risks are known, controlled and checked, and that you act when something goes wrong. Policies and process descriptions are part of it. But for the AI system itself, four kinds of evidence carry the most weight:

• An impact and risk assessment. Which risks did you find for this AI system, and for whom?
• Proof that the system was checked before use. Which tests did you run against those risks, and what were the results?
• Monitoring results after go-live. Does the system still behave as intended, now that the model, the data and the users have changed?
• Follow-up on failures. What went wrong, how serious was it, what did you change, and did the fix work?

The first is a document. The other three are test results over time. That is where many teams discover a gap. They tested once before go-live, kept the results in a spreadsheet and never ran the tests again.

How does testing produce that evidence?

Testing produces the evidence when every test can be traced back to a risk, and every result is kept over time. Start from the risk assessment. Turn each risk into test questions with clear criteria for a good answer. Run them before go-live and then on a schedule. Record what failed, link each failure to the risk or control it touches, and give it a priority. Fix it and check in the next run that the fix holds. That chain of risk, test, result, action and recheck is exactly what an auditor follows. It is also the loop in our five-step model for testing AI after go-live. Because AI doesn’t always give the same answer twice, you score the answers against criteria instead of one fixed result. That makes the evidence stronger, not weaker, because it shows how stable the system really is.

Do you need ISO 42001 certification?

You don’t need ISO 42001 certification by law, but it can be worth it. Certification makes sense when customers or partners ask for it, or when you sell AI to large or regulated organisations. It also helps when you want one clear structure for many AI systems. It costs time: a management system has to run for a while before an audit makes sense. If none of those reasons apply yet, you can still use the standard as a guide without getting certified. Either way, the evidence about your AI’s behaviour is the part you can’t fake and can’t make in a hurry. Start building it now.

That is why we built VeritasAI, our in-house tool for testing AI applications. We use it to test your AI application as a service. It runs your test questions continuously. It links every failed answer to the law, standard or framework it relates to, including ISO/IEC 42001, with a priority score. The management dashboard gives you the overview for a management review or an audit. The operational dashboard shows your team which questions fail, with the prompt and the answer. Read more on our AI Compliance Testing page.

Frequently asked questions

What is ISO 42001?

ISO/IEC 42001:2023 is the international standard for an AI management system. It sets requirements for managing the risks and opportunities of AI in an organisation, for companies that build AI and for companies that use it.

Is ISO 42001 mandatory?

No. ISO 42001 is voluntary. Customers can ask for it in contracts, and it helps you organise the work that laws such as the EU AI Act require.

What is the difference between ISO 42001 and ISO 27001?

ISO 27001 is about information security. ISO 42001 is about managing AI: risks such as unfair outcomes, lack of transparency and changing behaviour. The structure is similar, so organisations with ISO 27001 often combine the two.

Does ISO 42001 make you compliant with the EU AI Act?

Not by itself. It helps you show that your AI is managed well, which supports AI Act compliance. The legal duties, especially for high-risk systems, still need to be met and shown one by one.