Enabling AI adoption with ISO 42001 has been saved
Perspectives
Enabling AI adoption with ISO 42001
A standard for AI governance and risk management
The rapid evolution of artificial intelligence (AI) technologies necessitates a structured approach to risk management. ISO 42001 provides guidelines for organizations to manage AI-related risks effectively. Discover how aligning with the ISO 42001 standard can help your organization navigate the complexities of AI governance and compliance.
As AI becomes integrated into more customer-facing technologies, organizations are recognizing that these tools can introduce risks like inaccuracy and bias, concerns around data privacy and cybersecurity, and challenges with responding to a fragmented US and global regulatory regime.
In Deloitte’s State of Generative AI in the Enterprise survey, respondents indicated that the top two barriers to developing and deploying Generative AI (GenAI) were worries about complying with regulations (38% of respondents, up 10% from one year prior) and difficulty managing risks (32% of respondents, up 6% from one year prior)1. These concerns will likely be amplified by the advancements of GenAI and agentic AI use cases expected over the next few years.
In response to the need for guidance and leading practices around AI risk management, the International Organization for Standardization (ISO) Council published its ISO/IEC 42001:2023(E) Information technology — Artificial intelligence — Management system standard (“ISO 42001”)2 in December 2023. ISO 42001 provides a framework for AI governance and risk management across the AI development life cycle, including the following areas:
- Governance structures to establish oversight and accountability
- Risk management protocols to identify, assess, and mitigate potential risks and impacts
- Guidelines to design AI systems that are transparent, fair, and unbiased
- Compliance mechanisms to maintain adherence to evolving legal and regulatory standards
Organizations that achieve certification demonstrate how their AI management systems have a way to not only identify and mitigate risks, but also show how they were built with resilience, scalability, and ongoing oversight, which can lead to better outcomes and transparency for their customers.
Demonstrate market readiness of your AI systems with ISO 42001
Certification to build customer trust
AI can be transformative for organizations, but it does not come without risk. Aligning to a standard demonstrates not only strong risk management but also the maturity of an organization’s AI program.
In Deloitte’s State of Generative AI in the Enterprise survey, 35% of respondents indicated that the biggest obstacle to GenAI’s potential marketplace adoption is mistakes or errors with real-world consequences, followed by bias and hallucinations.3 According to another study, while 87% of executives claim to have AI governance frameworks within their organizations, fewer than 25% have fully operationalized their enterprise governance.4 In such cases, certification becomes an indicator that these programs have been implemented and are operating effectively. Pursuing an ISO 42001 certification can provide differentiation in the near term and may become a common benchmark in the future.
Kick-start your ISO 42001 journey
An ISO 42001 certification affords organizations the ability to stay ahead of costly risks, build customer trust, and make strides toward compliance with other AI frameworks. However, understanding and implementing the standard requires an investment of time and effort across the enterprise. The following list provides three areas for organizations exploring where to start their ISO 42001 compliance journeys.
Many organizations already have a head start toward ISO 42001 compliance. The standard’s approach to AI management builds upon control frameworks that many organizations already have in place, including data governance, IT, security, privacy, enterprise risk management, and internal audit. An initial assessment can help organizations to understand where they can expand existing capabilities to meet ISO 42001 requirements and minimize the introduction of new processes.
The complexity of AI risk management typically involves a variety of teams across an organization, including product management, data and model engineering, infrastructure, legal and compliance, trust and safety, and training teams. Given the number of stakeholders, this may lead to fragmented ownership and unclear responsibilities. Organizations obtaining their certification should identify leadership that can champion, resource, coordinate, and drive compliance and risk management efforts, and determine an operating model to coordinate among the teams involved.
To obtain an ISO 42001 certification, organizations need to demonstrate that their AI management system operates effectively and sustainably. Organizations should retain evidence—such as AI model design requirements, accuracy and performance monitoring logs, data audit trails, and product launch approvals—to demonstrate sustained compliance. Tools like governance, risk, and compliance platforms built explicitly for AI risk management needs can support these processes.
How Deloitte can help
Leading organizations find value in working with Deloitte to recommend sustainable risk and compliance programs and proactively unlock AI’s value. We have assisted organizations as they manage risks related to AI for more than a decade, ranging from early machine learning adoption to—more recently—risks from GenAI and agentic AI technologies. We bring the combination of practical experience with AI development, as well as perspectives in large-scale risk and compliance programs across a variety of industries. Our services include the following:
- Readiness evaluations
- AI model testing
- Governance, risk, and compliance program development
- Tooling
- Talent
- Regulatory compliance
- Security risk
Contacts
Rich Tumber |
|
Alison Hu |
|
1 Jim Rowan et al., State of Generative AI in the Enterprise: Quarter four report, Deloitte, January 2025.
2 International Organization for Standardization (ISO), ISO/IEC 42001 Information technology — Artificial intelligence — Management system (ed. 1), 2023.
3 Rowan et al., State of Generative AI in the Enterprise: Quarter four report.
4 IBM, “IBM study: AI spending expected to surge 52% beyond IT budgets as retail brands embrace enterprise-wide innovation,” press release, January 7, 2025.
Recommendations
Unpacking the EU AI Act: The future of AI governance
Understanding compliance requirements and strategic insights
Internet Regulation Services
Learn how we provide a multidisciplinary team to assist your organization to navigate the internet regulatory landscape.
