ISO 42001: From AI experiments to responsible use of AI
Most companies already use AI, but far fewer have decided how to manage it. This article explains what ISO 42001 is, where companies struggle with AI governance, how the standard relates to the EU AI Act, and how to get started.
Most companies have started using AI in one way or another. But far fewer have decided how to manage it. For organisations that are starting out with AI, or want to, ISO 42001 is a very good place to begin. I’m convinced the standard will matter far more than most people expect.
In my work, I see companies moving from experimenting with AI to using it across departments. That is exactly when the question of control comes up. Who is responsible? What are we allowed to do? And do we even know what our employees are using?
In this article, I’ll explain what ISO 42001 is, where companies tend to struggle, how the standard relates to the EU AI Act, and how you can get started.
ISO 42001 explained
So what is ISO 42001, really?
ISO 42001 is an international standard for AI management systems. It was published in December 2023 and is the first of its kind.
ISO stands for International Organization for Standardization, the world’s largest publisher of international standards. (42001 was published together with IEC, which is why its full name is ISO/IEC 42001.) When a new ISO standard appears, it means a group of experts from different countries and industries has agreed on guidelines for an area. In this case:
how an organisation manages its use of AI.
The standard gives you a structured way to work with responsibility, risk, transparency, data quality, and the ethical, legal and social questions that come with AI.
If you know ISO 27001 for information security, you will recognise how it’s built.
ISO 42001 is about the whole organisation, not about one specific model or tool.
Why the timing is right
We live in a world where technology keeps outrunning regulation. AI crunches data, makes recommendations, designs, writes and helps us make decisions. Yet AI is still a black box, and we don’t really know how it works inside.
There are plenty of principles for responsible and ethical AI. The problem is that they rarely tell a company how to organise the work in practice. That is the gap ISO 42001 tries to close. It turns responsible AI into something you can run day to day.
Turning the black box upside down
ISO 42001 doesn’t open the black box. That isn’t what an organisation needs anyway. But it does help you turn the box upside down. Instead of trying to explain everything that happens inside the model, you take control of what you and your organisation can actually control: how and when you use AI, who is responsible, and when a person needs to be involved.
This makes responsibility clearer, because it becomes obvious who answers for what. That matters if we want to trust AI more. Without control, AI tends to be used randomly, sometimes on purpose and sometimes without anyone noticing, and then you get neither the efficiency nor the ownership you were hoping for.
AI is entering our daily work, whether we like it or not
I saw this myself with the new Meta glasses. A colleague took photos of a presentation through their new glasses, so they could go back over the key points from the slides afterwards. Is that the new normal? It’s the kind of situation where it helps to have guidelines in place, and a good example of how AI is entering our daily work, whether we want it to or not.
That’s why I think it’s so important to get started. We need to stay ahead of how these tools develop. It’s a bit like having safety guidelines before the accident happens. We need to teach employees how to use AI tools safely, and which guidelines we follow.
Two misunderstandings about ISO 42001
“It’s only for big AI companies and developers.” That’s a myth. The standard matters just as much for companies that adopt and use AI. Most companies are mainly users, and they are the ones who need structure when Copilot, ChatGPT or Claude is rolled out across the whole organisation. Both small and large organisations can use the standard.
“It’s expensive.” It doesn’t have to be. Many organisations can use the standard as inspiration for better control of AI without going for full certification. And because AI scales so fast, and we still accept the black box, doing nothing usually costs more.
My view is that certification shouldn’t be the end goal. The goal is to get the processes into the organisation and keep them alive. I’ll come back to this later in the article.
Where companies struggle with AI governance
Let me make this more concrete. Where exactly do companies struggle? And what risks are we talking about?
Rolling out a tool is not the same as AI governance
Many of our customers are experimenting with AI and trying to work out where the technology creates value. That is perfectly natural. But it makes governance hard, because it’s difficult to define risks and controls before you know how AI is actually being used.
In most cases, it starts with employees getting access to AI while nobody has the full picture of what it’s used for. There is an AI policy, but it isn’t necessarily built into the processes. Roles are unclear. And documentation feels heavy or confusing, so it doesn’t get done.
One example we’ve come across is a large company that rolled out an AI tool to all employees. The plan was good: one shared, approved AI tool for the whole organisation. But the employees who already knew the different AI tools quickly experienced that the chosen tool couldn’t support their tasks as well as the alternatives they knew. So they started using other tools alongside it. Not to get around the rules, but because they wanted the best tool for the job.
The result was that the company suddenly had two worlds: the official solution, which they had under control, and an unofficial one that nobody had an overview of. To me, this shows that rolling out a tool is not the same as AI governance. You also need to keep track of what employees actually need and what they actually use.
Shadow AI: what employees actually use
There is often a big gap between the tools a company provides and what employees actually use. You may know this from shadow IT, where employees use systems the IT department hasn’t approved. Shadow AI is the same idea, just with AI tools.
The company has an overview of the official tools, but a large share of the use can happen below the surface.
As mentioned, other tools are often used with good intentions. These are employees who want to do their work better and faster, so they find tools that work for them. But it also means company data can end up in places where nobody has made a decision about it. And you can’t manage the risks of AI you don’t know is being used.
The answer is rarely a ban. Instead, I’d say you should give employees good approved alternatives, clear rules on what can be shared, and the right restrictions in the tool itself.
Generative AI is hard to validate
On top of that, generative AI systems can be hard to validate, because the output is not always the same. Ask twice and you won’t necessarily get the same answer. This makes quality assurance more complicated than we are used to with traditional IT systems.
When the AI team and legal don’t speak the same language
Many organisations have legal and compliance people who need to make sure the use of AI meets GDPR, contracts and now also the AI Act. This is often where friction starts. The AI team wants to move quickly on new use cases, while legal needs documentation and a risk assessment before they can approve.
Compliance will typically want answers to questions like:
- What data is used, and where does it end up?
- Is there a data processing agreement with the supplier?
- Has a data protection impact assessment (DPIA) been done, if personal data is involved?
- Which risk category does the solution fall into under the AI Act?
- Who is responsible if something goes wrong?
This is where ISO 42001 can work as a shared language. When roles, risk assessments and documentation are in place from the start, legal doesn’t have to be the brake at the end. Instead, they become part of the process.
AI risks go beyond IT security
One of the most important points for me is that the risks of AI are broader than classic information security. When we talk about AI risks, we mean things like:
- Bias and discrimination, for example when data produces skewed results.
- Personal data and privacy: where does data end up, and who has access?
- Misinformation and unreliable answers that look trustworthy.
- Too much trust in AI, where people put the responsibility on the system, not least because AI tends to agree with us. This is known as sycophancy.
- System behaviour, when AI interacts with other systems in ways we didn’t foresee.
- Environment and resources: the energy use of the tools and how it affects our environment.
- Contracts: some customer contracts limit how you can use AI.
Many of these risks have nothing to do with technology. They are about people, responsibility and trust.
Ethical debt, not just technical debt
Everyone knows technical debt. You choose a quick fix now and pay for it later. But models and tools can also lead to ethical debt. And it’s hard to climb out once you’re in too deep.
AI scales so fast that taking an ethical stand matters more than ever, both to be responsible and to build relationships with your customers.
From risk to action: making ethics concrete
It’s easy to agree that AI should be used ethically. The hard part is turning that into something you can act on. This is where ISO 42001 helps, because the standard asks you to look at two things: the risk to the company and the consequences for the people affected by the system. That is exactly where ethics becomes concrete.
In practice, it comes down to three questions for each way you use AI:
- What can go wrong?
- Who is affected if it does?
- What do we do to prevent it?
So ethics isn’t about big principles. It’s about the small decisions you make for each use case. And when those decisions are written down, you also have the answer when a customer asks how you use AI responsibly.
What role does your company play?
ISO 42001 distinguishes between different roles in the AI value chain. Roughly speaking, there are those who develop AI, those who make AI available to others, and those who use AI in their own processes.
Most companies are mainly users. But the role can change. If you start building your own agents, adjusting models or offering AI features to your customers, you move closer to being a provider. And then the requirements change too. That’s why it’s a good idea to decide on your role for each AI system you use.
ISO 42001 and the EU AI Act: a standard is not the same as a law
When I talk to customers about ISO 42001, the EU AI Act almost always comes up. That makes sense. But the two are often mixed up, so let me try to separate them.
What’s the difference?
The EU AI Act is legislation. It sets requirements for companies that develop and use AI in the EU, and the requirements depend on how risky the AI system is.
ISO 42001 is a voluntary standard. It gives you a structure for how to manage AI in the organisation: roles, processes, risk assessments and documentation.
This also means you can’t be “certified in the AI Act” the way you can be certified to an ISO standard. You have to comply with the law. You can choose to work to the standard.
Why they are connected anyway
Even though they are different, they overlap a lot. Many of the things ISO 42001 asks you to get under control are the same things you will need for the AI Act: an overview of your AI systems, risk assessments, clear roles, human oversight and documentation.
Work is also under way on the so-called harmonised standards under the AI Act, which will describe more precisely how to meet the law. They are expected to follow many of the principles in ISO 42001 closely, but be more specific in some areas.
A concrete example is AI literacy. The AI Act already requires companies to make sure that employees who work with AI have enough skills and training. This is also a central part of ISO 42001. Different roles need different skills, and you need to decide what those are. It is also one of the reasons we at Capacit run AI workshops, to give companies and their employees the skills and foundation they need to use AI responsibly.
Don’t wait for everything to be in place
My point is this: don’t wait until all the EU standards are finished before you start building structure around AI. The work you do now on overview, responsibility and risk is not wasted. It is exactly the foundation you will need, however the details of the regulation turn out.
Certification is not necessarily the goal
One of the things I think is most important to say out loud is that the value of ISO 42001 is not only in the certificate.
For some companies, certification makes good sense. It can be a competitive advantage, especially if you deliver AI solutions to others or if customers require it. One example is Anthropic, the company behind Claude, which was certified to ISO 42001 (opens in a new window) in January 2025.
But for many companies it’s more important to use the standard to structure governance, risk and responsibility. There is a real difference between working by the principles and being formally certified. And my view is clear: certification shouldn’t be the end goal. The goal is to get the processes into the organisation and keep them alive.
How to get started with AI governance
Now let’s look at how you actually get started. This is where many people get stuck.
You don’t need to be a tech expert
Let me start with the most important point: you don’t need to be a tech expert to govern AI. But you do need to understand that AI is coming into the workplace and that it has to be handled, just like you handle other kinds of risk.
Governance is also not purely an IT project. It needs management to be involved, set the direction and provide resources.
Start with an overview
My best advice is to start with an overview. Before you can manage AI risks, you need to know which AI systems you actually use. This is how I would go about it:
- Map which AI tools and systems are used, including the ones you didn’t buy yourselves.
- Describe what they are used for.
- Find out which teams and employees use them.
- Clarify your role for each system: user, provider or developer.
- Assess the main risks and who is affected.
- Decide which controls and guidelines are needed.
- Assign responsibility and ownership to specific people.
- Document and follow up regularly.
This may sound like a lot, but it doesn’t have to be heavy. The point is that governance should follow the way you actually use AI, not just the technology.
What you need to have under control
Once you have the overview, you can start building structure. ISO 42001 includes an annex, Annex A, with concrete controls you can use as a checklist. They cover AI policy, roles and responsibilities, data, suppliers and the use of the AI systems themselves, among other things. The standard also requires an AI impact assessment of how an AI system affects the people who use it or are affected by it. Here are the areas I think matter most for most companies, grouped in four phases:
Keep it proportionate
An important point: governance should fit your size and how you use AI. A smaller company that uses Copilot for emails and meeting summaries doesn’t need the same compliance structure as a bank that uses AI for credit scoring. Start small, and build on it as your use of AI grows.
Governance is what will set the winners apart
Technology, responsibility and business value. Those are the three things I believe AI governance has to bring together.
I think effective governance of AI is what will set the winners apart from the rest. There are so many new models and updates, and competition is tough. How each company uses AI toward its stakeholders and customers will be decisive. Governance matters more than ever.
AI helps shape our reality
And I want to finish with the point I think is the most important of all.
When we use AI and it answers, we believe it. And if we make decisions based on its output, it helps shape our reality. Don’t we want to know that it is properly governed?
That’s why I don’t think we should see governance as a bureaucratic obstacle. We should see it as co-creating our future workplace. Done right, it won’t stop innovation. It will make it possible to scale AI responsibly and build a lasting competitive advantage for ourselves and our customers.
