Why ISO/IEC 42001 matters now: governing artificial intelligence responsibly

Artificial intelligence has moved from the laboratory into the back office, the call centre and the lending decision. The question is no longer whether organisations will use it, but whether they can govern it responsibly. ISO/IEC 42001 is the first international management-system standard written for exactly that task, and it has arrived at the right moment.

We have a particular reason to care about this one. We do not only teach it. Our own Digital Office runs on it. So when we talk about ISO/IEC 42001, we are describing a discipline we practise on ourselves, with all the honesty that demands.

What the standard sets out to do

ISO/IEC 42001 (the AI management-system standard) gives an organisation a structured way to govern its use of artificial intelligence. Like its siblings in the ISO family, it is built around the same management-system spine: understand your context, set objectives, assess risk, put controls in place, then monitor and improve. What is new is the subject. Here the risks include things older standards never had to name, including bias, opacity, drift and the question of who is accountable when a model decides.

The standard asks an organisation to be deliberate. Which systems are we using AI in. What could go wrong for the people affected. Who reviews the outputs. How do we keep a human in the loop where it counts. These are governance questions, not engineering ones, and that is the point.

Aligned, not certified, and why the difference matters

Here is where we are careful, and where we ask our learners to be careful too. Our Digital Office is aligned to the principles of ISO/IEC 42001. It is not certified to the standard. That distinction is not a hedge. It is the whole lesson.

Alignment means we have taken the standard's principles, including human oversight, risk assessment, transparency about what is automated, and clear accountability, and built them into how the office actually operates. Certification is a separate, formal act: an accredited body audits the system against the requirements and issues a certificate. Claiming the second when you have only done the first is precisely the kind of overstatement good governance is meant to prevent.

The honest sentence is the hard one to write: we are aligned to its principles, not certified to the standard. Learning to draw that line is half of what responsible AI governance is.

Why now

Three things have converged. AI is now cheap enough and capable enough to sit inside everyday processes, so the exposure is real rather than theoretical. Regulators and clients are beginning to ask how organisations control these systems, and a recognised framework is the cleanest answer. And the standard itself now exists, giving everyone a common language instead of a hundred private definitions of responsible AI.

For African organisations adopting AI quickly, often leapfrogging older ways of working, this is an opportunity rather than a burden. Building governance in from the start is far easier than retrofitting it after something goes wrong.

How we teach what we practise

Because the office runs on these principles, our training is not abstract. We can show what a risk register for an AI system looks like, how human oversight is documented, and where the honest limits of a claim sit. The Foundation, Lead Implementer and Lead Auditor tracks extend to ISO/IEC 42001 alongside the standards we have facilitated for years. We train you, we certify you on the recognised courses, then we put you to work, and the Digital Office stands as the working example in the room.

This is a representative sample article published to illustrate the kind of guidance ISO Ambassadors shares. Course names, partnerships and roles reflect our standing programme.