ISO/IEC 42001 specifies requirements for a(n):
LA 1 / LI 1
Answer: B · why42001 is the AI management system (AIMS) standard.
Accredited personnel-certification bodies, e.g. PECB · AI Governance - ISO Management Systems
ISO/IEC 42001 Lead Auditor / Lead Implementer (AI Management System)
ISMS/GRC professionals extending into AI governance, auditors of AI management systems (AIMS), and consultants implementing ISO/IEC 42001.
Overview
- Prerequisites
- Training course then exam. Example (PECB): Lead Auditor or Lead Implementer credential needs 5 years' professional experience incl. 2 years in AI management, plus 300 hours of audit (LA) or AIMS project (LI) activity.
- Maintenance
- PECB certificates are valid for 3 years. Lead Auditor and Lead Implementer holders must report 90 CPD hours over each 3-year cycle (they can be spread unevenly across years) and pay annual maintenance fees (US$390 per 3-year cycle for these certification levels; the first year is included in the application). IRCA and other bodies have their own CPD rules - check official site.
- Outline in effect
- Standard: ISO/IEC 42001:2023 (published 18 Dec 2023)
Exam duration for PECB 42001 exams not confirmed in the documents checked - check official site.
Exam facts
- Questions
- 80 (PECB, both LA and LI)
- Duration
- check official site
- Question types
- Multiple choice
- Passing score
- 70% (PECB)
- Format
- Linear
- Delivery
- Check PECB Examination Rules and Policies
Cost
- Notes
- Bundled with training price set by the provider - check official site.
Domains
From the PECB ISO/IEC 42001 certification scheme; no percentage weights published.
- LA 1. Fundamental principles and concepts of an AI management system
- LA 2. AI management system requirements
- LA 3. Fundamental audit concepts and principles
- LA 4. Preparing an ISO/IEC 42001 audit
- LA 5. Conducting an ISO/IEC 42001 audit
- LA 6. Closing an ISO/IEC 42001 audit
- LA 7. Managing an ISO/IEC 42001 audit program
- LI 1. Fundamental principles and concepts of an AIMS
- LI 2. Artificial intelligence management system
- LI 3. Planning of an AIMS implementation
- LI 4. Implementation of an AIMS
- LI 5. Monitoring and measurement of an AIMS
- LI 6. Continual improvement and preparation for an AIMS certification audit
Upcoming changes
No announced changes as of 19 Oct 2026.
Study plan
- Week 1
ISO/IEC 42001 clauses
- Read clauses 4-10; note AI-specific additions: AI risk assessment, AI risk treatment, AI system impact assessment.
- Week 2
Annex A / B controls
- Study Annex A control objectives (policies, internal organisation, resources, impact assessment, life cycle, data, information for interested parties, use, third parties) and Annex B guidance.
- Week 3
Supporting AI standards
- ISO/IEC 23894 (AI risk), ISO/IEC 42005:2025 (impact assessment), ISO/IEC 22989 (terminology), ISO/IEC 42006:2025 (certification body requirements).
- Week 4
Regulatory mapping
- Map 42001 to the EU AI Act and NIST AI RMF 1.0 / AI 600-1; note where 42001 supports (but does not equal) legal compliance.
- Week 5
Case study: impact assessment and audit trail
- Run an AI system impact assessment for one use case using ISO/IEC 42005 guidance.
- Draft audit evidence requests (LA) or an implementation roadmap (LI) for that system.
- Week 6
AI life cycle and data controls in practice
- Build an AI system inventory for a sample organisation; classify each system's role (provider, developer, user).
- Map data quality, provenance, logging and human-oversight controls to Annex A objectives.
- Week 7
Course week
- Attend the course; build a sample AIMS scope and Statement of Applicability.
- Week 8
Exam practice
- Scenario questions; audit-finding writing (LA) or implementation sequencing (LI).
Exam tips
- Reuse your ISO/IEC 27001 knowledge: 42001 follows the same harmonised structure (clauses 4-10).
- Remember what is AI-specific: AI system impact assessment, data quality, life cycle controls, transparency to interested parties.
- For auditor questions, apply ISO 19011 and certification-body rules (ISO/IEC 17021-1 + 42006).
Common pitfalls
- Assuming ISO/IEC 42001 certification equals EU AI Act conformity - it does not.
- Ignoring the AI system impact assessment requirement.
- Treating AI risk only as security risk (bias, transparency, societal impact also matter).
Resources & official links
Official
- ISO/IEC 42001:2023
- ISO/IEC 42005:2025 AI system impact assessment
- ISO/IEC 42006:2025 requirements for AIMS certification bodies
- PECB ISO/IEC 42001 certification scheme
Also widely used
- NIST AI RMF 1.0 and Generative AI Profile (NIST AI 600-1)
- EU AI Act (Regulation (EU) 2024/1689) and the AI Omnibus amendments
- ISO/IEC 23894:2023 AI risk management
Sources
- ISO/IEC 42001:2023 (iso.org)
- PECB ISO/IEC 42001 Certification Scheme (domains, 80 questions, 70%, experience)
- PECB Certification Maintenance Policy (2026)
Last verified 19 Oct 2026. Values marked “check official site” could not be confirmed from an official source.
Practice questions
Which assessment is specific to ISO/IEC 42001 compared with ISO/IEC 27001?
LA 2 / LI 2
Answer: B · why42001 requires assessing potential consequences of AI systems for individuals, groups and society.
Which standard gives detailed guidance on AI system impact assessments (published 2025)?
LI 4
Answer: A · whyISO/IEC 42005:2025 provides impact assessment guidance.
Which standard sets additional requirements for bodies that certify AI management systems?
LA 7
Answer: A · whyISO/IEC 42006:2025 supplements ISO/IEC 17021-1 for AIMS certification bodies.
ISO/IEC 42001 follows which overall structure?
LA 1 / LI 1
Answer: B · whyIt uses the harmonised structure, which makes integration with an ISMS easier.
An organisation uses a third-party large language model. Under an AIMS, it should FIRST:
LI 3
Answer: B · whyThird-party AI is still within the organisation's AI risk and impact processes.
Which is the BEST evidence that an AI policy is being followed?
LA 5
Answer: B · whyRecords demonstrate operation of the documented process.
Bias in training data is primarily addressed by controls on:
LI 4
Answer: B · whyData quality and provenance controls address bias risks.
Does ISO/IEC 42001 certification by itself prove compliance with the EU AI Act?
LA 2 / LI 2
Answer: B · whyCertification is voluntary and does not replace legal conformity assessment.
An auditor finds no evidence that AI system performance is monitored after deployment. This relates MOST to:
LA 5
Answer: B · whyClause 9.1 requires monitoring and evaluating performance, including AI systems in operation.