ISO Consultants Explain: ISO 42001 Doesn’t Certify That Your AI Is Fair

As AI certification enters the market, a familiar pattern is emerging. Organisations want the certificate to say more than it says, and some suppliers are willing to imply that it does.

As ISO consultants, we think it’s worth being precise now, while the market is still forming. Whether you build AI in India, run operations from the Philippines or sell software into Nigeria, the same question will reach you: what does your certificate actually mean?

What does ISO 42001 certification actually mean?

ISO 42001 certification means you operate a management system for AI that meets the standard’s requirements. You’ve determined your role, inventoried your systems, assessed their risks and their impacts on people, put controls in place, and you manage the lifecycle and improve. That’s a real and substantial thing, and few organisations have it.

ISO/IEC 42001:2023 was published in December 2023 as the first international standard for AI management systems. Certification involves a two-stage audit by an accredited certification body, annual surveillance and recertification every three years. The standard adds AI-specific requirements on top of the familiar structure. These include an AI risk assessment, an AI risk treatment plan, and an AI system impact assessment. The impact assessment looks at effects on individuals, groups, and societies. Source: https://docs.modulos.ai/frameworks/iso-42001/ 

What doesn’t ISO 42001 certify?

It doesn’t certify any individual AI system, that outputs are fair, unbiased, or accurate, that your AI is safe, or that you comply with regulations. The certificate covers the management system within a defined scope, not the behaviour of a particular model.

The certification applies to an organisation’s management system, not to individual AI systems. 

On fairness, the standard requires you to consider it in your impact assessment and to put proportionate controls in place. It sets no threshold for fairness, and no auditor tests your model against one.

On safety, the certificate means you have a system for identifying and managing risk. That’s what a management system standard can offer, and it’s the most any of them offer.

Does ISO 42001 certification mean EU AI Act compliance?

No. The EU AI Act is law, and it doesn’t require ISO 42001. Conformity is assessed against the Act. In October 26 the EU cited EN 18286:2026, a separate quality management standard, as its first harmonised AI Act standard. ISO 42001 certification carries no such presumption of conformity.

The Act never names ISO 42001 and requires no certification. ISO 42001 certification alone carries no presumption of conformity under the Act. The Commission published the reference to EN 18286:2026 in the Official Journal, giving providers who follow it a presumption of conformity with the Article 17 quality management requirements it covers. The European Standards Committee wrote a purpose-built standard for Article 17 instead of adopting ISO 42001 as it stands. 

Timing matters if you make medical devices. The Digital Omnibus entered into force on 27 July 2026. It moved stand-alone high-risk obligations to 2 December 2027, and AI inside medical devices to 2 August 2028. A certified management system supports compliance. It doesn’t constitute it. 

Why does the distinction matter more for AI?

AI failures are visible, sometimes public, and attract attention that a quality or environmental failure doesn’t. A company that markets its certificate as proof of fair AI, then ships a system that discriminates, has made a claim the evidence contradicts. A company that calls it evidence of governance is defensible.

The first company has a problem beyond the outcome itself. It will be reported as having said something the facts contradict. The second can say systems fail, and the question is whether its governance was reasonable and whether it caught and corrected the failure.

How should you describe your ISO 42001 certificate?

Name the standard, the certification body, and the scope. “Certified to ISO 42001 for our AI management system covering the named systems” is accurate. Avoid anything implying a model has been validated, outputs are certified, or the certificate equals regulatory compliance.

The same care applies to privacy. ISO and IEC published a revised, standalone ISO/IEC 27701 on 14 October 2025. Organisations can now certify a privacy management system without first certifying to ISO/IEC 27001. That’s a useful credential, but it isn’t legal compliance. Nigeria has the Nigeria Data Protection Act 2023 and a regulator to enforce it. The Act established the Nigeria Data Protection Commission. India notified its Digital Personal Data Protection Rules 2025 in November 2025. A certificate doesn’t replace compliance with either law. 

What is the internal risk after you certify?

The more dangerous risk of overclaiming is internal. If certification creates a sense that AI governance is now handled, the monitoring the standard requires quietly stops. AI systems drift: data changes, populations change, and use cases expand beyond what was assessed.

A system that was appropriate at deployment may not be appropriate a year later. The only thing that catches that is ongoing monitoring. Clause 9.1 asks you to define what to monitor, how to measure it and how often. A sense of completion undermines exactly that activity. 

The certificate is evidence that you built the mechanism. Annual surveillance audits check it, but they sample. Whether you keep operating it is something no auditor can certify in advance.

Which industries need to be most careful with ISO 42001 claims?

Medical device makers, IT and software companies, and any business selling AI into hiring, credit, health or education should be most careful. Their buyers and regulators read AI claims closely, and a loose description of a certificate can cost a contract.

Examples of stand-alone high-risk systems include AI used in HR and employment. Importers and distributors who resell AI-enabled products should ask the supplier what the certificate covers: which systems, which scope, and which certification body. 

What advice do MSCi’s ISO consultants give?

Our advice is practical. Most overclaiming starts in a sales deck, not in the audit.

• Write the scope sentence first. Name the systems it covers, then use that wording everywhere.

• Check your website and sales deck against the certificate. Do it before launch, and again after every update.

• Set your own fairness threshold. The standard sets none, so choose metrics and acceptable ranges, and record who approved them.

• Give monitoring an owner and triggers. Triggers include drift, new use cases, new data sources and complaints.

• Re-run the impact assessment when the use case changes. A new customer type is a change.

• Ask your own suppliers the same question. What exactly does their certificate cover?

How can ISO consultants help with ISO 42001 in India and Nigeria?

MSC Incorporation (MSCi) is an ISO consultancy with 40+ years of experience in ISO consultation. As ISO 42001 consultants in India, with ISO certification consultancy support in Nigeria, we help with scope, an ISO 42001 readiness checklist, AI risk and impact assessments, ISO 27701 consulting services and internal audits. We prepare your company for the audit. An independent accredited certification body issues the certificate, not MSCi.

5. Frequently Asked Questions 

Does ISO 42001 certify that my AI is fair?

No. It certifies your management system. You must consider fairness in your impact assessment and apply proportionate controls, but the standard sets no fairness threshold.

Is ISO 42001 mandatory?

No. It’s a voluntary international standard. Your customers or tenders may still ask for it. 

What is EN 18286, and how does it differ from ISO 42001?

EN 18286:2026 is a European quality management standard written for Article 17 of the EU AI Act. Following it gives a presumption of conformity for the requirements it covers. ISO 42001 certification doesn’t.

What should an ISO 42001 readiness checklist include?

It should cover scope, an inventory of your AI systems, AI risk assessment, AI impact assessment, control selection, monitoring, and internal audit. Add owners and review dates for each.

How do I choose ISO 42001 consultants in India?

Ask whether they’ll work from your actual AI systems, and whether they say plainly that they don’t issue certificates. Be careful with anyone who implies the certificate proves your model is fair.

Can ISO 27701 consulting services help with AI privacy?

Yes. The 2025 edition adds clearer guidance on managing personal data within AI and digital ecosystems. MSCi’s ISO consultants can combine a privacy management system with your AI management system.