ISO 42001 at a Glance
Artificial intelligence (AI) is transforming healthcare, from diagnostic imaging to clinical decision support to remote patient monitoring. As AI becomes an integral part of deployed medical technologies, organisations face increasing expectations to demonstrate that their systems are not only innovative, but also safe, transparent and responsibly governed.
Published in December 2023, ISO/IEC 42001:2023 is the world's first international standard for an Artificial Intelligence Management System (AIMS). Rather than regulating AI technology itself, the standard provides organisations with a structured framework for governing the development, deployment, maintenance and continual improvement of AI systems throughout their lifecycle.
For both non-medical device and medical device manufacturers, ISO 42001 provides a practical way to develop responsible AI systems while complementing existing quality, information security and regulatory management systems. Although it is currently voluntary, the standard is rapidly emerging as a recognised benchmark for organisations developing AI-enabled medical technologies under medical device regulations and the EU AI Act.
Who Needs ISO 42001 in Medical Devices?
ISO 42001 can be relevant to every organisation developing or deploying AI within healthcare. While the standard applies across all industries, its principles are particularly valuable for companies operating within regulated medical technology environments where patient safety, transparency and risk management are critical.
Typical organisations that may benefit from ISO 42001 include:
- AI-enabled diagnostic imaging companies
- Clinical decision support software providers
- Remote patient monitoring platforms
- Digital therapeutics developers
- Medical device manufacturers embedding AI components into existing products
- Healthcare technology companies integrating third-party AI products
One of ISO 42001's strengths is recognising that organisations can perform single or multiple roles within a specific AI ecosystem. The standard distinguishes between:
- AI Providers - organisations developing or supplying AI systems.
- AI Producers - the human capital that underpins the creation and maintenance of AI systems.
- AI Customers - organisations deploying or operating AI systems within real-world environments.
The standard is also becoming increasingly relevant during procurement. NHS organisations and healthcare providers are placing greater emphasis on assurance around AI governance when assessing digital suppliers as existing compliance standards have not been optimised for the new wave of AI capabilities. While procurement requirements continue to evolve, evidence of a structured AI management system is emerging as an important trust signal within procurement frameworks and supply chain assessments.
It is important to note that ISO 42001 is currently voluntary. It is not yet harmonised under any existing AI or medical device regulation, meaning certification is not currently a regulatory requirement. However, many organisations are already adopting the standard proactively (or at least the principles behind it) to demonstrate mature governance, prepare for future regulatory expectations and strengthen customer confidence.
As AI regulation continues to develop internationally, ISO 42001 is increasingly viewed as a strategic investment rather than simply another management system.
How ISO 42001 Is Structured
Like many ISO standards, ISO 42001 follows the usual high-level structure, making it familiar to organisations already certified to standards such as ISO 9001 or ISO 27001. This common structure allows organisations to integrate AI governance into existing management systems rather than creating entirely separate processes.
The operational requirements are contained within Clauses 4 to 10:
Clause 4 - Context of the Organisation
Organisations must understand the internal and external factors influencing their AI activities, identify interested parties, determine the scope of the AI Management System, and establish appropriate governance arrangements.
Clause 5 - Leadership
Senior leadership must demonstrate accountability for AI governance by establishing policies, assigning responsibilities and promoting responsible AI practices throughout the organisation.
Clause 6 - Planning
Risk management sits at the heart of ISO 42001. Organisations are required to identify AI-related risks and opportunities, perform AI-specific risk assessments and treatments, complete AI impact assessments, and establish measurable objectives for continual improvement.
Clause 7 - Support
This clause covers the resources needed to operate an effective AI Management System, including competence, awareness, communications and documented information.
Clause 8 - Operation
Operational controls govern how AI systems are designed, developed, validated, deployed, monitored and maintained throughout their lifecycle. This includes managing changes, third-party AI components and ongoing operational controls.
Clause 9 - Performance Evaluation
Organisations must monitor the effectiveness of their AI Management System through internal audits and management reviews.
Clause 10 - Improvement
Continual improvement remains a core principle. Organisations are expected to address nonconformities, implement corrective actions and continuously improve both AI governance and operational performance.
Alongside these clauses sits Annex A, which contains 38 AI-specific controls organised into nine categories:
- A.2 - Policies related to AI
- A.3 - Internal organisation
- A.4 - Resources for AI systems
- A.5 - Assessing impacts of AI systems
- A.6 - AI system lifecycle
- A.7 - Data for AI systems
- A.8 - Information for interested parties of AI systems
- A.9 - Use of AI systems
- A.10 - Third-party and customer relationships
Supporting annexes provide further implementation guidance:
- Annex B offers practical guidance on implementing the Annex A controls.
- Annex C offers potential AI objectives, risks and potential risk sources that organisations can use as a template.
- Annex D helps map ISO 42001 to other standards and sector-specific guidance, helping organisations integrate compliance activities.
Similar to other ISO standards, ISO 42001 is fully certifiable. Organisations can therefore obtain independent certification to demonstrate that their AI management system has been externally assessed against an internationally recognised standard. Importantly, AI risk management is not confined to a single clause, it is embedded throughout the entire management system.
ISO 42001 vs ISO 13485 and ISO 27001
Medical device manufacturers often ask whether ISO 42001 replaces existing management systems or parts of them. The answer is straightforward: it does not.
Each standard addresses a different aspect of organisational governance:
- ISO 13485 establishes the quality management system for medical devices.
- ISO 27001 governs information security management.
- ISO 42001 governs artificial intelligence management.
Together they form complementary layers of assurance rather than competing requirements.
There is significant overlap between the three standards, however. All require leadership commitment, documented processes, competence management, internal audits, management review and continual improvement. Organisations already certified to ISO 13485 or ISO 27001 therefore possess many of the organisational foundations required for ISO 42001. However, AI introduces governance challenges that traditional management systems do not fully address.
For example, ISO 13485 focuses on medical device quality but provides limited guidance on issues such as:
- AI model drift after deployment
- Dataset governance throughout the AI lifecycle
- Algorithmic bias and fairness
- Explainability and transparency
- Human oversight of AI decisions
- Monitoring AI behaviour over time
Similarly, ISO 27001 protects information assets but does not address whether AI outputs remain clinically appropriate, ethically acceptable or operationally trustworthy.
ISO 42001 fills these gaps by introducing governance controls specifically designed for AI systems (as outlined in the Annex discussion above). Rather than focusing solely on cybersecurity or product quality, it considers how AI systems are developed, validated, monitored and continually assessed throughout their operational life.
For organisations already operating mature ISO 13485 or ISO 27001 management systems, achieving ISO 42001 certification is often considerably more efficient because many core management processes already exist. Existing document control, corrective action procedures, internal audit programmes and management review processes can usually be extended to include AI governance rather than created from scratch.
In practice, an established ISO 13485 or ISO 27001 system should be viewed as a valuable head start, but not a substitute, for implementing ISO 42001.
ISO 42001 and the EU AI Act
The regulatory landscape for AI is evolving rapidly, making governance standards increasingly important for medical device manufacturers.
The EU AI Act entered into force on 1 August 2024, marking the beginning of the world's first comprehensive legal framework for artificial intelligence. While certain provisions apply earlier, most obligations for high-risk AI systems become applicable from 2 August 2026. For AI systems that form part of regulated products requiring notified body conformity assessment, such as many medical devices, Article 6 obligations apply from 2 August 2027.
Under the AI Act, many AI-enabled medical devices already regulated under the MDR will automatically be classified as high-risk AI systems. In these cases, notified bodies will assess compliance with both medical device legislation and the AI Act as part of conformity assessment activities.
Although ISO 42001 does not provide compliance with the AI Act in itself, it supports many of the governance principles required by the legislation, including:
- AI risk management
- Data governance
- Human oversight
- Transparency
- Record keeping
- Post-market surveillance
- Continual improvement
This makes ISO 42001 an excellent foundation for organisations preparing for future AI Act obligations whilst maintaining existing MDR compliance activities.
Within the UK, regulation continues to evolve along a different but complementary path. The MHRA has established initiatives such as the AI Airlock to support the safe evaluation of AI-enabled medical technologies, and NHS England has established registers such as the AI Scribe one.
For organisations supplying NHS customers, if the product is Software or AI as a Medical Device, they will also need to complete the Digital Technology Assessment Criteria (DTAC version 2) which contains additional governance obligations such as DCB0129 Clinical Risk Management, the Data Security and Protection Toolkit (DSPT) and Cyber Essentials.
Rather than waiting for harmonised standards under the AI Act, forward-looking manufacturers are already mapping existing quality, cybersecurity and clinical safety controls against emerging AI governance requirements. Doing so reduces future compliance effort, strengthens organisational maturity and demonstrates responsible AI practices to regulators, customers and notified bodies alike.
First Steps Toward ISO 42001 Readiness
For organisations beginning their ISO 42001 journey, the first objective is understanding exactly where AI exists across the business. A sensible start is to identify every AI system associated with your products and services. This should include internally developed machine learning models, third-party AI services, foundation models, APIs, cloud-hosted AI platforms and any embedded AI functionality within larger medical devices.
Once the AI landscape has been established, organisations should perform an AI system risk assessment in accordance with Clause 6.1.2 together with an AI impact assessment under Clause 6.1.4. These assessments should not exist separately from established medical device risk management processes but instead integrate with existing ISO 14971 risk management files and clinical safety activities under DCB0129.
A structured gap analysis against Annex A (and the standard’s main clauses) should then identify where existing management systems already satisfy ISO 42001 requirements and where additional controls are required. Organisations certified to ISO 13485 or ISO 27001 frequently find that leadership, document control and audit processes already exist, allowing them to focus on AI-specific topics such as:
- AI lifecycle governance
- Dataset management
- Model monitoring
- Third-party AI suppliers
- AI transparency
- AI impact assessments
Successful implementation also requires clear ownership. AI governance typically spans regulatory affairs, quality assurance, clinical safety, cybersecurity, software engineering, data science and executive leadership. Defining accountability across these disciplines early significantly improves implementation success.
Where ISO 42001 Fits Your Compliance Strategy
For AI medical device manufacturers, ISO 42001 should not be viewed as another standalone compliance exercise. Instead, it forms part of an integrated governance framework alongside ISO 13485, ISO 27001, ISO 14971, the EU AI Act, clinical safety standards and cybersecurity best practice.
When these management systems are implemented together, organisations can demonstrate a mature, risk-based approach covering product quality, information security, patient safety and responsible AI governance throughout the product lifecycle.
At AbedGraham, we help AI medical device manufacturers build practical, integrated compliance programmes that combine regulatory affairs, clinical safety, cybersecurity and management system expertise. Whether you're preparing for ISO 42001 certification, mapping your controls against the EU AI Act or integrating AI governance into an existing ISO 13485 quality management system, our specialists can help you take a structured, proportionate approach.
Want to understand what ISO 42001 means for your organisation? Speak to our team to discuss your AI governance strategy and compliance roadmap.