ISO 42001: The Complete Guide for SMBs — What It Is, Why It Matters, and How to Get Certified (2026)

ISO 42001: The Complete Guide for SMBs — What It Is, Why It Matters, and How to Get Certified (2026)

By David Mosher, CEO, Rhindon Cyber | AI Governance & Compliance Expert | Former Microsoft, Bridgewater Associates, Raytheon

Quick Answer: ISO/IEC 42001:2023 is the world's first international standard specifying requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within an organization (ISO, 2023). Published in December 2023, it applies to any organization — of any size, in any sector — that develops, provides, deploys, or uses AI systems. For SMBs, ISO 42001 is the most credible, globally recognized path to demonstrating that AI is being governed responsibly. Unlike regulatory mandates, it is voluntary and certifiable, meaning it produces a third-party audit signal that clients, insurers, and regulators can trust.

---

Table of Contents

1. What Is ISO 42001?
2. Why ISO 42001 Matters for SMBs in 2026
3. The Academic Evidence: What Research Shows About ISO 42001 Benefits
4. The Four Themes of AI Governance ISO 42001 Addresses
5. ISO 42001 Structure: Ten Clauses of the Standard
6. Annex A: The 38 Controls That Govern Your AI Systems
7. ISO 42001 vs. NIST AI RMF vs. EU AI Act
8. The Certification Path: Five Stages from Gap Analysis to Certificate
9. Implementation Roadmap for SMBs: A Phased Approach
10. Common Pitfalls — and How to Avoid Them
11. How RAIC Accelerates ISO 42001 Alignment
12. References

---

What Is ISO 42001?

ISO/IEC 42001:2023 — formally titled Information Technology — Artificial Intelligence — Management System — is an international standard published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in December 2023 (ISO, 2023). It specifies the requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System, referred to as an AIMS.

Unlike AI ethics guidelines or risk frameworks, which describe principles and practices, ISO 42001 is a management system standard — the same family of standards as ISO 27001 (information security) and ISO 9001 (quality management). This means it is auditable, certifiable, and capable of producing a formal certificate of conformity issued by an accredited third-party certification body. For organizations that have implemented ISO 27001, the ISO 42001 structure will feel immediately familiar: it follows the same Annex SL high-level structure, which means many governance processes can be integrated rather than duplicated.

The standard is designed for any entity that "uses AI and wishes to demonstrate behavior within global ethical and regulatory standards" — regardless of whether the organization builds AI, buys AI, or simply uses AI-enabled tools in its operations (ISO, 2023). This universal scope is a defining characteristic: an SMB using Microsoft Copilot, a healthcare practice deploying an AI triage tool, and an enterprise software firm selling AI features are all within scope, albeit at different implementation scales.

---

Why ISO 42001 Matters for SMBs in 2026

The case for ISO 42001 adoption rests on four converging pressures specific to the 2026 business environment.

1. Enterprise Client Qualification Requirements

As ISO 42001 adoption spreads among large enterprises, AI governance attestation is becoming a standard vendor qualification requirement — appearing in RFPs, security questionnaires, and procurement due diligence checklists. An SMB with an ISO 42001 certificate can answer those questions definitively. An SMB without one cannot. This is the same dynamic that drove ISO 27001 from a voluntary standard to a de facto market requirement over the past decade.

2. EU AI Act Deployer Alignment

The EU AI Act (Regulation [EU] 2024/1689) imposes documented obligations on organizations that deploy AI in the EU context — including requirements for risk management, human oversight, data governance, AI literacy, and post-market monitoring (European Parliament & Council of the European Union, 2024). ISO 42001's control set directly addresses these obligations. European harmonized standards are expected to reference ISO 42001 in the formal conformity assessment path for high-risk AI systems, meaning ISO 42001 certification may become the practical path to EU AI Act compliance documentation for many deployers.

3. Cybersecurity Insurance Underwriting

AI governance posture is increasingly incorporated into cyber liability insurance underwriting questionnaires. Insurers are beginning to ask what AI tools are in use, whether governance policies exist, and how AI-related incidents are managed. An ISO 42001 certificate — or documented alignment with its controls — provides exactly the kind of third-party evidence that reduces underwriting risk and supports premium calculations.

4. Competitive Differentiation and Trust

Birkstedt, Minkkinen, Tandon, and Mäntymäki (2023), in a landmark literature review of AI governance research published in Internet Research (Emerald, ABDC-A), define AI governance as "a system of rules, practices and processes employed to ensure an organization's use of AI technologies aligns with its strategies, objectives, and values, complete with legal requirements, ethical principles and the requirements set by stakeholders." ISO 42001 operationalizes this definition as a certifiable standard — meaning it translates governance intention into documented, auditable evidence. Organizations that can demonstrate this evidence differentiate themselves on trust, not just capability.

---

The Academic Evidence

Process Optimization, Innovation, and Competitive Advantage (Mazzinghy et al., 2025)

Mazzinghy et al. (2025), publishing in Standards (MDPI), conducted an empirical survey study of professionals in the Brazilian logistics sector using the TOPSIS multi-criteria decision-making method to identify and rank the benefits of ISO/IEC 42001 implementation. Of 15 benefits mapped in the literature review, the participating professionals attributed highest importance to:

1. Customer satisfaction — structured AI governance increases stakeholder confidence in AI-enabled products and services
2. Operational efficiency — documented AI management processes reduce rework, errors, and redundant efforts
3. Incentives for innovation — governance structure enables faster, more confident AI adoption because risks are defined and controlled
4. Improved company image and competitive advantage — certification signals responsible AI to clients, partners, and regulators

The study's core conclusion is directly actionable for SMBs: ISO 42001 "not only promotes process optimization and cost reduction, but also encourages innovation and strengthens competitiveness in the market" (Mazzinghy et al., 2025). Governance and competitive advantage are not in tension — governance enables competitive advantage by making AI adoption faster and safer.

Technical, Operational, and Strategic Impacts (Biroğul, Şahin & Əsgərli, 2025)

Biroğul, Şahin, and Əsgərli (2025), publishing in Advances in Artificial Intelligence Research, examined the technical, operational, and strategic implications of implementing ISO/IEC 42001:2023 across organizational practice contexts. Three findings are directly relevant to SMB implementation:

• Technical impacts: ISO 42001 implementation systematically improves AI system documentation — including model cards, data governance records, and audit trails — that would not otherwise exist in organizations without formal AI governance. This documentation is the foundation of regulatory defensibility.
• Operational impacts: The AIMS lifecycle management requirements force organizations to think about AI systems beyond deployment — establishing maintenance, monitoring, and decommissioning processes that reduce operational risk from outdated or degraded AI models.
• Strategic impacts: ISO 42001 certification creates a governance framework that makes subsequent regulatory compliance — EU AI Act, sector-specific AI regulations, client due diligence — materially more efficient to demonstrate. Organizations that have done the ISO 42001 implementation work once do not need to rebuild governance evidence from scratch for each new stakeholder requirement.

AI Governance Themes and Organizational Knowledge Gaps (Birkstedt et al., 2023)

Birkstedt et al.'s (2023) systematic literature review in Internet Research — which analyzed AI governance research across four themes (technology, stakeholders and context, regulation, and processes) — identified a persistent gap between AI ethics principles stated at the organizational level and operational governance practices embedded in day-to-day AI management. The study found that organizations consistently articulate AI ethics commitments but lack the process infrastructure to operationalize those commitments in practice.

ISO 42001 directly addresses this implementation gap. Its ten clauses and 38 Annex A controls are specifically designed to bridge the gap between stated AI principles and documented, auditable organizational processes — precisely the gap that Birkstedt et al. (2023) identified as the central failure mode of organizational AI governance.

---

The Four Themes

Drawing on Birkstedt et al.'s (2023) four-theme AI governance taxonomy, ISO 42001 can be understood as a standard that systematically addresses each governance dimension:

Theme	What It Covers	ISO 42001 Clauses Addressing It
Technology	AI system capabilities, limitations, technical risks, model lifecycle management	Clauses 6, 8, and Annex A controls A.6, A.7, A.8
Stakeholders and context	Internal and external stakeholder identification, impact assessment, transparency obligations	Clauses 4, 7, and Annex A controls A.2, A.9
Regulation	Legal and regulatory compliance, EU AI Act alignment, sector-specific requirements	Clauses 4, 6, and Annex A controls A.3, A.4
Processes	AI governance policies, roles and accountability, audit, review, and continuous improvement	Clauses 5, 9, 10, and Annex A controls A.1, A.5

This alignment is not coincidental. ISO 42001 was developed with awareness of the AI governance research literature and the policy landscape — its structure reflects the areas where organizational AI governance most consistently fails, and its controls target the specific process gaps that empirical research has documented.

---

ISO 42001 Structure: Ten Clauses

ISO 42001 follows the ISO Annex SL high-level structure, making integration with ISO 27001, ISO 9001, and other management system standards straightforward. The standard is organized into ten clauses. Clauses 1–3 are introductory; Clauses 4–10 contain the normative requirements organizations must fulfill.

Clause 4: Context of the Organization

The organization must determine the internal and external factors that affect its ability to achieve the intended outcomes of the AIMS. This includes identifying interested parties — clients, regulators, employees, AI-affected individuals — and their requirements. The organization must also document its AI policy context: what AI systems it operates, for what purposes, and under what regulatory obligations.

SMB application: For most SMBs, this means documenting the business context, identifying which stakeholders are affected by AI decisions, listing the regulatory requirements that apply (EU AI Act, GDPR, HIPAA, sector-specific), and defining the scope of the AIMS — which AI systems and business functions are included.

Clause 5: Leadership

Senior management must demonstrate commitment to the AIMS by establishing an AI policy, assigning roles and responsibilities, and ensuring the AI governance program has the authority and resources to function effectively. Leadership accountability is not delegatable under ISO 42001: the standard requires evidence that top management has actively engaged with the AI governance program.

SMB application: In a smaller organization, this typically means the CEO or COO is named as the AI governance executive sponsor, a brief AI policy is formally approved and signed by leadership, and an AI Oversight Lead is assigned with defined responsibilities.

Clause 6: Planning

The organization must assess AI-related risks and opportunities, establish measurable AI governance objectives, and plan how those objectives will be achieved. This includes AI system impact assessment — evaluating the potential effects of AI systems on individuals, groups, and society before deployment.

SMB application: Risk assessment for each AI system in scope; a documented set of governance objectives with measurable targets; and completed impact assessments for AI systems that make or inform consequential decisions.

Clause 7: Support

The organization must allocate adequate resources, ensure personnel competence in AI governance, promote AI literacy across the organization, and manage documented information — maintaining the records and documents that demonstrate AIMS operation.

SMB application: AI literacy training for all staff using AI tools; designated AI governance personnel with defined competence requirements; and a document management process for AIMS records (policies, assessments, audit logs, incident reports).

Clause 8: Operation

The organization must plan, implement, and control the processes needed to meet AIMS requirements — including AI system lifecycle management, third-party AI supplier oversight, and AI system impact assessment implementation. Clause 8 is where the governance framework becomes operational reality.

SMB application: Documented AI system lifecycle procedures (from selection and procurement through deployment, monitoring, and decommissioning); vendor assessment process for third-party AI tools; and operational controls for high-risk AI systems including human oversight requirements.

Clause 9: Performance Evaluation

The organization must monitor, measure, analyze, and evaluate AIMS performance — including internal audits and management reviews. Clause 9 ensures that governance is not a set-and-forget compliance exercise but a continuously monitored and improved program.

SMB application: Annual internal audit of AIMS effectiveness; quarterly management review of governance KPIs; and defined performance metrics for the AI governance program (e.g., percentage of AI systems with completed risk assessments, training completion rates, incident response times).

Clause 10: Improvement

The organization must identify nonconformities, take corrective actions, and continuously improve the AIMS. This includes learning from AI governance incidents — near-misses, policy violations, data handling errors — and using those learnings to prevent recurrence.

SMB application: A formal nonconformity and corrective action process; an AI incident log; and a documented continuous improvement cadence tied to the management review cycle.

---

Annex A: The 38 Controls

ISO 42001's Annex A provides a comprehensive set of 38 controls, organized into 10 control categories, that organizations select and implement based on their AI risk profile. Annex A is normative — meaning it is a required part of the standard — but individual controls are applied based on a Statement of Applicability (SoA) that documents which controls are applicable, which are implemented, and justification for any exclusions.

Control Category	Description	Key SMB Controls
A.1 AI policies	Organizational AI policy and governance framework	AI acceptable use policy; AI ethics principles
A.2 Internal organization	Roles, responsibilities, and governance structure	AI Oversight Lead; AI governance committee
A.3 Resources for AI systems	Compute, data, and human resources governance	Resource adequacy assessment; data provenance
A.4 AI system lifecycle	Design, development, deployment, and decommissioning	AI system inventory; lifecycle documentation
A.5 Data for AI systems	Data quality, provenance, privacy, and bias management	Training data documentation; data governance
A.6 AI system design	Design principles, bias controls, explainability	Model documentation; bias testing
A.7 AI system verification and validation	Testing, evaluation, and performance validation	Validation protocols; pre-deployment testing
A.8 AI system operation	Deployment, monitoring, and incident management	Monitoring cadence; incident response
A.9 Human oversight of AI systems	Human review, intervention, and override capabilities	Human-in-the-loop procedures; escalation paths
A.10 Documentation and information management	Record-keeping, audit trails, and knowledge management	AIMS documentation; audit logs

For SMBs, the highest-priority control categories are typically A.1 (policy foundation), A.2 (governance structure), A.4 (AI system lifecycle — the registry), A.8 (operational monitoring), and A.9 (human oversight). These five categories together constitute the core of a minimum viable AIMS for a smaller organization.

---

ISO 42001 vs. NIST AI RMF vs. EU AI Act

The three frameworks dominating AI governance in 2026 are complementary, not competitive. The efficient path is a single integrated governance program that satisfies all three simultaneously, rather than three separate parallel programs.

Dimension	ISO/IEC 42001	NIST AI RMF 1.0	EU AI Act
Type	International management system standard	U.S. voluntary framework	EU binding regulation
Certifiable?	Yes — third-party audit produces certificate	No	Conformity assessment required for high-risk AI
Scope	Any organization using, developing, or providing AI	Any organization using or deploying AI	Organizations placing AI on EU market
Primary output	AIMS certificate of conformity	Organizational Profile; risk register	Documented compliance; CE marking for high-risk
Mandatory?	Voluntary	Voluntary	Mandatory for covered organizations
Key mechanism	Management system (plan-do-check-act cycle)	Risk management (Govern-Map-Measure-Manage)	Risk classification + prohibited practices
Ideal first step?	Yes — governance wrapper that maps to both others	Good for U.S.-primary programs	Required for EU market participants

The practical integration sequence: ISO 42001 provides the management system structure and certification signal; NIST AI RMF provides the risk assessment vocabulary and methodology that populates ISO 42001's planning and risk management requirements; the EU AI Act defines the legal obligations that ISO 42001 and NIST controls document compliance with.

An SMB that implements ISO 42001 with NIST AI RMF as its risk methodology has built the documentation foundation needed to demonstrate EU AI Act deployer compliance — particularly for the Article 4 AI literacy obligation, the Article 26 high-risk deployer obligations, and the Article 50 transparency requirements (European Parliament & Council of the European Union, 2024).

---

The Certification Path

ISO 42001 certification follows a structured process with five sequential stages. Third-party audits are conducted by accredited certification bodies such as BSI, Bureau Veritas, DNV, and ANAB-accredited auditors.

Stage 1: Gap Analysis and Readiness Assessment

Before beginning formal implementation, the organization assesses its current AI governance practices against ISO 42001's requirements to identify gaps. The gap analysis produces a prioritized list of what must be built, documented, or formalized before certification audit.

Typical findings for SMBs: Missing AI system registry (Map function gap); no formal AI policy signed by leadership; absent impact assessment process; no documented AI literacy program; no AI-specific incident response procedures.

Estimated timeline: 2–4 weeks

Stage 2: AIMS Design and Implementation

The organization designs and implements the AIMS — developing the policies, procedures, roles, controls, and documentation required by Clauses 4–10 and applicable Annex A controls. This stage also includes completing the Statement of Applicability (SoA), which documents control applicability and implementation status.

The Biroğul et al. (2025) findings are directly relevant here: the operational impacts of ISO 42001 implementation extend well beyond documentation — the process of building the AIMS produces genuine operational improvements in AI system lifecycle management, vendor oversight, and incident response that persist beyond the certification audit.

Estimated timeline: 8–16 weeks (depending on organizational complexity and existing governance maturity)

Stage 3: Internal Audit

Before the external certification audit, the organization conducts an internal audit against ISO 42001's requirements — identifying nonconformities, implementing corrective actions, and demonstrating the AIMS's operational effectiveness. The internal audit is a Clause 9 requirement, not optional pre-audit preparation.

Estimated timeline: 2–3 weeks

Stage 4: Stage 1 Certification Audit (Documentation Review)

The accredited certification body conducts a Stage 1 audit — a documentation review that assesses whether the AIMS design and documented evidence meet ISO 42001's requirements. Stage 1 typically identifies observations and minor findings that must be addressed before Stage 2.

Estimated timeline: 1–2 weeks for audit; 2–4 weeks to address findings

Stage 5: Stage 2 Certification Audit (Operational Effectiveness)

The certification body conducts a Stage 2 audit — an on-site (or remote) assessment of how well the AIMS actually operates in practice, not just on paper. Auditors interview staff, review evidence of ongoing operation, test controls, and confirm that the AIMS produces its intended outcomes. Successful Stage 2 completion results in a certificate of conformity valid for three years, with annual surveillance audits confirming continued compliance.

Estimated timeline: 1–2 weeks for audit; certificate issued within 2–4 weeks

Total estimated timeline from gap analysis to certificate: 5–7 months for most SMBs.

---

Implementation Roadmap

The following roadmap is calibrated for a 10–200 person organization beginning from a low AI governance baseline — a common starting point for SMBs based on Zavodna, Überwimmer, and Frankus's (2024) finding that knowledge gaps and resource limitations are the most significant barriers to AI governance implementation in small organizations.

Phase 1: Foundation (Weeks 1–4)

• Conduct gap analysis against ISO 42001 Clauses 4–10 and Annex A
• Define AIMS scope: which AI systems, which business functions, which organizational units
• Appoint AI Oversight Lead with documented authority and responsibilities
• Draft and sign AI Policy (Clause 5, Annex A.1)
• Complete shadow AI discovery to establish AI system inventory baseline (Clause 8, Annex A.4)

Deliverables: Gap analysis report; AIMS scope statement; signed AI Policy; preliminary AI system registry

Phase 2: Risk and Impact Assessment (Weeks 5–10)

• Complete AI system risk assessment for all in-scope systems (Clause 6)
• Complete AI system impact assessments for systems with potential effects on individuals (Clause 6, Annex A.2)
• Develop Statement of Applicability (SoA) — document which Annex A controls apply, which are implemented, and rationale for any exclusions
• Complete vendor assessment for all third-party AI tools (Clause 8, Annex A.3)
• Establish AI literacy training program for all staff using AI tools (Clause 7)

Deliverables: Risk assessment documentation; impact assessments; SoA; vendor assessment records; training completion records

Phase 3: Controls Implementation (Weeks 11–18)

• Implement applicable Annex A controls based on SoA — prioritizing A.1, A.2, A.4, A.8, A.9
• Establish AI system monitoring cadence and operational controls (Annex A.8)
• Implement human oversight procedures for high-risk AI systems (Annex A.9)
• Develop AI-specific incident response procedures (Annex A.8)
• Establish documentation management system for AIMS records (Annex A.10)

Deliverables: Implemented controls with evidence; monitoring procedures; incident response plan; documentation management records

Phase 4: Internal Audit and Management Review (Weeks 19–22)

• Conduct internal audit against ISO 42001 requirements (Clause 9)
• Document findings; implement corrective actions for nonconformities (Clause 10)
• Conduct management review — assess AIMS performance, resource adequacy, and objective achievement (Clause 9)
• Prepare evidence package for Stage 1 certification audit

Deliverables: Internal audit report; corrective action records; management review minutes; evidence package

Phase 5: Certification Audit and Ongoing Maintenance

• Stage 1 documentation audit with selected certification body
• Address Stage 1 observations; prepare for Stage 2
• Stage 2 operational effectiveness audit
• Certificate of conformity issued (valid three years, with annual surveillance audits)

Ongoing: Monthly AIMS monitoring; quarterly management review; annual internal audit; annual surveillance audit with certification body

---

Common Pitfalls

The most consistent implementation failures in ISO management system certifications — documented across ISO 27001, ISO 9001, and now ISO 42001 — share common root causes, most of which trace back to the governance implementation barriers identified by Birkstedt et al. (2023) and Zavodna et al. (2024).

Pitfall	Why It Happens	How to Avoid It
Scope too broad	Organizations include every AI system in scope without prioritizing by risk	Define AIMS scope around the AI systems with highest business impact and risk; expand scope in subsequent certification cycles
Documentation without operation	Policies and procedures exist on paper but are not embedded in day-to-day work	Audit controls during implementation, not only before the Stage 2 audit; interview staff to confirm awareness and practice
Missing impact assessments	Organizations document AI system inventories but skip impact assessment for systems affecting individuals	Treat impact assessment as mandatory, not optional, for any AI system that influences decisions about people
Weak human oversight controls	Human oversight procedures exist in policy but are not operationally defined	Define specifically who reviews AI outputs, at what frequency, with what authority to override, and how reviews are documented
Leadership disengagement	Clause 5 is treated as an HR or IT responsibility rather than a leadership accountability	The AI Oversight Lead must have a direct reporting line to the CEO or COO; leadership engagement is auditor-verified
AI literacy as a checkbox	Training programs are created and completed but do not change behavior	Design literacy training around specific AI tools in use, specific risks relevant to each role, and specific AUP requirements — not generic AI content

The Birkstedt et al. (2023) finding that organizations consistently fail to bridge the gap between stated AI principles and operational governance processes is the single most important warning for ISO 42001 implementers: the standard cannot be satisfied with documentation alone. Auditors evaluate operational effectiveness — they look for evidence that controls actually operate, not just that they are written down.

---

How RAIC Accelerates ISO 42001 Alignment

RAIC (AI Risk & Integrity Cloud) by Rhindon Cyber was designed to produce the documentation, evidence, and operational controls that ISO 42001 requires — starting from the AI system discovery that makes a credible AIMS possible.

Clause 6 + Annex A.4: AI System Registry as AIMS Foundation

RAIC's browser extension agent automatically populates the AI System Registry — the operational core of ISO 42001's planning and operation requirements. The registry documents every AI system in scope with purpose, data classification, risk level, vendor information, and oversight requirements. This artifact directly satisfies the AI system inventory requirements of Clause 6 and Annex A.4, and forms the basis of the Statement of Applicability.

Clause 6 + Annex A.2: Risk Assessment and Impact Assessment

RAIC's governance assessment applies the NIST AI RMF trustworthy AI characteristics and ISO 42001 control categories as evaluation dimensions across the AI System Registry, producing a risk assessment for each system and an impact assessment flag for systems affecting individuals. These assessments are exportable as ISO 42001-aligned documentation — ready for internal audit and Stage 1 review.

Clause 7: AI Literacy Evidence

RAIC documents AI tool usage across the organization through its monitoring agent, providing evidence that staff are using specific AI systems — the baseline evidence that the Clause 7 competence and awareness requirements are operationally relevant. The governance dashboard tracks which systems each team uses, enabling role-specific literacy program design.

Clauses 8 + 9: Operational Controls and Performance Evidence

RAIC provides continuous monitoring of the AI environment — detecting new tools, flagging data exposure events, and maintaining an audit log of shadow AI detection and governance response. This monitoring cadence produces the operational evidence that Clause 8 and Clause 9 require: demonstrating that the AIMS is not only designed but actually running.

ISO 42001 + NIST + EU AI Act: Unified Compliance Reporting

RAIC generates compliance reports mapped simultaneously to ISO 42001, NIST AI RMF 1.0, and the EU AI Act — enabling a single governance program to satisfy all three stakeholder requirements. For SMBs pursuing ISO 42001 certification, RAIC's reports provide the evidence package for Stage 1 documentation review and the operational evidence for Stage 2.

---

Request a free RAIC ISO 42001 readiness assessment at raic.rhindoncyber.com. Receive a gap analysis against all ISO 42001 clauses and Annex A controls in under 30 minutes.

---

References

Birkstedt, T., Minkkinen, M., Tandon, A., & Mäntymäki, M. (2023). AI governance: Themes, knowledge gaps and future agendas. Internet Research, 33(7), 133–167. doi.org/10.1108/INTR-01-2022-0042

Biroğul, S., Şahin, Ö., & Əsgərli, H. (2025). Exploring the impact of ISO/IEC 42001:2023 AI management standard on organizational practices. Advances in Artificial Intelligence Research, 5(1), 14–22. doi.org/10.54569/aair.1709628

European Parliament & Council of the European Union. (2024, July 12). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union. eur-lex.europa.eu/eli/reg/2024/1689/oj

International Organization for Standardization. (2023). ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system. ISO. iso.org/standard/81230.html

Mazzinghy, A. O. C., Silva, R. M. S., Fernandes, R. M., Batista, E. D., Picanço, A. R. S., Monteiro, N. J., de Amorim, D. M., Cardoso, B. F. O., Silva, J. M. N., & Martins, V. W. B. (2025). Assessment of the benefits of the ISO/IEC 42001 AI management system: Insights from selected Brazilian logistics experts. Standards, 5(2). doi.org/10.3390/standards5020010

National Institute of Standards and Technology. (2023, January 26). Artificial intelligence risk management framework (AI RMF 1.0) (NIST AI 100-1). U.S. Department of Commerce. doi.org/10.6028/NIST.AI.100-1

Papagiannidis, E., Mikalef, P., & Conboy, K. (2024). Responsible artificial intelligence governance: A review and research framework. Journal of Strategic Information Systems, 34(2), Article 101885. doi.org/10.1016/j.jsis.2024.101885

Sebastião, S. P., & Dias, D. F. (2025). AI transparency: A conceptual, normative, and practical frame analysis. Media and Communication, 13, Article 9419. doi.org/10.17645/mac.9419

Wirtz, B. W., Weyerer, J. C., & Kehl, I. (2022). Governance of artificial intelligence: A risk and guideline-based integrative framework. Government Information Quarterly, 39(4), 101685. doi.org/10.1016/j.giq.2022.101685

Zavodna, L. S., Überwimmer, M., & Frankus, E. (2024). Barriers to the implementation of artificial intelligence in small and medium-sized enterprises: Pilot study. Journal of Economics and Management, 46(1), 331–352. doi.org/10.22367/jem.2024.46.13

---

This article was written by David Mosher, CEO of Rhindon Cyber and publisher of the Pragmatic Cybersecurity newsletter. Rhindon Cyber builds AI governance and risk management tools for SMBs and managed service providers. RAIC is available at raic.rhindoncyber.com.