# ISO/IEC 42001:2023

> ISO/IEC 42001:2023 is the first certifiable management-system standard for artificial intelligence — the AI counterpart to ISO 27001. It asks an organisation to run AI risk as a managed, auditable process, and Provael slots in as an operational control: adversarial red-teaming with a documented, repeatable measurement.

Regulation/standard: ISO/IEC 42001:2023
Timing: Published December 2023 — the first certifiable AI management-system standard.

## What it is

- ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS).
- Its Annex A lists operational controls; red-teaming and adversarial testing sit naturally among them as an evidence-producing control.
- It is certifiable by accredited bodies, so enterprise buyers increasingly ask suppliers to hold it or work toward it.
- Related AI standards: ISO/IEC 23894:2023 (AI risk management) and ISO/IEC TR 5469:2024 (AI functional safety); Provael produces evidence that feeds these processes rather than implementing them.

## Where a red-team result fits

- **Annex A · operational control** — Red-teaming as an operational control — a documented, repeatable adversarial test with a measured result and a retained trace is exactly the control evidence an AIMS audit looks for.

## What Provael maps to it

- A repeatable adversarial-robustness measurement you can register as an operational control in your AIMS.
- Retained traces and a one-page scorecard that serve as control evidence during a 42001 audit.
- A CI red-team gate that turns the control from a point-in-time test into a continuously monitored one.

## Dates (verified 6 Jul 2026)

- Published: December 2023

## Sources

- ISO/IEC 42001:2023 (ISO): https://www.iso.org/standard/81230.html
- ISO/IEC 23894:2023 (ISO): https://www.iso.org/standard/77304.html

Canonical: https://www.provael.com/compliance/iso-42001

---
Provael · Prove it. Prevail. · Apache-2.0 · https://github.com/provael/provael
Not legal advice; verify regulatory dates against the primary source.