ISO 42001 Competence Requirements: The Essential 2026 Training Guide

The ISO 42001 competence requirements are short on paper and heavy in practice. Clause 7 says people doing AI work must be competent, and then auditors check whether that is true for the developers, reviewers and managers sitting in front of them.

Most organizations answer with a training slide deck and an attendance sheet. That is a start, but competence means being able to do the job, and the evidence has to show it.

This guide explains clauses 7.2 and 7.3, shows a skills matrix by role and lists the records auditors ask for. For the wider clause, read our clause 7 support guide.

What the ISO 42001 competence requirements say

Clause 7.2 requires the organization to determine the necessary competence of people doing work that affects AI performance, to ensure they are competent on the basis of education, training or experience, and to take actions to acquire competence where needed.

You must evaluate whether those actions were effective, and keep appropriate documented information as evidence of competence. Actions can include training, mentoring, reassigning people or hiring.

So the ISO 42001 competence requirements have three parts: define what is needed, make sure people have it and prove it with records.

The authoritative text is summarized at ISO/IEC 42001:2023.

Competence versus awareness

Competence is about doing the work well. Awareness, in clause 7.3, is about knowing the AI policy, how your own work contributes to the effectiveness of the system and the implications of not conforming.

Everyone in scope needs awareness. Only people whose work affects AI performance need defined competence. A salesperson needs awareness of the AI policy, while a machine learning engineer needs both.

Treat them as two layers: a short awareness programme for everyone and deeper role-based competence for specific roles.

Identify the roles that affect AI performance

List the roles that design, build, test, deploy, monitor and oversee AI systems. Include data engineers, model developers, product owners, reviewers, risk owners, privacy staff and the AI governance lead.

Add managers who decide on use cases and approve releases, and procurement staff who select AI suppliers. Their decisions shape risk even if they never touch a model.

This role list is the foundation of the skills matrix, so build it from your AI inventory and org chart rather than from memory. Our AI model inventory guide helps.

Build a skills matrix by role

For each role, define the competencies needed: technical skills, knowledge of the AI policy, risk and impact assessment methods, data protection basics and the controls they operate.

Then rate each person: meets, partly meets, does not meet. Do this with managers, not alone in compliance, because they know who can actually do what.

Where gaps exist, assign a development action with an owner and date. The matrix becomes your plan and your evidence at the same time.

Review the matrix at least yearly to keep the ISO 42001 competence requirements current.

Role	Core competence	Typical evidence
AI developer	Model development, testing, secure data handling	Training log, code review sign-off
Reviewer or approver	Risk and impact assessment methods	Assessment exercise, sample reviews
AI governance lead	ISO 42001 requirements, audit and regulation	Certificates, experience record
Product owner	Use case risk and policy	Policy training, decision records
All staff in scope	Awareness of policy and contribution	Awareness session attendance

What good training looks like

Effective training is specific to the role and the systems. A generic AI ethics course does not show that a reviewer knows how to complete an impact assessment.

Use short, practical sessions: walk through a real risk assessment, a real incident or a real impact assessment. Pair it with a short test or exercise so you can show the learning worked.

Refresh training when processes change and for new joiners. Annual refreshers are common, but tie them to real triggers too.

Evidence auditors expect

Keep training logs with date, topic, attendees and trainer, plus the skills matrix, job descriptions, certificates where relevant and records of competence assessments.

Also keep evidence of effectiveness, such as test results, observed work or manager sign-off. The standard asks you to evaluate effectiveness, so attendance alone may draw a comment.

Make the records easy to find. In an audit, the quickest way to look competent is to show a clean skills matrix and two or three worked examples. See our internal audit guide for how to test it first.

Document how you meet the ISO 42001 competence requirements for each role, not only in general.

Competence for AI governance roles

The people running the AI management system need their own competence: knowledge of ISO 42001, risk and impact assessment methods, audit techniques and regulation relevant to your sector.

Many organizations train their AI governance lead and internal auditors on the standard itself. Internal auditors in particular must be competent and impartial, so check their background.

Document these requirements in the job description or role profile so the link between role and competence is explicit.

Third parties and contractors

People who work for you under contract still affect AI performance. Include contractors and consultants in the competence assessment, or cover them through supplier requirements.

If an external team builds or operates your models, the contract should require suitable competence and the right to review evidence of it.

This is also where Annex A supplier controls and the competence clause meet, so keep both views consistent.

Linking training to risk and objectives

Training should address your real risks. If your risk register shows weak human oversight, run training on oversight. If an AI incident reveals a gap, add it to the programme.

You can also set an objective for competence, such as completing role-based training for all AI developers each year. See our guide to ISO 42001 AI objectives.

This keeps the ISO 42001 competence requirements connected to the rest of the system instead of living in a separate HR process.

Common findings on competence

Frequent findings include no defined competence for key roles, training records that do not match the people in scope and no evaluation of effectiveness.

Another is relying on experience claims with no evidence, such as a verbal statement that someone has done this for years. Keep a short note, a CV or a reference.

Finally, new joiners and contractors are often missed. Build competence checks into onboarding.

A practical plan for your first year

Quarter one: list the roles, build the matrix and run an awareness session for everyone. Quarter two: deliver role-based training for developers and reviewers. Quarter three: assess effectiveness and close gaps.

Quarter four: refresh, feed results into the management review and update the matrix for the coming year. Keep every step documented.

Our toolkit includes a competence matrix template, so the ISO 42001 Toolkit gives you a starting point to adapt.

Awareness: what everyone in scope should know

Run a short session covering the AI policy, the objectives that matter to each team, how to report an AI concern and what happens if the rules are not followed. Keep it to thirty minutes with a few real examples.

Record attendance and a simple check of understanding, such as a three-question quiz. Add awareness to onboarding so new joiners are covered from the first week.

Awareness also links to Annex A.3, where staff need a way to report concerns about AI systems. Our ISO 42001 controls guide explains the area.

Repeat the message through newsletters and team meetings. Awareness fades quickly if it only happens once.

Connecting competence to your risk work

Competence gaps are risks. If few people can run an impact assessment, that is a risk to quality and speed. Record such gaps in your AI risk assessment and plan treatment.

Competence also changes the controls you choose. A team new to AI may need stronger review gates, while an experienced team can run lighter processes.

This honest linkage is what makes the system credible, and it satisfies the clause without turning training into a paper exercise.

Making competence checks routine

Build competence checks into hiring, role changes and annual reviews. Add a line to your onboarding checklist for AI roles, and ask managers to confirm skills when approving access to production AI systems.

Revisit the matrix when you add a new type of system. A team that moves from classic machine learning to generative AI may need new skills in prompt safety, evaluation and content risk.

Done regularly, the ISO 42001 competence requirements become part of how the organization works, and the audit evidence appears as a by-product.

ISO 42001 competence requirements FAQ

Do all staff need ISO 42001 training?

All staff in scope need awareness of the policy and their role. Deeper competence is required only for roles that affect AI performance.

Do we need formal certifications?

No. The standard accepts education, training or experience. Certificates help as evidence but are not mandatory.

How do we prove effectiveness of training?

Use tests, observed work, reviews of outputs or manager sign-off, and keep the records. Attendance alone is weak evidence.

How often should we refresh training?

At planned intervals, often annually, and whenever processes, systems or risks change materially.