ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The question ISO 42001 vs ISO 23894 comes up whenever a team starts AI governance, and the short answer is that they are not alternatives. ISO 42001 is a certifiable AI management system standard. ISO 23894 is guidance on managing AI risk.
Confusing them leads to two common errors: trying to certify against 23894, which is impossible, or building an AI management system with no usable risk method.
This guide explains what each standard is, where they overlap and how to use them together. For the certifiable standard, see the ISO 42001 requirements guide.
Free gap assessment
How much of ISO 42001 could you evidence today?
Score every clause and Annex A control of the AI management standard, free, and see where the programme really sits.
Run the free ISO 42001 gap assessment → or View premium report sample
ISO/IEC 42001:2023 was published in December 2023 and specifies requirements for an AI management system. It follows the management system structure of clauses 4 to 10 and adds an Annex A of controls specific to AI.
It is certifiable. An accredited certification body audits you against the requirements and issues a certificate, which is why customers ask for it.
The standard tells you that you must assess AI risk and impact, but it leaves the detailed method to you. That is where ISO 23894 helps.
When people ask about ISO 42001 vs ISO 23894 they usually want to know which one to buy first, and the answer depends on whether certification is the goal.
ISO/IEC 23894:2023 was published on 6 February 2023 as guidance on risk management for organizations that develop, produce, deploy or use AI. It is a guidance document, not a management system standard.
It adapts the structure of ISO 31000, with principles, framework and process, and adds AI-specific considerations. It uses the language of recommendation, so there is nothing to certify against.
Think of it as a reference book for your AI risk method. It tells you how to think about risk sources, consequences and treatment in AI settings.
The official description is on the ISO site: ISO/IEC 23894:2023 on iso.org.
ISO 42001 tells you what the management system must contain and lets an auditor check it. ISO 23894 tells you how to approach AI risk, and nobody audits against it.
You can implement 42001 without reading 23894, but you may end up with a thinner risk method. You can read 23894 without 42001, but you will have a method without an enforceable system around it.
Most organizations that care about certification use both, with 23894 informing the risk process that 42001 requires.
In short, the ISO 42001 vs ISO 23894 question is about requirements versus guidance.
| Point | ISO 42001 | ISO 23894 |
|---|---|---|
| Type | Management system standard | Risk management guidance |
| Published | December 2023 | 6 February 2023 |
| Certifiable | Yes, by accredited bodies | No |
| Core content | Clauses 4-10 and Annex A controls | Principles, framework and process for AI risk |
| Best use | Build and certify a system | Design the risk method |
Both address risk identification, analysis, evaluation and treatment. Both expect communication with stakeholders and ongoing monitoring and review.
Both also assume risk is tied to context: your objectives, your systems and the people affected. ISO 42001 requires that link through clauses 4 and 6. ISO 23894 builds it into its framework.
The overlap is helpful. If you follow 23894 for your method, the records it produces fit directly into the ISO 42001 risk assessment and treatment documents.
Free AI risk assessment
Which of your AI systems could harm people, or you?
List your AI systems, models and data, pick from 38 AI risk scenarios, rate them for the people affected and for you, and plan treatment with ISO 42001 Annex A controls. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free AI risk assessment → or View premium report sample
This shared logic explains why teams often discuss ISO 42001 vs ISO 23894 as if one replaces the other, when in fact they cooperate.
ISO 42001 adds the management system: policy, roles, objectives, competence, internal audit, management review and corrective action, plus the impact assessment requirement and Annex A controls.
ISO 23894 adds depth on AI risk: sources of risk across the life cycle, examples of consequences and guidance on applying the risk process to AI. It also links to ISO 31000 concepts that many risk teams already know.
Using both gives you structure and substance. Using one alone leaves a gap.
Our toolkit gives you a risk method and register ready to adapt, so the ISO 42001 Toolkit covers the practical side.
Use 23894 to design your risk assessment method: risk criteria, risk sources, scales and treatment options. Then document the method as the process required by clause 6.1.2.
Apply it in your assessments and record the results in your risk register. Our AI risk assessment guide shows the format, and the AI risk register guide gives an example.
Treat 23894 as input to your system, not an audit criterion. Auditors will test your process against ISO 42001, but a method grounded in 23894 is easier to defend.
Record which parts of 23894 you used, so a reviewer can see the link between guidance and method.
ISO 42001 requires both an AI risk assessment and an AI system impact assessment. Risk looks at what could affect your objectives. Impact assessment looks at the consequences for individuals, groups and society.
ISO 23894 covers risk. For impact assessment, ISO/IEC 42005:2025, published in May 2025, gives guidance. Together they support the two assessments ISO 42001 requires. See our ISO 42001 impact assessment guide.
Do not merge the two into one form without keeping both lenses visible, or an auditor may find one missing.
ISO 31000 is the general risk management standard that ISO 23894 builds on. If your organization already uses it for enterprise risk, you can extend that process for AI using 23894.
This continuity helps adoption. Risk teams do not have to learn a new language, and AI risks can sit in the same register as other enterprise risks.
Our guide to the ISO 31000 vs ISO 27005 comparison shows how related risk standards fit together.
If you plan to certify, start with ISO 42001 and use ISO 23894 as a method reference. If you only need a risk approach for internal purposes, 23894 may be enough for now.
If you are small and short of time, a simple risk method that meets clause 6.1.2 is enough. You can deepen it with 23894 as you mature.
Whichever you start with, keep your records ready for the other. They fit together naturally.
The ISO 42001 vs ISO 23894 decision depends on whether you need a certificate.
Mistakes include claiming ISO 23894 certification, which does not exist, and writing a risk method that ignores AI-specific risk sources. Another is skipping impact assessment because the risk assessment seems thorough.
A third is buying guidance documents and treating them as policy. Standards need translating into your own procedures and records.
Finally, do not copy examples without adapting them. Your systems and context decide which risks matter.
Keep an eye on new ISO publications too, because the AI standards family keeps growing and your references should stay current.
Step one: decide your scope and inventory your AI systems. Step two: design your risk method using 23894 and ISO 31000 concepts. Step three: write the ISO 42001 documents around it.
Step four: run assessments, select controls and complete the Statement of Applicability. Step five: audit, review and certify.
Our implementation guide walks through each step, with the risk method in step three.
Auditors do not ask for ISO 23894 compliance. They ask whether your risk process meets clause 6.1.2 and whether you can show it operating. A method rooted in 23894 simply helps you explain your choices.
Be ready to show risk criteria, the risk assessment steps, the results and the treatment decisions. Keep the link between each risk and the Annex A controls in your Statement of Applicability.
If an auditor questions a risk rating, a documented rationale that references recognised guidance will carry more weight than a bare score.
This is the practical value of the ISO 42001 vs ISO 23894 combination: one gives you the auditable system, the other the reasoning behind your numbers.
Do we need a certificate, or only a risk method? Who will use the document, and how? Do we already use ISO 31000 or another risk framework?
Does a customer or regulator name a standard? If so, align to that first. If not, choose the one that meets your actual need.
Also check how the standards relate to regulation such as the EU AI Act. Our guide to ISO 42001 vs the EU AI Act explains how a management system supports legal compliance without replacing it.
No. ISO 42001 does not require you to follow ISO 23894, but it is useful guidance for your risk method.
No. It is a guidance document, so there is no certification.
Auditors assess against ISO 42001. They may accept a method based on 23894 if it meets the clause requirements.
Not required, but ISO 23894 builds on it, so familiarity helps.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026