What is ISO/IEC 42001 and how do you get certified in South Africa?
ISO/IEC 42001:2023 is the international standard for an AI management system: the policies, roles, risk processes and controls an organisation uses to govern AI. Certification to it is issued by certification bodies accredited for that standard, in South Africa through SANAS. It certifies that the management system exists and works, which is different from AIC, which certifies that a named person stays accountable for specific automated decisions.
What ISO/IEC 42001 is
Published in 2023, ISO/IEC 42001 sets out requirements for an artificial intelligence management system. Like ISO 27001 for information security, it is about the system an organisation runs: leadership commitment, an AI policy, defined roles, risk and impact assessment, controls (in its Annex A), monitoring, internal audit and continual improvement.
How certification works
Certification to ISO/IEC 42001 is done by a certification body accredited to audit that standard. In South Africa, accreditation is the work of SANAS, the South African National Accreditation System. Before you appoint a certification body, ask to see that ISO/IEC 42001 is within its accredited scope; a certificate from a body that is not accredited for the standard carries far less weight.
How it differs from AIC
- ISO/IEC 42001 certifies a management system across the organisation. AIC certifies something narrower and sharper: that for each consequential AI system, a named person remains accountable for its decisions.
- ISO/IEC 42001 is largely about having the right processes. The AIC standard tests outcomes too: that overrides happen, that reasons match the real drivers of decisions, and that affected people can contest a decision and get an answer.
- AIC is not an ISO/IEC 42001 certification body and does not issue ISO certificates. Its standard maps to ISO/IEC 42001, so evidence gathered for one helps with the other.
AIC is itself not yet accredited. Its accreditation status and roadmap are published on the disclosures page.
Which do you need?
Organisations that need to show a mature, organisation-wide AI governance system to customers or regulators abroad often want ISO/IEC 42001. Organisations whose exposure is in specific decisions about people, such as credit, claims, hiring and pricing, need to show accountability for those decisions, which is what POPIA section 71 and the AIC standard address. Many will want both, built on one set of evidence.
Questions people also ask
Is ISO 42001 certification mandatory in South Africa?
No. It is voluntary, though customers, partners and regulators may ask for it.
Does AIC issue ISO 42001 certificates?
No. AIC certifies against its own published standard, which maps to ISO/IEC 42001. ISO certificates come from certification bodies accredited for that standard.
Sources
- ISO/IEC 42001:2023, AI management systems
- SANAS, the South African National Accreditation System
- The AIC standard, published in full
This guide explains the law and standards in general terms. It is not legal advice about your organisation. AI Integrity Certification is a certification body and does not consult on the systems it certifies.
Check your own organisation
AIC Aware is a free self-assessment against the AIC standard. It takes about ten minutes and shows where accountability for automated decisions is missing.