ISO 42001 Is Becoming the De Facto AI Governance Standard — But Few Companies Are Actually Certified

ISO/IEC 42001, the first international standard for AI management systems (AIMS), was published back in December 2023, but as of 2026 the list of organizations actually certified against it stays short — notable names include Microsoft, AWS, and Anthropic. The standard sets out a structured, auditable way to govern AI risk across its full lifecycle, similar in spirit to how ISO 27001 does for information security — except certification against 42001 remains voluntary, and it isn't yet recognized by the EU as a harmonized standard that automatically confers conformity with the AI Act.

The reasons adoption is slow are strikingly mundane: there simply aren't enough qualified auditors who understand both AI systems and ISO-style management-system governance; AI systems themselves change faster than a management system's documentation can keep up; and the initial gap assessment, training, and certification fees add up fast for organizations without existing ISO infrastructure. Meanwhile, the EU AI Act's high-risk requirements are phasing in through 2027-2028, and companies working with the European market will need to build a similar governance structure regardless of whether they hold an ISO 42001 certificate.

For our clients, this is exactly where COBIT-based IT audits and AI governance overlap: COBIT's domains are about who's accountable and how you verify it — the same layer ISO 42001 is built on. Which means a company that's already been through a proper COBIT audit is usually much closer to 42001 readiness than it looks at first glance.