ISO/IEC 42001
Voluntary. ISO standards are not legislation, and the standard does not regulate admission to practice. Certification is a choice unless a contract or regulator mandates it.
The 2023 standard for an artificial intelligence management system. It governs how AI is managed. It does not test whether a legal answer is right.
MaintainedLast reviewed
Key facts
- Issued by
- ISO and the International Electrotechnical Commission
- Sources listed
- 1
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
ISO/IEC 42001:2023 is titled Information technology — Artificial intelligence — Management system. ISO’s page says it specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. It is for organisations that provide or use AI-based products or services.
ISO describes an AI management system as interrelated elements for setting policies and objectives, and processes to achieve them, for the responsible development, provision or use of AI systems. ISO says the standard uses the plan-do-check-act method, and that it manages AI-related risks and opportunities across the organisation rather than the detail of one application. It was published in December 2023. The page says it is the first AI management-system standard.
Who it applies to
ISO says it is for organisations of any size that develop, provide or use AI-based products or services, in any industry, including public bodies and non-profits. A law firm that uses an AI tool can fall inside that description. Certification is a choice. The standard does not regulate admission to practice.
What it asks of a law firm using AI
- This page uses ISO’s public description. It does not copy the standard, which ISO sells.
- A certificate, if one exists, should name ISO/IEC 42001:2023, the organisation, the scope, the certification body and the expiry.
- ISO’s own description separates this standard from a test of a particular model. Do not read a 42001 certificate as evidence that the tool does not hallucinate, or that citations are real.
- ISO says the standard supports compliance with legal requirements. Support is not compliance. The Privacy Act, the conduct rules and any court note still have to be met on their own terms.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | ISO lists cost savings and efficiency among the benefits of using the standard. That is ISO’s claim about a management system. It is not a measured saving on a legal task. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | The standard is about responsible development, provision and use, and about risk treatment. It is not a measure of whether the output is good enough for a matter. This framework’s effectiveness question is untouched by the badge. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | A 42001 certificate is evidence that a named organisation ran an AI management system in a stated scope. Ask what that scope covers. Absence of a certificate is not, by itself, a reason to refuse a tool. Presence is not a reason to skip the reading. |
| Confidentiality Whether client and other confidential information can go into the tool. | Not set here. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | ISO’s public page mentions transparency as a theme of the standard. It does not set a client-disclosure rule for Australian solicitors. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | Record ISO/IEC 42001 only when a source names it. Do not fold it into the ISO 27001 field. They certify different systems. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | Not set here. |
Sources
Checked 2026-10-10. Issued by ISO and the International Electrotechnical Commission.