On this page
- Choose the correct published document
- Scope: the organisation’s AI management system
- Separate the supplier’s deliverables
- Example: introducing an AI assistant for customer support
- Plan the wider evidence library
- Questions before ordering
- Primary sources and edition check
- Explore more standards buying guides
The verified European product is EN ISO/IEC 42001:2026, adopting ISO/IEC 42001:2023. Genorma identifies it as published, and ISO confirms the international first edition. The two dates describe the adoption relationship; they should not be presented as two different ISO revisions. European adoption record; ISO publication.
Choose the correct published document
Scope: the organisation’s AI management system
The published scope sets requirements and provides guidance for an AI management system used by organisations providing or using AI-based products or services. ISO distinguishes that organisational framework from the details of particular AI applications. European scope; ISO management-system explanation.
Start the procurement brief with an inventory of intended uses and the organisation’s role in each. A company building an AI service, a business configuring an external service and a department using an AI tool may need different evidence and responsibilities. Ask a provider to explain which of those activities its offer reaches instead of accepting an undifferentiated “AI compliance package”.
Separate the supplier’s deliverables
| Proposed deliverable | Question that makes the offer clearer |
|---|---|
| AI tool or platform | What capability is supplied, and who controls its use in the organisation? |
| Application evaluation | Which use case, data and version does the evaluation address? |
| Management-system project | Which organisational decisions, roles and records will be included? |
| Staff training | Which users and approvers need guidance tied to their actual responsibilities? |
| Independent assessment | What exact system scope and publication basis will be assessed? |
Ask what the provider needs from the organisation before it can complete its work. If the offer assumes a finished inventory of AI uses but none exists, identify the discovery task separately. Similarly, a generic policy may be only a starting point if purchasing and technical teams can introduce new services without a shared decision process.
Example: introducing an AI assistant for customer support
Imagine a company selecting an AI assistant for support staff. One vendor offers a working demonstration and user training. A second service provider offers an organisational management-system project. Those offers should not be compared as if they deliver the same result.
The buyer could describe the proposed use, the people who approve it and the information it will handle. It could ask how a change in the service, its configuration or its intended use will reach the decision-makers. Who owns the use-case description? Who reviews feedback? Who can limit or stop the use while an issue is investigated? These questions help specify the governance work without claiming that a demonstration proves suitability for every future use.
Plan the wider evidence library
Information security and privacy are related but distinct objectives. See EN ISO/IEC 27001 for an ISMS and EN ISO/IEC 27701 for a PIMS. General quality management is addressed by EN ISO 9001. Decide whether integration helps the organisation; this list is not a claim that every AI system automatically needs each publication.
Keep a specific application’s technical evaluation separate from the organisational assessment. Ask a provider which claims its evidence supports and which decisions remain outside the engagement. Do the same for any regulatory or contractual analysis: require a clearly identified basis rather than treating a management-system document as a universal legal conclusion.
- Match the exact EN 2026 reference to the European product when the order requires that adoption.
- Record the ISO 2023 relationship so training and contracts use unambiguous terminology.
- Separate platform supply, implementation support and any assessment charges.
- Check access for the people responsible for the organisational programme, not only technical developers.
Questions before ordering
Is the European 2026 document a new ISO 2026 revision?
Genorma explicitly identifies it as adopting ISO/IEC 42001:2023. Preserve that distinction in the document register and ask the seller about the requested language or national publication.
Does this test or certify an individual AI model?
The publication’s subject is an organisational management system. If the purchase requires evaluation of a particular model or application, specify that technical task and its evidence separately.
Is it only useful to AI developers?
The published scope includes organisations providing or using AI products or services. Decide from the organisation’s role and the intended project boundary. Provider and user scope.
Primary sources and edition check
- Genorma: published European 2026 adoption and ISO relationship
- ISO: published ISO/IEC 42001:2023 and management-system scope
Publication and purchase records checked on 7 October 2026. The examples and procurement questions are original guidance. Detailed implementation requires the applicable licensed text and decisions for the actual project.
Explore more standards buying guides
Browse standards by reference and subject to compare related document choices.