ISO 42001 and Your AI Strategy: What Quality Managers Need to Know

Blog
infoforeast

ISO 42001 and Your AI Strategy: What Quality Managers Need to Know

A new standard just dropped. ISO/IEC 42001:2025 — the AI Management System Standard. And if you’re a quality manager in any organization touching AI, this one’s coming for you.

I’ll be honest: when I first heard about ISO 42001, I rolled my eyes. Another standard. Another framework. Another set of documentation requirements for things we’re already doing (or should be doing).

Then I read it. And I changed my mind.

Why ISO 42001 Matters Now

ISO/IEC 42001 is the world’s first management system standard for artificial intelligence. It provides a framework for establishing, implementing, maintaining, and continually improving an AI Management System (AIMS) within an organization.

If that sounds like ISO 9001 for AI — that’s because it is. Same Plan-Do-Check-Act structure. Same management system approach. Same emphasis on risk-based thinking, leadership commitment, and continual improvement.

But here’s why it matters specifically to quality managers:

At ArcelorMittal, we deployed AI for predictive maintenance on our rolling mills. It worked — reducing unplanned downtime by 34%. But nobody asked about governance. Nobody asked about risk assessment. Nobody asked about data quality, model validation, or performance monitoring. The AI worked, so we moved on.

That’s exactly the gap ISO 42001 fills. And it’s exactly the gap that will get organizations in trouble.

The EU AI Act Changed Everything

The EU AI Act came into full enforcement in 2026, and it classifies AI systems by risk level — from minimal to unacceptable. High-risk AI systems (which include many manufacturing quality applications) require:

  • Risk management systems
  • Data governance and quality
  • Technical documentation
  • Record-keeping and transparency
  • Human oversight
  • Accuracy, robustness, and cybersecurity

If you’re thinking “these look like ISO 9001 requirements adapted for AI” — you’re right. And if you already have ISO 9001, you have a head start on ISO 42001 implementation. But only a head start.

The quality manager who understands both standards is going to be the most valuable person in their organization over the next three years. I’m not exaggerating.

What ISO 42001 Actually Requires

Let me break down the key clauses and what they mean for quality managers:

Clause 4: Context of the Organization

You need to understand how AI is used in your organization — not just the AI you deployed intentionally, but the AI embedded in your tools, your ERP, your analytics platforms.

At Norgren, we discovered that 11 of our software tools had embedded AI capabilities that nobody had documented. Our “AI inventory” took three months to complete. It found predictive analytics in our ERP, anomaly detection in our MES, and automated decision-making in our logistics platform.

If you don’t know where your AI is, you can’t manage it. ISO 42001 makes AI visibility a requirement, not an aspiration.

Clause 6: Planning

This is where risk assessment meets AI. You need to:

  • Identify AI-related risks and opportunities
  • Set AI quality objectives
  • Plan actions to address risks

At Airbus, our AI risk assessment identified that our automated inspection system had a 3.2% false-negative rate on composite material defects. That’s below the human inspector rate of 4.1%, so it passed our initial validation. But ISO 42001 asks a deeper question: what’s the impact of that 3.2% on flight safety?

The answer led us to implement a dual-inspection protocol — AI first pass, human verification of AI-flagged areas. Result: zero defects escaping to final assembly, with only a 12% increase in inspection time.

Clause 7: Support

Resources, competence, awareness, communication, documented information. Same as ISO 9001, but with an AI twist.

The competence requirement is the big one. Your team needs to understand AI — not at a data scientist level, but enough to evaluate AI outputs critically. I’ve trained quality teams at three companies on “AI literacy for quality professionals.” The modules that matter most:

  1. Understanding AI confidence scores and what they mean for decisions
  2. Recognizing bias in AI outputs (and why it’s a quality issue)
  3. Knowing when to trust AI and when to override it
  4. Validating AI performance against ground truth

    5. Clause 8: Operation

    This is operational control of your AI systems. It includes:

    • AI system development and deployment controls
    • Third-party AI system management
    • Data management for AI
    • Technical documentation

    At ArcelorMittal, we created an “AI system specification” for every AI tool — documenting its purpose, training data, performance metrics, limitations, and override procedures. It was 4 pages per system. With 11 systems, that was 44 pages of documentation. Tedious? Yes. Valuable during our ISO 42001 gap assessment? Absolutely.

    Clause 9: Performance Evaluation

    Monitoring, measurement, analysis, and evaluation. Internal audits. Management review.

    Here’s the critical insight: AI systems drift. A model that performed at 96% accuracy in January might degrade to 89% by July due to changes in input data. ISO 42001 requires ongoing performance monitoring — not just initial validation.

    We implemented monthly AI performance reviews at Airbus. Each AI system gets a one-page dashboard showing accuracy, precision, recall, false positive rate, and drift indicators. If any metric drops below threshold, it triggers an automatic review.

    Clause 10: Improvement

    Nonconformity and corrective action. Continual improvement.

    The interesting part: AI nonconformities are different from process nonconformities. If your welding robot produces a bad weld, you fix the robot. If your AI inspection system misses a defect, you might need to retrain the model, adjust the training data, or change the decision threshold. Corrective action for AI is a new skill set.

    The Quality Manager’s Advantage

    Here’s what I tell every quality manager who asks about ISO 42001: you already know 80% of what you need.

    • Management systems? You’ve been running one for years.
    • Risk-based thinking? That’s your bread and butter.
    • Internal audits? You could do them in your sleep.
    • Document control? You’ve been fighting that fight since your first job.
    • Corrective actions? You’ve closed more 8Ds than you can count.

    The 20% you need to learn is AI-specific: model validation, data governance, bias detection, drift monitoring. These are learnable skills. The management system expertise — that’s the hard part, and you already have it.

    Implementation Strategy

    For organizations already certified to ISO 9001, here’s the most efficient path:

    Step 1: AI Inventory (Month 1)

    Catalog every AI system in your organization. Include embedded AI in commercial software. Document purpose, owner, data sources, and criticality.

    Step 2: Gap Assessment (Month 2)

    Compare your current practices against ISO 42001 requirements. Most organizations find they’re already doing 60-70% of what’s required — they just haven’t formalized it for AI.

    Step 3: Integration (Months 3-4)

    Extend your existing management system to cover AI. Don’t build a separate system. Integrate AI controls into your existing procedures, forms, and reviews.

    Step 4: Pilot (Month 5)

    Run an internal audit against ISO 42001. Fix the gaps. Then run a management review specifically on AI management.

    Step 5: Certification (Month 6)

    If certification makes sense for your business (and for EU-operating manufacturers, it increasingly does), engage a certification body.

    The Bottom Line

    ISO 42001 isn’t just another standard. It’s the framework that will define how organizations govern AI for the next decade. Quality managers who understand it — who can bridge the gap between quality management and AI governance — will be indispensable.

    The question from the title isn’t rhetorical. You need to know this standard. Not because it’s mandatory (yet), but because your organization’s AI strategy will live or die by its governance framework.

    And who better to build that framework than the person who already knows how to run a management system?

    See Velin in Action

    Velin is an AI agent platform built on ISO management system principles — including ISO 42001 alignment. It demonstrates what well-governed AI looks like in practice: documented, monitored, auditable, and continuously improved.

    If you’re planning your ISO 42001 implementation — or just want to see what governed AI in quality management looks like — book a Velin demo.

    See how autonomous AI agents can transform your quality management while maintaining the governance and control your standards demand.

    Peter Stasko is a Quality Architect with 25+ years across ArcelorMittal, Norgren, and Airbus. Certified ISO 9001 Lead Auditor, Six Sigma Black Belt, and early adopter of ISO 42001 practices. He builds AI agents that quality managers can trust.

Related Posts

Scroll top