ISO published a certifiable management standard for AI governance

The design

In December 2023, the International Organization for Standardization and the International Electrotechnical Commission published ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system. Its catalogue page describes it as the organizations' first AI management-system standard, drafted by ISO/IEC JTC 1/SC 42, the joint technical subcommittee the two bodies created in 2017 specifically for AI standardization, according to that committee's own page. Unlike a technical standard for a specific AI application, 42001 sets requirements for how an organization governs AI development, provision, or use through policies, objectives, and a plan-do-check-act management cycle, the same structure ISO uses for its information-security standard, 27001.

What the evidence says

Both ISO's own pages are consistent on what the standard is and is not: a management-system standard specifies organizational process requirements, not technical requirements for a specific AI model's outputs. ISO's catalogue page states the standard "specifies the requirements" for establishing, implementing, and improving an AI management system "within the context of an organization," language about governance process rather than about any product's accuracy, safety, or fairness. The full 51-page text itself is sold rather than published free, so this entry could confirm the standard's scope and structure from ISO's own summaries but could not verify how any specific clause is worded.

What it asks of people

ISO/IEC 42001 asks something of an organization that chooses to seek certification against it: documented policies, defined objectives, and evidence of a functioning management cycle that a third-party certification body can audit. It asks nothing of a companion-app user directly, and certification under 42001 does not by itself tell a user anything about whether a specific chatbot's replies are safe, private, or accurate — only that the company's internal governance process around AI met an auditor's checklist for having such a process at all.

Privacy and safeguards

Nothing in the material available here shows 42001 setting a specific data-retention limit, disclosure requirement, or age-assurance measure; as a management-system standard it asks an organization to have processes addressing such risks, not to meet any single named privacy rule. Certification is voluntary and creates a legal obligation only where a contract, a customer requirement, or a regulator separately makes it one; no evidence here indicates any named AI companion maker holds or has sought 42001 certification.

• Has a specific companion-app company announced ISO/IEC 42001 certification, and if so, for which part of its business?
• Does a certification claim describe what an auditor actually checked, or only that a certificate was issued?
• Would 42001 certification tell a user anything about a chatbot's actual answers, or only about the company's internal paperwork around them?

ISO/IEC 42001 gives companies a recognizable, auditable governance label for AI, the same function 27001 serves for information security, but the label describes a management process, not a guarantee about how any particular companion product behaves toward the people who use it.