ISO/IEC 42001: the AI management system, honestly scoped
What a voluntary cert proves and what it does not — and why the line matters.
ISO/IEC 42001 is a certifiable AI management system standard. It proves you have a system. It does not prove the system is correct, calibrated, or that its outputs are true. The line between those two is the line an honest scope statement draws.
ISO/IEC 42001 is the international standard for AI management systems, published in late 2023. It is certifiable — an accredited registrar can issue a certificate stating that an organization has an AI management system meeting the standard. That certificate is voluntary. It is not a statute, not supervisory guidance, and it does not, by itself, satisfy any binding legal obligation. What it proves is that the organization has a management system for AI: a policy, roles, risk treatment, controls, internal audit, management review. What it does not prove is that any AI output the organization produces is correct, calibrated, or true. Conflating those two is the most common 42001 mistake, and the one that loses an examiner.
We are pre-revenue and building the POC. This post scopes 42001 honestly against the manifest (BR-842) we are building, and names the voluntary tier throughout. The manifest is built for the binding tier first; 42001 is a management-system posture on top.
What a management system cert actually attests
A management system standard attests that a system exists and operates. ISO 9001 attests a quality management system; ISO 27001 an information security management system; ISO/IEC 42001 an AI management system. In each case the cert is about the system, not about the product. A firm can be ISO 9001 certified and still ship a defective product; a firm can be ISO/IEC 42001 certified and still produce an uncalibrated forecast. The cert says "there is a system that governs this," not "the output is right." An examiner who understands this reads the cert as evidence of governance maturity; an examiner who does not, reads it as a claim of correctness — and the firm that lets that misreading stand has oversold the cert.
Where the manifest sits relative to the cert
The per-output manifest is the substrate the management system governs. 42001 asks for AI risk policy, objectives, risk treatment, controls; the manifest is the record that makes each of those concrete. Risk treatment for a specific output is the AxisOverride; controls are the hash chain (BR-842) that makes provenance non-repudiable; internal audit reads the manifest, not a slide deck; management review reads the calibration loop (Brier, log-loss, deino-eval, Gate 1b). The cert is the posture; the manifest is the evidence the posture operates on. A firm that has the cert and the manifest has a system that produces evidence; a firm that has only the cert has a system that produces claims.
A management system cert attests that a system exists. It does not attest that the output is right. The line between those two is the line an honest scope statement draws.
- 42001 is certifiable and voluntary — it attests a management system, not a correct output.
- The manifest is the substrate the system governs: hash chain for controls, AxisOverride for risk treatment, calibration for review.
- A firm with the cert and the manifest has a system that produces evidence; with only the cert, a system that produces claims.
- The cert is the posture; the manifest is the record the posture operates on.
What 42001 does not replace
A 42001 certificate does not satisfy the EU AI Act, GDPR Art. 22, SR 11-7, or a fundamental-rights impact assessment. It is a management-system posture, not a compliance deliverable. A firm that certifies to 42001 and skips the FRIA has a system for governing AI and a gap in binding compliance. The honest scope statement names the cert as voluntary, names what it covers (the management system), and names what it does not cover (every binding obligation). The examiner who reads that scope statement trusts the rest; the examiner who reads an oversold scope statement discounts everything.
The cert is the posture, not the proof. A management system that produces evidence is worth more than a cert that produces claims — and the manifest is what turns one into the other.
— ISO/IEC 42001 scoping note
The honest scope
We do not claim the manifest makes a firm 42001-certified; certification is a registrar decision, not a substrate property. We claim the manifest provides the record that makes a management system evidentiary rather than aspirational. Calibration is gated (Gate 1b); the manifest attests provenance and reproducibility, never truth. The voluntary cert, honestly scoped, is a credit to the firm and a convenience to the examiner — and only when the scope line is drawn where it actually runs.