Published in 2023, the ISO 42001 standard ensures the security, reliability and ethics of AI used in organizations, through risk analyzes and audits.
The emergence of generative AI in business is giving cold sweats to many managers who fear exfiltration of sensitive data, prompt injection attacks and other cyber risks. And they are not at the end of their sentence. A more significant source of fear is emerging: that of AI agents capable of being diverted to execute powerful malicious commands such as unauthorized actions (triggering transfers, deleting accounts, etc.), or the propagation of attacks when they are connected to several tools.
To deal with this, more and more companies are seeking to comply with the only international AI management standard, the ISO 42001 standard, “even before the implementation of these agents”, says Eric Bohec, chief technology officer (CTO) group at Nomios. Published in 2023 by the International Organization for Standardization (ISO), “this standard will even become essential to support any launch of an AI project,” says Matthieu Guilpin, CISO of Jus Mundi, a company which offers an AI agent specialized in international law and which obtained ISO 42001 certification in 2025.
The 27001 of the AI
“Generative AI in business is a problem, but not that complicated to manage. The most complicated thing for organizations will be the adoption of small AI agents to execute business processes. These agents are very useful for accelerating these processes but their use must be supervised. Companies cannot afford to adopt them haphazardly as with generative AI,” indicates Eric Bohec. This is why the company’s consulting arm is currently supporting a dozen clients to comply with the ISO 42001 standard. This standard defines how to implement an AI management system to control risks relating to ethics or security, such as data leaks or confidentiality problems.
“Like the well-known ISO 27001 standard, 42001 establishes a common framework to prove that the development of AI is carried out in an ethical and responsible manner,” observes Matthieu Guilpin. Through measures to carry out AI risk analyses, this normative framework allows organizations that comply with it to “ask the right questions: what are the AI agents in my company? Who has the right to access them? Do we have the right to train this or that model with company data? Is sensitive data protected? And to ensure this, the models will be subjected to pentesting”, affirms Eric Bohec. “The fact of supporting these customers towards the adoption of AI thanks to this standard reassures them because they tell themselves that we are relying on a solid, objective framework, and not on our simple subjective opinion”. And for good reason, this standard is written by a committee of experts and specialists in AI and cybersecurity within the ISO.
The market imposes this standard
Although Nomios and other consulting firms use ISO 42001 to support their clients in adopting secure AI, there are still few certified companies. Although the ISO has not communicated figures on this subject, press releases And consultancy publications cite figures ranging from a few hundred to more than 2,000 certified organizations worldwide. Just like ISO 27001, it is a certifying body, accredited by the French Accreditation Committee, which issues the certificate after an audit verifying that there is no major non-compliance with the standard. This certificate is valid for three years and the organization monitors each year that the standard continues to be respected.
However, more and more companies will embark on a certification process due to market demands, according to Eric Bohec. “It is inevitable. If I take the example of ISO 27001, many organizations have adopted it to prove a sufficient level of security to their customers. For ISO 42001, it will be the same because all companies will use AI. The customers of companies that provide a service with AI will require them to be certified. In any case, it is the business and the customers who impose the adoption of such standards and this requirement will be in the contracts. This will be made necessary in the calls for tenders.
“AI comes with its own security risks and this is worrying for all customers. For them, the interest of this standard is to surround themselves with certified suppliers, in order to be assured that they follow the best practices of AI security, without having to carry out a complete audit on all points”, adds Matthieu Guilpin. For suppliers, embarking on ISO 42001 certification now allows them to anticipate an emerging market trend and position themselves more favorably for the conclusion of future contracts.
