Let me start where most Indian CIOs and Heads of AI actually start with this standard. I want to tell you about a conversation I had earlier this year with a Bengaluru CTO. Smart engineer. Ten years at a good company. Just been made CTO of a mid-size B2B SaaS. They had built a working product with three AI features baked in — a customer support co-pilot, an anomaly detector in the analytics dashboard, and a natural-language query interface for the reporting module. They were in the second round of a tender for a large European bank. Multi-year contract. Big deal for them.
The European bank's procurement team sent a compliance questionnaire. On page four, item 3.1 said: "Provide a copy of your current ISO/IEC 42001:2023 certificate for the AI Management System covering the AI capabilities embedded in the offered solution." The CTO called me. He said, "I know ISO 27001. I have a SOC 2 Type II. What is ISO 42001?" I told him. He said, "How long does it take to get?" I told him: twelve to eighteen months, first time. He looked at the calendar. The bank's decision was in ninety days. The deal died on Item 3.1.
That story is the beginning of why this course exists. Through 2024 and 2025, ISO 42001 was an optional badge that most Indian companies had not heard of. Through 2026, it has quietly become a procurement gate for anyone selling AI-enabled anything to a European or American enterprise buyer. If your organisation deploys AI in production, and if your customers are enterprise or your regulators are SEBI, RBI, IRDAI or CERT-In, this standard is going to land on your desk. Better to see it coming than to see it kill a tender.
What ISO/IEC 42001 is, in one paragraph
ISO/IEC 42001:2023 is the international standard for an AI Management System. It was published on 18 December 2023 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) jointly, through Subcommittee 42 of Joint Technical Committee 1 — which is the ISO/IEC committee that also produces the ISO 22989 AI terminology standard and the ISO 23894 AI risk management guidance standard [L1-C1]. It sets out requirements for establishing, implementing, maintaining and continually improving an AI Management System within an organisation that develops or uses AI. The certificate is not self-issued. An organisation demonstrates conformity by passing a two-stage audit performed by a certification body that is itself accredited by a national accreditation body that is itself a signatory to the IAF Multilateral Recognition Arrangement. The certificate is valid for three years. It covers a defined scope — the AI systems, teams and processes covered by the AIMS — not the whole organisation by default.
Read that paragraph again carefully. It contains four concepts that new practitioners routinely mix up. Let me draw them apart clearly, because if you do not have this distinction firmly in your head, you will spend the next twelve months making the same mistake in every conversation.
- The standard — ISO/IEC 42001:2023 — is the document that says what an AIMS must contain. ISO sells you the PDF. It costs about CHF 168.
- The AI Management System (AIMS) — that is the actual thing you build in your organisation. Policies, roles, processes, documented information, running cadences. It is what the standard describes.
- The certificate — that is the piece of paper an accredited certification body (CB) issues you after your AIMS has passed a two-stage audit.
- The accreditation chain — that is the chain of authority (ISO/IEC publishes standard, IAF signs the Multilateral Recognition Arrangement, national accreditation body accredits the CB, CB audits you, CB issues certificate). Without the accreditation chain, the certificate is a piece of paper that means nothing.
When your European buyer asks for "the certificate," they mean the fourth item. But you cannot skip to the fourth item. You have to build the second item first. And you have to pick a CB from the third item that is accredited under the first item. The whole system only works if all four pieces connect. This course walks each piece in turn.
Why 2026 changed the game
ISO 42001 was published in December 2023. Through 2024 it was mostly a topic of conference talks. Through 2025 the early enterprise adopters started certifying — Mphasis announced ISO/IEC 42001:2023 certification on 28 October 2025 [L1-C10]. SGS certified KPMG in India to ISO/IEC 42001:2023, announced in December 2025 for its Gurugram and Noida offices [L1-C11].
Four things happened in 2025 and 2026 that turned the temperature up. Let me walk them in order because you need this context to understand why your customer is now asking.
First: MeitY published the India AI Governance Guidelines in November 2025
These Guidelines were released by the Ministry of Electronics and Information Technology in November 2025 ahead of the India AI Impact Summit that Bharat hosted in February 2026 [L1-C3]. The Guidelines are non-binding. They are principle-driven. But Annexure 6 lists the standards the Bureau of Indian Standards has published or is developing for AI, and IS/ISO/IEC 42001:2023 is one of them. The Guidelines do not mandate or single out any standard. Because 42001 is a BIS standard, Indian buyers can cite it in tenders. That is a procurement practice, not a MeitY requirement.
Second: MeitY notified the IT Amendment Rules 2026 on 10 February 2026
These Rules became effective on 20 February 2026 [L1-C4]. They amended the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules of 2021 to introduce a new due-diligence category called Synthetically Generated Information (SGI). Intermediaries that offer tools to create or share synthetically generated information must label it clearly and prominently, and embed metadata identifying the computer resource that generated it where feasible. Significant social media intermediaries carry extra verification duties. Takedown after a court or government notice is now 3 hours (earlier 36). Nudity, sexual-act, impersonation and morphed-image complaints are 2 hours (earlier 24). Organisations that deploy AI to generate content — even non-intermediaries who supply the generative tools — now need to think about labelling as part of their AI governance. ISO 42001 Annex A.8 (Information for interested parties) becomes the operational hook.
Third: SEBI issued the 5 May 2026 circular on AI-driven vulnerability detection
SEBI Circular No. HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 dated 5 May 2026 is addressed to every category of regulated entity in the Indian securities market — exchanges, depositories, brokers, mutual funds, custodians, credit rating agencies, merchant bankers, portfolio managers, investment advisors, everyone [L1-C5]. It names advanced AI-driven vulnerability detection tools, such as Claude Mythos, as an example. SEBI recognised that AI tools now cut both ways — attackers use them to find and exploit vulnerabilities at machine speed, and defenders use them for the same purpose. The Circular constituted a task force called Cyber-suraksha.ai and directs a set of cybersecurity strengthening measures: patching, AI-assisted vulnerability assessment, API security, SOC monitoring and onboarding to the Market SOC. It is a cybersecurity circular. It does not require an AI management system and does not mention ISO/IEC 42001. An AIMS can still help you show that AI-driven threats sit inside your risk assessment.
Fourth: the RBI FREE-AI Committee Report was released in August 2025
On 13 August 2025 the Reserve Bank of India released the report of its Committee on the Framework for Responsible and Ethical Enablement of Artificial Intelligence, chaired by Professor Pushpak Bhattacharyya of IIT Bombay [L1-C6]. The report is technically not a binding master direction — it is a committee report — but you already know how RBI works. The Master Direction that follows a committee report of this weight is usually a matter of when, not whether. The report structures itself around seven guiding sutras and 26 recommendations across six pillars: Infrastructure, Policy, Capacity, Governance, Protection, Assurance. If you are a regulated entity in BFSI, you should treat this as the shape of what is coming. And ISO 42001 is again the cleanest operational fit for the Governance and Assurance pillars.
Add these four together and you can see what your European buyer, your SEBI regulator, your RBI regulator, and now your government-tender procurement team have all started asking about at roughly the same time. This is not coincidence. AI has crossed the threshold from novelty to system-critical, and every serious regulator and every serious buyer is now catching up. ISO 42001 is the international management-system standard that everyone converges on because it exists and is certifiable and other things (NIST AI RMF, EU AI Act) are either non-certifiable frameworks or hard-law regulations rather than operational management systems.
Who this course is for, and what you will actually be able to do at the end
This is a working practitioner course. It is written for the Indian CIO, CISO, Head of AI, Head of Data Science, DPO or General Counsel who has to build, run and pass a first-time ISO 42001 certification of an AI Management System in their organisation. It is written the way a senior advocate teaches a student, not the way an ISO PDF is translated. I will walk you through every clause of the standard, every one of the 38 Annex A controls, the AI Impact Assessment methodology from ISO 42005:2025, the AI risk management methodology from ISO 23894:2023, the Statement of Applicability, the certification body selection, the Stage 1 and Stage 2 audits, the surveillance cycle, and — this is the part most classroom courses will not touch — the whole India regulatory overlay that sits on top of the ISO baseline.
At the end of this course, you should be able to sit down in front of an executive team and say: "Here is what ISO 42001 requires. Here is the twelve to eighteen month path to certification. Here are the ten templates we lift straight into implementation. Here is the audit body I recommend. Here is the India regulatory overlay we build alongside. Here is what it costs and here is what we get for it." That is the practical capability this course exists to build.
Next lesson, I want to zoom out and place ISO 42001 in the ISO family — because you are going to run into ISO 27001, ISO 27701, ISO 23894 and ISO 42005 in this work, and you need to know how they connect. Then we will place it against NIST AI RMF and the EU AI Act, so you know which one your customer actually wants when they say "AI governance."