ISO 42001 vs ISO 9001: Quality Management and AI Management Compared

If your organisation already holds ISO 9001, you have a head start on ISO/IEC 42001 that most AI governance guides never mention. Both standards share the same skeleton, the same management-system logic and the same Plan-Do-Check-Act loop. But they answer two very different questions. ISO 9001 asks whether you consistently deliver products and services that meet customer and regulatory requirements. ISO 42001 asks whether you develop, provide and use AI responsibly, including for people who will never be your customers.

That difference matters more now than ever. ISO 9001 was refreshed on 16 September 2026, its first new edition since 2015. ISO 42001 has just appeared in the ISO Survey for the first time, with only 271 accredited certificates worldwide. And the EU's first harmonised AI Act standard, EN 18286, is built as a quality management system that maps to both.

This guide explains what each standard covers, where they overlap, where they diverge, and how to run them as one integrated system without doubling your paperwork.

The short answer

ISO 9001 is a quality management system (QMS) standard. It applies to any organisation, in any sector, and focuses on customer satisfaction, consistent processes and continual improvement. ISO/IEC 42001 is an AI management system (AIMS) standard. It applies to any organisation that develops, provides or uses AI, and focuses on AI risk, impact on individuals and society, transparency, data and the AI system life cycle.

You don't choose between them. If you build or use AI and care about quality, the realistic question is how much of your ISO 9001 system you can reuse for ISO 42001. The answer is: a lot of the management system, very little of the AI-specific substance.

Two standards, very different adoption curves

ISO 9001 is the most widely certified management system standard in the world, first published in 1987. ISO/IEC 42001 is barely two years old. The ISO Survey 2025, released in October 2026 with data as of 31 December 2025, shows the gap clearly.

For every ISO 42001 certificate there are almost 6,000 ISO 9001 certificates. The United States leads ISO 42001 with 100 certificates (36.9% of the total), followed by India (25) and the Republic of Korea (24). Industry trackers that count public announcements put the number higher, at roughly 350 organisations by mid-2026, because the Survey only includes certificates from accredited bodies listed in IAF CertSearch.

The practical takeaway: an ISO 9001 certificate is expected in most supply chains. An ISO 42001 certificate still sets you apart, and the organisations most likely to get one first are those that already run a certified management system.

What the two standards share: the Harmonized Structure

Both standards follow ISO's Harmonized Structure (HS), the successor to Annex SL's High-Level Structure. That means identical clause numbers, many identical core definitions and much near-identical text in Clauses 4 to 10.

Reuse ratings are an analytical guide for integrated implementations, not part of either standard.

If you have a working ISO 9001 system, your document control, internal audit programme, management review, corrective action process and competence records can usually be extended to cover AI. That is where integration saves the most time.

Where they differ: seven critical gaps

1. The object of management

ISO 9001 manages the quality of products and services. ISO 42001 manages AI systems and the way the organisation develops, provides or uses them. An AI system can be "high quality" in ISO 9001 terms, delivered on time and to specification, and still be biased, opaque or unsafe in ISO 42001 terms.

2. Who the standard protects

ISO 9001 centres on customers and relevant interested parties. ISO 42001 explicitly extends attention to individuals, groups and societies affected by AI, many of whom never buy anything from you. A loan applicant scored by your model, a job candidate screened out by your tool, or a citizen affected by a public-sector system all count.

3. How risk is handled

ISO 9001 uses risk-based thinking. The 2026 edition splits Clause 6.1 into clearer sub-clauses for addressing risks and pursuing opportunities, but it still prescribes no formal risk assessment method. ISO 42001 requires a defined AI risk assessment process (6.1.2), an AI risk treatment process (6.1.3) and an AI system impact assessment (6.1.4), each repeated in operation under Clause 8.

4. Controls and the Statement of Applicability

ISO 9001 has no control catalogue. Its new Annex A is informative guidance on interpreting the requirements, the first such annex in the standard's history. ISO 42001's Annex A is normative: 38 controls across nine areas, against which you must produce a Statement of Applicability justifying every inclusion and exclusion.

5. What "quality" means

ISO 9000 defines quality as the degree to which a set of inherent characteristics fulfils requirements. For AI, those characteristics go well beyond function: accuracy, robustness, fairness, explainability and controllability. ISO 42001 doesn't define AI quality itself, but its sister standard ISO/IEC 25059 provides a quality model for AI systems that bridges the two worlds.

6. Data as a managed asset

ISO 9001 treats data mainly as documented information and as evidence for decisions. ISO 42001 treats data as a component of the product. Control area A.7 covers data acquisition, quality, provenance and preparation, because a model is only as good as its training and test data.

7. Change and continuous learning

ISO 9001 controls changes to products, processes and the QMS. AI systems can change their behaviour without anyone editing a line of code, through retraining, data drift or model updates from a third-party provider. ISO 42001's life-cycle controls (A.6) expect you to define verification, validation, deployment and monitoring criteria that account for this.

Why AI needs more than a QMS

McKinsey's State of AI in 2025 survey of 1,993 participants across 105 countries found that 88% of organisations now use AI regularly in at least one business function, up from 78% a year earlier. Adoption has outpaced control.

Inaccuracy is a quality failure, and ISO 9001 has the tools to catch it: verification, validation, nonconformity control and corrective action. But ISO 9001 won't prompt you to ask whether a model treats groups unfairly, whether affected people can understand or challenge a decision, or whether your AI supplier changed the model last week. IBM's 2025 Cost of a Data Breach report found that 63% of the 600 organisations it studied had no AI governance policies. A QMS alone does not close that gap.

What changed in ISO 9001:2026, and why it brings the standards closer

ISO describes the 2026 edition as an evolution, not a revolution. Three changes stand out for AI governance teams:

• Quality culture and ethical behaviour are now explicit. Clause 5.1.1 requires top management to promote them, and Clause 7.3 requires people to be aware of them. That moves ISO 9001 toward the values-led territory ISO 42001 already occupies.
• Risks and opportunities are separated into distinct sub-clauses under 6.1, making it easier to align with ISO 42001's more formal AI risk process.
• Climate change from the 2024 amendment is carried into the new edition, alongside updated Harmonized Structure terms that improve integration with other management system standards.

Certification bodies need time to gain accreditation for the new edition, so most experts expect the first ISO 9001:2026 certificates around the second half of 2027. Existing ISO 9001:2015 certificates remain valid during the transition, which is expected to end around September 2029.

The EU AI Act connection: EN 18286

Article 17 of the EU AI Act requires providers of high-risk AI systems to operate a quality management system. Not an "AI management system". The law is written in product-safety language, and that is where ISO 9001 thinking becomes directly relevant to AI regulation.

On 14 October 2026, EN 18286:2026, Artificial intelligence — Quality management system for EU AI Act regulatory purposes, became the first harmonised standard cited in the Official Journal under the AI Act. Following it gives providers a presumption of conformity with the Article 17(1) QMS requirements. EN 18286 includes informative annexes mapping its clauses to both ISO 9001 and ISO/IEC 42001, and it is designed to be layered on top of either, or on a sectoral QMS such as ISO 13485, rather than replace them.

Article 17(3) also lets providers already bound by sectoral QMS rules fold AI Act requirements into their existing system. For a medical device or machinery manufacturer with an established QMS, the most efficient route is often ISO 9001 or ISO 13485 as the base, ISO 42001 for organisation-wide AI governance and EN 18286 for the high-risk product layer.

Which one do you need?

How to integrate ISO 42001 into an ISO 9001 system: 6 steps

1. Redefine your scope and AI role

   List every AI system you develop, provide or use, including AI features inside purchased software. Record whether you act as AI provider, producer, user or more than one, because that determines which Annex A controls apply.

2. Extend your policy and leadership commitments

   Add an AI policy alongside, or within, your quality policy. Link it to the new ISO 9001 requirements on quality culture and ethical behaviour so the two reinforce each other.

3. Add an AI risk and impact layer

   Keep one risk methodology, but add AI-specific risk sources such as bias, opacity, drift and misuse, plus an AI system impact assessment covering individuals, groups and society.

4. Build your Statement of Applicability

   Assess all 38 Annex A controls. Many map to existing ISO 9001 processes: supplier control to A.10, design and development to A.6, and customer communication to A.8.

5. Extend operations to the AI life cycle

   Add verification and validation criteria for models, data quality controls, deployment approvals and post-deployment monitoring for drift and incidents.

6. Run one audit programme and one management review

   Audit both standards together, report AI objectives alongside quality objectives, and use a single corrective action system for quality and AI nonconformities.

Common mistakes to avoid

• Assuming ISO 9001 design and development controls cover AI model validation and data quality
• Treating AI risk as one more line in the general risk register, with no impact assessment
• Ignoring AI features embedded in third-party tools your teams already use
• Building a separate AIMS manual that duplicates your QMS procedures
• Marketing ISO 9001 or ISO 42001 certification as EU AI Act compliance

A prompt to run your ISO 9001 to ISO 42001 gap analysis

Paste in your QMS details to get a first-draft gap analysis. Your lead implementer or auditor should review the output.

You are an integrated management system specialist with deep
knowledge of ISO 9001:2026 and ISO/IEC 42001:2023.

Our organisation:
[sector; size; ISO 9001 scope and certification status; list of
AI systems we develop, provide or use; our AI role(s): provider,
producer, user; key customers and affected groups; main AI
suppliers; whether we place high-risk AI on the EU market]

Produce:
1. A clause-by-clause table (Clauses 4 to 10) showing, for each
   ISO/IEC 42001 requirement: the existing ISO 9001 process we can
   reuse, the gap, and the action needed.
2. A draft Statement of Applicability for all 38 Annex A controls:
   applicable yes/no, justification, and the existing QMS process
   it maps to (if any).
3. The AI-specific processes we must create from scratch, with
   suggested owners.
4. Where ISO 9001:2026 changes (quality culture, ethical
   behaviour, Clause 6.1 restructure) can be implemented jointly
   with ISO/IEC 42001.
5. Whether EN 18286 is likely to be relevant to us, and why.
6. A 90-day integration plan, ranked by priority.

Use only what I provide and mark uncertain points UNKNOWN.

ISO 9001 makes sure you deliver what the customer asked for. ISO 42001 makes sure what you deliver doesn't harm the people who never asked. Mature organisations need both answers. — Kumail Mehdi

Frequently asked questions

Sources

• ISO — Launch of ISO 9001:2026 (16 September 2026)
• ISO — ISO 9001:2026 Quality management systems — Requirements
• ISO — ISO/IEC 42001:2023 AI management systems
• HEIC — ISO Survey 2025 results (ISO 9001, ISO 27001, ISO 42001)
• Atoro — How many companies are ISO 42001 certified?
• DQS — ISO 9001:2026 changes, timeline and transition
• 9001Simplified — ISO 9001:2026 revision and certification timing
• Modulos — EN 18286 and its relationship to ISO 9001 and ISO/IEC 42001
• AI Weekly — EU publishes EN 18286, first AI Act harmonised standard
• McKinsey — The state of AI in 2025
• IBM — 2025 Cost of a Data Breach: navigating AI