NovaQTech Insights
ISO/IEC 42001 Alongside ISO 9001: What Is Shared, What Is Different, and How to Run One Integrated System
For an organization that already operates a certified ISO 9001 quality management system, the practical question about ISO/IEC 42001:2023 is rarely “what is an AI management system?” It is: “How much of this is actually new, and can we run it inside the system we already have?” The short answer is that the backbone is shared — deliberately — and the genuinely new requirements are concentrated in a few identifiable places. This article compares the two standards clause by clause and shows where integration works and where the AI management system (AIMS) needs its own artefacts. (For the deeper conceptual question — where quality management ends and AI governance begins — see our earlier research article: https://novaqtechgroup.com/2026/10/06/from-qms-to-ai-governance-how-iso-9001-and-iso-iec-42001-can-work-together-in-the-age-of-ai/.)
The shared backbone
Both standards follow the harmonized structure for management system standards, so clauses 4 to 10 carry the same titles and the same management logic: understand your context, lead, plan, support, operate, evaluate performance, improve. If your organization runs ISO 9001, the following machinery transfers to ISO/IEC 42001 almost unchanged: context and interested-party analysis, documented information control, competence and awareness management, internal audit, management review, and nonconformity and corrective action. This is not a coincidence — ISO designed the AI management system to be integrable with the systems organizations already run.
| Clause | ISO 9001 (QMS) | ISO/IEC 42001 (AIMS) | Integration note |
|---|---|---|---|
| 4 — Context | Organization and its context; needs of interested parties; QMS scope | Same structure, applied to the organization’s role in AI (provider, producer, customer/user) | One context analysis, extended with AI-specific issues and parties (regulators, affected individuals, AI suppliers) |
| 5 — Leadership | Quality policy; customer focus; roles and responsibilities | AI policy; AI roles and responsibilities; no customer-focus clause | Policies can sit in one document; the AI policy must additionally address responsible development and use of AI |
| 6 — Planning | Actions to address risks and opportunities (risk-based thinking); quality objectives | AI risk assessment (6.1.2), AI risk treatment (6.1.3), AI system impact assessment (6.1.4); AI objectives | The largest real difference: 42001 formalizes risk and impact assessment far beyond 9001’s risk-based thinking |
| 7 — Support | Resources, competence, awareness, communication, documented information | Same clauses, extended to AI resources: data, models, tools, human resources with AI competence | Fully shareable processes; competence matrices need AI-specific entries |
| 8 — Operation | Operational planning and control of product/service provision: customer requirements, design and development, purchasing, production, release, nonconforming outputs | Operational planning and control of the AI management processes; AI risk and impact processes in operation; AI system life cycle | Least transferable clause: 9001’s clause 8 is about product conformity; 42001’s is about governing AI systems across their life cycle |
| 9 — Performance evaluation | Monitoring and measurement, customer satisfaction, internal audit, management review | Monitoring and measurement of the AIMS and AI systems, internal audit, management review | One audit programme and one management review can cover both, with AI-specific inputs and criteria added |
| 10 — Improvement | Nonconformity and corrective action; continual improvement | Same | One corrective-action process serves both systems |
What ISO/IEC 42001 adds that ISO 9001 does not have
Four additions matter in practice.
First, the AI system impact assessment (clause 6.1.4). ISO 9001 asks you to consider risks to conformity and customer satisfaction. ISO/IEC 42001 additionally requires assessing the consequences of AI systems for individuals, groups and society — fairness, safety, rights, and foreseeable misuse — at both system and organizational level. This is a different lens from quality risk, and it is the clause most existing QMS processes cannot simply absorb.
Second, Annex A and the Statement of Applicability. ISO/IEC 42001 carries a reference set of 38 controls in nine themes (including policies related to AI, resources for AI systems, the AI system life cycle, data for AI systems, information for interested parties, and third-party relationships). The organization determines which controls apply through its risk process and justifies the selection in a Statement of Applicability. ISO 9001 has no equivalent artefact — nothing in a QMS requires you to justify, control by control, what you have implemented.
Third, the AI system life cycle. Where ISO 9001’s clause 8 controls how a product or service is designed, produced and released, ISO/IEC 42001 expects defined processes across the life of an AI system: planning and design, data collection and processing, model development and validation, deployment, operation and monitoring, and eventual retirement — including how changes to the system are controlled after deployment. For organizations that buy rather than build AI, much of this becomes supplier governance: what did the provider test, on what data, and how are you informed of changes?
Fourth, data and transparency obligations. Annex A controls address the quality, provenance and preparation of data used by AI systems, and the information owed to interested parties — including, where relevant, explaining to users that they are interacting with an AI system and how outputs are produced. A QMS controls records; an AIMS must additionally govern training and input data as a managed resource.
What ISO 9001 has that ISO/IEC 42001 does not
The comparison cuts both ways. ISO/IEC 42001 is not a product-quality standard: it contains no equivalent of ISO 9001’s customer-requirements review, design and development controls for products and services, production controls, or customer-satisfaction monitoring. An organization certified to ISO/IEC 42001 has demonstrated that it manages AI responsibly — not that its products conform. In regulated and high-stakes settings you need both disciplines, which is precisely why the two systems are designed to run together rather than compete.
Running them as one system
In practice, an integrated QMS + AIMS works like this. Share the foundation: one context analysis (extended for AI), one documented-information system, one competence framework (extended with AI roles), one internal audit programme — audited by auditors who are competent in both standards — one management review with AI-specific inputs added to the agenda, and one corrective-action process. Keep these AIMS artefacts distinct: the AI policy commitments, the AI risk assessment and treatment records, the AI system impact assessments, the Statement of Applicability, and the inventory of AI systems with their life-cycle stage and accountable owner. The inventory is the practical starting point: most organizations discover AI uses — embedded features in purchased software, staff using public AI tools, vendor platforms — that no register currently captures.
One timing note for European-facing organizations: the first harmonised standard under the EU AI Act, EN 18286:2026, builds its quality-management requirements for high-risk AI on this same management-system logic (see our news coverage: https://novaqtechgroup.com/2026/10/20/first-harmonised-standard-under-the-eu-ai-act-is-published-en-182862026/), so an integrated QMS + AIMS is also the most direct route to AI Act conformity work.
Getting started
If you already run ISO 9001, you are closer to ISO/IEC 42001 than you may think — the work concentrates in clause 6, Annex A, and the AI system inventory. NovaQTech’s ISO/IEC 42001:2023 AI Management System Implementation Kit (https://novaqtechgroup.com/product/iso-iec-420012023-ai-management-system-implementation-kit/) provides the AIMS documentation set — manual, procedures, registers and forms, including the impact-assessment and Statement of Applicability artefacts — structured to sit alongside an existing QMS rather than duplicate it. A free sample is available on the product page.