ISO 42001 is becoming the SOC 2 of AI companies

ISO/IEC 42001 was published in December 2023 as the first certifiable standard for an AI management system. For about a year it was something governance people talked about at conferences. In 2026 it started showing up in procurement questionnaires, and deals began stalling when the answer was blank.

If you sell an AI product to enterprises, treat ISO 42001 the way SaaS companies learned to treat SOC 2. Plan for it before a buyer makes it a condition, and build it on top of the security program you already have rather than as a separate project.

I've built ISO 27001 programs for fintech and healthcare companies and I'm now mapping AI governance requirements for teams shipping LLM features into regulated customers. The questions those customers ask are getting sharper every quarter.

Why buyers suddenly care

The demand isn't coming from love of a standard. Large companies have their own AI governance obligations, from the EU AI Act to sector regulators and their boards, and they are exporting those obligations to the vendors that sell to them. AWS, Microsoft and Google have certified parts of their services under ISO 42001, so enterprise buyers now see it as normal and ask their own suppliers for the same.

The EU AI Act's general purpose AI obligations have applied since 2 August 2025. The timeline for high risk systems has been under negotiation in Brussels. Buyers aren't waiting for the final dates, because their own procurement cycles are longer than the uncertainty.

What ISO 42001 asks of you

It follows the same management system structure as ISO 27001: context, leadership, planning, support, operation, performance evaluation and improvement. If you've run a 27001 program, the clauses will feel familiar.

The AI specific parts are where the work is. Clause 6.1.4 asks for an AI system impact assessment covering effects on individuals and society. Annex A lists 38 controls across areas such as AI policy, the AI system lifecycle, data for AI systems, information for interested parties, use of AI systems and third party relationships.

In practice buyers boil it down to five questions: which models you use and from whom, what happens to their data inside those models, who checks outputs, how you monitor for drift and failure, and what you do when something goes wrong.

Watch a sales engineer answer "we use a third party LLM" on a call and then go quiet when asked about that provider's data retention terms, and you'll know which of those five is the hardest.

What a small AI company should build first

An inventory of every AI system you run or embed, including the internal ones your support team quietly adopted. An AI policy that a person can read in ten minutes. An impact assessment for each customer facing system. Supplier controls for your model providers: which zero retention or regional options you use and what their terms say about training on your data. Monitoring and an incident process that treats a harmful output like any other incident.

Run it as an extension of your ISO 27001 program. One management review, one internal audit cycle, one risk register with AI risks added. Two parallel programs is how small teams burn out.

That shared structure is the multi framework problem every compliance platform claims to solve. The question to ask yours, whether it's Steppe or anything else, is whether one control can satisfy 27001 and 42001 at the same time with a single set of evidence. If the answer involves duplicating it, keep looking.

If AI is in your product, governing it is part of the product, and buyers have started checking.