Guide · Malaysia & Singapore · 2026
ISO 42001 in Malaysia & Singapore: What It Is, Who Needs It, How to Prepare (2026)
ISO/IEC 42001 is the international standard for governing AI. Certification is voluntary, so the real questions are whether your customers will ask for it, how it differs from ISO 27001, and what to prepare first.
Short answer
What is ISO 42001?
ISO/IEC 42001:2023 is the international standard for an AI management system: the policy, roles, risk process and controls an organisation uses to govern AI. Certification is voluntary; it usually becomes necessary when a customer, tender or regulated sector in Malaysia or Singapore asks for it. You prepare by scoping your AI use, assessing risk and impact, and completing a Statement of Applicability against its 38 Annex A controls.
At a glance
ISO 42001 at a glance
The standard in eight lines. Read the official text on iso.org; the standard itself is sold by ISO and national standards bodies.
| Item | ISO/IEC 42001 |
|---|---|
| Full reference | ISO/IEC 42001ISO/IEC 42001:2023, published jointly by ISO and IEC |
| What it is | ISO/IEC 42001The international standard for an AI management system (AIMS) |
| What it covers | ISO/IEC 42001The policy, roles, risk process and controls an organisation uses to govern how AI is used and built |
| How it runs | ISO/IEC 42001A plan–do–check–act cycle, with the same management-system clauses (4 to 10) as other ISO management standards |
| Controls | ISO/IEC 42001Annex A lists 38 controls, from AI policy and impact assessment to data, suppliers and responsible use |
| Key record | ISO/IEC 42001A Statement of Applicability: each Annex A control, whether it applies, why, and how it is implemented |
| Certifiable? | ISO/IEC 42001Yes, by an accredited certification body after an audit. Certification is voluntary |
| Who asks for it | ISO/IEC 42001Customers, tenders and regulated sectors that want proof AI is governed |
Who needs it
Who needs ISO 42001 certification?
Nobody is required to certify. ISO 42001 is a voluntary standard, and you can follow it without an audit. Certification starts to matter when someone outside your company asks for proof.
Plan for certification if
- A customer, tender or contract asks for ISO 42001 or evidence of an AI management system.
- You sell an AI product or AI-powered service, and buyers' vendor assessments ask how you govern it.
- You are a financial institution under BNM or MAS, a healthcare provider, or serve such clients.
- Your AI outputs reach the EU, or a parent company works to an international standard.
Follow the standard, certify later, if
- Your staff use approved AI tools, but you do not build AI or sell it.
- Nobody has asked you for a certificate yet.
- You want the structure of a management system first, and an audit only when it pays off.
In the AI Governance Kit, planned ISO 42001 certification puts you in the Regulated tier. The Lite and Standard tiers follow the same structure, so moving up does not mean starting again. Check your tier on the AI governance hub.
Comparison
ISO 42001 vs ISO 27001: what is the difference?
ISO 27001 protects information. ISO 42001 governs AI, including what AI does to people. They share the same management-system clauses, so a company with ISO 27001 extends its existing processes rather than starting again.
| ISO/IEC 42001 | ISO/IEC 27001 | |
|---|---|---|
| Management system for | ISO/IEC 42001Artificial intelligence (AIMS) | ISO/IEC 27001Information security (ISMS) |
| Protects | ISO/IEC 42001People and organisations from the effects of AI: human oversight, transparency, fairness, impact | ISO/IEC 27001The confidentiality, integrity and availability of information |
| Distinct assessment | ISO/IEC 42001AI system impact assessment on individuals, groups and society | ISO/IEC 27001Information security risk assessment |
| Typical controls | ISO/IEC 42001AI policy, AI system impact assessment, data for AI, responsible use, AI suppliers and customers | ISO/IEC 27001Access control, cryptography, physical security, operations and supplier security |
| Structure | ISO/IEC 42001Clauses 4–10 plus Annex A controls and a Statement of Applicability | ISO/IEC 27001Clauses 4–10 plus Annex A controls and a Statement of Applicability |
| Certifiable | ISO/IEC 42001Yes, voluntary | ISO/IEC 27001Yes, voluntary |
How it fits
How ISO 42001 relates to NIST AI RMF and Malaysian and Singapore rules
NIST AI RMF
A US risk management framework (Govern, Map, Measure, Manage). It is not certifiable; use it for the method of identifying and treating AI risk inside the ISO 42001 structure.
Malaysia
The PDPA covers personal data in AI; the national AI governance and ethics guidelines set principles; an AI Governance Bill is in draft. ISO 42001 gives you one management system to show how you meet them.
Singapore
The Model AI Governance Frameworks set voluntary expectations and AI Verify offers a testing toolkit; MAS guidelines add AI risk management for financial institutions. The kit maps ISO 42001 controls to these.
Regulation status changes. See the AI governance guide for Malaysia and Singapore for the current position and the full framework mapping.
Preparation roadmap
How to prepare for ISO 42001: eight steps mapped to the kit
The order follows the standard's clauses. Each step names the AI Governance Kit documents that do the work: free documents link to an in-browser preview; member documents are included with Hub membership.
- 01
Clause 4
Set the scope and context
Decide which AI systems, business units and sites the management system covers, and record the issues and interested parties that shape it.
AGK-000 v1.1 · AI Governance Framework and Document ArchitectureAGK-POL-01 · Governance Charter & Operating Model (member) - 02
Clause 5 · A.2, A.3
Write the AI policy and name the roles
Top management approves an AI policy, an AI Governance Committee and a named owner. Staff rules for everyday AI use sit in the acceptable use policy.
AGK-POL-02 v1.1 · AI Acceptable Use PolicyAGK-POL-01 · Governance Charter & Operating Model (member) - 03
Clause 4.3 · A.4
List every AI system
Build the AI system register, including tools staff already use without approval, so the scope matches what is really in use.
- 04
Clauses 6.1, 8.2–8.4 · A.5
Assess risk and impact
Assess each AI system's risks and its impact on individuals, groups and society, then decide how each risk is treated.
AGK-TPL-03 v1.0 · AI Use Case Intake FormAGK-PRC-02 · Risk & Impact Assessment (member)AGK-TPL-04 · Risk & Impact Assessment Form (member) - 05
Clause 6.1.3 · Annex A
Complete the Statement of Applicability
Go through the 38 Annex A controls, mark each one applicable or not with a reason, and record how and where it is implemented.
AGK-TPL-08 · Control Library, Lite Checklist & ISO SoA (member) - 06
Clauses 7–8 · A.6–A.10
Run the controls and train people
Put the data rules, approved tools, supplier checks and training into operation, and keep the records an auditor will ask for.
AGK-STD-A02 v1.0 · AI Data Handling StandardAGK-STD-C01 · AI Literacy & Training (member)AGK-PRC-03 · Vendor & Model Assessment (member) - 07
Clauses 9–10
Check and improve
Run an internal audit and a management review, log nonconformities and corrective actions, and fix what they find.
AGK-TPL-06 v1.0 · AI Incident, Nonconformity and CAPA LogAGK-PRC-05 · Review & Recertification (member) - 08
If you certify
Book the certification audit
Choose an accredited certification body. It audits your documents first (stage 1), then how the system works in practice (stage 2).
Clause references are indicative, as mapped in AGK-000 v1.1. Confirm numbering against your licensed copy of ISO/IEC 42001:2023.
AGK-TPL-08 · member document
The Statement of Applicability, explained
The Statement of Applicability (SoA) is the document an auditor reads first. It lists every Annex A control, says whether it applies to you and why, and shows how each one is implemented and evidenced. Excluding a control is allowed, but only with a written reason.
- Ref and control
- Each of the 38 Annex A controls, with the standard's numbering and a paraphrased title.
- Implemented by
- The kit documents that put the control into practice, so the SoA points to real policies and procedures.
- Applicable?
- Yes or no for your organisation. Every exclusion needs a written justification.
- Status and evidence
- Implemented, partial or not yet, and where the evidence is kept for the auditor.
In the kit
AGK-TPL-08: Control Library, Lite Checklist & ISO SoA
An Excel workbook with a starter ISO 42001 SoA sheet. It lists the 38 Annex A controls and the management-system clauses 4 to 10, each already mapped to the kit documents that implement it, with columns for applicability, justification, status and evidence. The same workbook holds the full control library with the kit's indicative framework mapping.
It is a member document, included with Hub membership (waitlist open now). Control titles are paraphrased; you confirm them against your own copy of the standard.
About Hub membershipFree AI Governance Lite pack
The documents an organisation starting out needs to govern AI tools in its first 90 days. Word and Excel, ready to edit.
- Lite Quick Start and Control Checklist AGK-001 · Word
- AI Governance Framework and Document Architecture AGK-000 · Word
- AI Acceptable Use Policy AGK-POL-02 · Word
- AI Data Handling Standard AGK-STD-A02 · Word
- AI Discovery and Shadow AI Procedure AGK-PRC-07 · Word
- AI Adoption Roadmap and Use-Case Prioritisation Guide AGK-GDL-C02 · Word
- AI System Register AGK-TPL-01 · ExcelPreview AI System Register
- AI Use Case Intake Form AGK-TPL-03 · Word
- AI Incident, Nonconformity and CAPA Log AGK-TPL-06 · ExcelPreview AI Incident, Nonconformity and CAPA Log
- AI Acceptable Use Acknowledgement AGK-TPL-07 · Word
- Pengakuan Penggunaan AI (Bahasa Melayu) AGK-TPL-07-BM · Word
- AI Use-Case Prioritisation and Benefits Tracker AGK-TPL-12 · ExcelPreview AI Use-Case Prioritisation and Benefits Tracker
Template release v1.0 · ZIP · 990 KB
Download AI Governance Framework and Document Architecture and the Lite pack
Templates for governance purposes, not legal advice.
AI Governance Hub
AI Governance Hub: the AI risk management platform for your risk team
Templates go stale. The Hub keeps every AI system registered, risk-assessed, owned and evidenced, and answers staff questions from your own policy. Launching soon: join the waitlist and we will contact you before it opens.
| Feature | Free | Member |
|---|---|---|
| Templates | 12 Lite documents | All 48 documents, with version history |
| Pre-read and tier check | ||
| 90-day planner with owners and evidence | ||
| Policy assistant: a pack tailored to your company | ||
| AI system and risk register, with a ready AI risk library | ||
| Control owner register with quarterly attestation and evidence | ||
| Connector, agent and AI vendor registries | ||
| Incidents, exceptions and review calendar | ||
| KRI dashboard and one-click board report | ||
| MCP connection: staff ask Claude, ChatGPT or Copilot and get answers from your own policy | ||
| Regulation and vendor-setting update alerts |
Member features are planned for launch and may change.
Enterprise · deploy in your environment · coming later
Run the same AI risk platform in your own cloud account (AWS, Azure or Google Cloud, with your own AI model account), or fully offline on your own servers with a private AI model. For organisations that cannot use shared cloud software. Pricing on request.
Want it set up with you? We run a governance setup sprint: owners, policy, register and an approved AI tool. Book an online meeting
RM 2,400
per organisation per year
ISO 42001 FAQ
What is the ISO 42001 standard?
ISO/IEC 42001:2023 is the international standard for an AI management system. It sets out the policy, roles, risk and impact assessment, and controls an organisation uses to govern how it uses and builds AI, run on a plan–do–check–act cycle. Annex A lists 38 controls, and the standard is certifiable.
Who needs ISO 42001 certification?
No organisation is required to certify; it is voluntary. It becomes necessary when a customer, tender or contract asks for proof that AI is governed, which is most common for AI product builders, outsourcers and regulated sectors such as banking, insurance and healthcare. Others can follow the standard without certifying.
What is the difference between ISO 42001 and ISO 27001?
ISO 27001 is an information security management system: it protects the confidentiality, integrity and availability of information. ISO 42001 is an AI management system: it governs how AI is used and built, including human oversight, transparency and impact on people. Both share clauses 4–10, so existing ISO 27001 processes can be extended.
How much does ISO 42001 certification cost?
There is no fixed price. The cost depends on the scope of your AI management system, the number of sites and AI systems, how much documentation you already have, and the certification body's audit days. Ask two or three accredited certification bodies for a quote once your scope is written down.
Is ISO 42001 mandatory in Malaysia or Singapore?
No. ISO 42001 is a voluntary international standard. Malaysian and Singapore AI and personal data rules, such as the PDPA, the national AI governance guidelines and MAS guidance for financial institutions, are separate. Following ISO 42001 helps you meet many of their expectations, and the AI governance guide tracks their status.
What is an ISO 42001 Statement of Applicability?
The Statement of Applicability (SoA) is the record that lists every Annex A control, states whether it applies to your organisation, justifies any exclusion, and shows how each applicable control is implemented and where the evidence is kept. Certification auditors use it to plan the audit, so it is one of the first documents to prepare.
Do we need ISO 27001 before ISO 42001?
No. ISO 42001 can be adopted and certified on its own. If you already hold ISO 27001, you start ahead: document control, internal audit, management review and corrective action work the same way, so you extend those processes to AI rather than build a second management system from scratch.
Can Anchor Sprint certify us for ISO 42001?
No. Anchor Sprint is not a certification body and does not issue ISO certificates. Certification comes from an accredited certification body after a two-stage audit. Our AI Governance Kit helps you prepare: it follows the standard's structure and includes a starter Statement of Applicability mapped to the kit documents.
Part of the AI governance guide for Malaysia and Singapore. See also the AI acceptable use policy template and the template library.
