Consider a hypothetical example. Picture the approval record for an AI system on the day it went live: a risk assessment, a set of sign-offs, perhaps a short list of conditions. Now picture the same system a year later. Its vendor may have updated the underlying model, more teams may be using it, and the decisions it informs may have changed. The question worth asking is whether the governance record changed with it.
That question sits at the center of ISO/IEC 42001, the international standard for AI management systems. ISO describes the standard as setting requirements for a management system that an organization establishes, implements, maintains and continually improves. Read that way (an interpretation, not ISO’s wording), governance is not a single decision point before launch but something that continues for as long as the organization develops, provides or uses AI.
The difference between a decision point and a system sounds small. In practice, it changes what leaders should ask of their governance arrangements.
What ISO/IEC 42001 is
ISO/IEC 42001:2023 was published in December 2023. Its full title is Information technology — Artificial intelligence — Management system. ISO describes it as “the world’s first AI management system standard.”
According to ISO, the standard “specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations.” It is intended for organizations of any size that develop, provide or use AI-based products or services, across all industries, including the public sector and nonprofits.
Two features matter for this discussion.
First, it is a management system standard. ISO explains that, rather than looking at the details of specific AI applications, it “provides a practical way of managing AI-related risks and opportunities across an organization.” It is less a checklist for one model and more a description of how an organization should run AI governance as a whole.
Second, ISO states that implementing the standard means putting in place policies and procedures for the sound governance of an organization in relation to AI, “using the Plan-Do-Check-Act methodology.”
Plan-Do-Check-Act (PDCA) is not new. It is the improvement loop that underpins much of ISO’s management system work. ISO describes its management system standards as helping organizations create a culture that “reflexively engages in a continuous cycle of self-evaluation, correction and improvement.” ISO/IEC 42001 applies that same logic to AI.
Why a gate is not enough
The following section is interpretation, not a statement from ISO.
A launch review answers one question at one moment: is this system acceptable today, given what we know today?
That is a fair question, and it should be asked. The difficulty is that AI systems and their surroundings do not stay still after launch. The data a system sees in operation can drift away from the data it was built or tested on. Use cases expand, often informally, as people find new ways to apply a tool. Vendors update the models and services that organizations build on. Regulation and customer expectations move. And the people relying on the output change how much they trust it and how carefully they check it.
A gate cannot see any of that once it has been passed. The approval was correct for the conditions at the time, but nothing in a one-time review tells the organization when those conditions have changed enough to matter.
This is where the wording of the standard is instructive. ISO’s own summary of what ISO/IEC 42001 requires includes “performance evaluation and monitoring” and “continual improvement” alongside leadership, policy, risk management and lifecycle controls. ISO’s explainer also lists monitoring AI systems “throughout their lifecycle” as part of what an AI management system helps organizations do. The emphasis falls on what happens after the first decision, not only on the decision itself.
What the cycle looks like in practice
The questions below are an interpretation of how the PDCA cycle can be applied to AI governance. They are not quoted from the standard, and they do not replace its actual requirements, which are set out in the ISO/IEC 42001 text itself.
Plan. What are our objectives for AI, what risks and opportunities come with them, and who is accountable for each? Planning in a management system is not only about one project. It covers the organization’s context, its AI policy and the objectives it sets for itself.
Do. Are the controls we designed actually operating? A documented control that nobody performs is a description, not a control. This stage is about whether roles, processes, data governance and lifecycle controls exist in day-to-day work, not just on paper.
Check. What do monitoring, internal audit and management review tell us about whether those controls work? ISO notes that audits “are a vital part of the management system approach,” because they let an organization check how far it is meeting its objectives. For AI, checking might include system performance, incidents, complaints, and whether the system is still being used for the purpose that was approved.
Act. What are we changing as a result, and is that change recorded? This is the stage that closes the loop. Findings that do not lead to a decision, an owner and a date tend to reappear at the next review in the same form.
Then the cycle starts again. The plan is updated with what was learned, and the next round of checking is informed by the last.
Where the launch review still belongs
Interpretation.
None of this means launch reviews should disappear. Deciding whether a system is ready to go live is a legitimate and important control. The shift is in how that review is positioned.
In a gate model, the launch review is the main event. In a cycle model, it is one input among several. It sets a baseline, records the assumptions the approval rests on, and defines what will be checked later and when. The approval becomes the start of a governance record rather than the end of one.
A useful way to see the difference is in how a review ends. A gate ends with “approved.” A cycle ends with “approved, on these conditions, to be reviewed by this date, by this owner, against these signals.”
Certification is optional; the cycle is the point
ISO is clear that certification to ISO/IEC 42001 is voluntary. ISO itself does not certify organizations; certification is carried out by independent certification bodies. More broadly, ISO notes that organizations can benefit from implementing management system standards without being certified to them.
Interpretation: this matters because conversations about ISO/IEC 42001 often go straight to certification: whether to pursue it, how long it takes, what it costs. Those are reasonable questions for some organizations. But the most transferable idea in the standard is available to any organization, certified or not: governance that is reviewed on a rhythm, with evidence, and that changes in response to what the evidence shows.
ISO’s explainer frames this in the same direction, noting that certification can provide additional confidence to stakeholders, “but adoption of the standard itself already delivers significant value.”
How it fits with other standards
ISO/IEC 42001 sits within a wider family of AI standards from the same joint ISO/IEC committee (JTC 1/SC 42). One example is ISO/IEC 23894:2023, which provides guidance on how organizations can manage risk specifically related to AI and integrate risk management into their AI-related activities.
ISO also notes that many of its management system standards share the same structure and many of the same terms and requirements, which is intended to help organizations run more than one standard together. Interpretation: for organizations that already operate management systems for areas such as information security or quality, the PDCA rhythm in ISO/IEC 42001 is likely to feel familiar. Whether AI governance should be integrated into an existing management system or run alongside it is a design choice each organization needs to make for itself.
A simple test for leaders
Interpretation.
A practical way to tell whether AI governance in an organization works as a gate or a cycle is to look at the most recent AI-related review and ask a few questions:
- Did it end with a decision, an owner and a date for the next review, or only with an approval?
- Were the conditions of the approval written down, so that someone could later tell whether they still held?
- Is anyone responsible for monitoring the system after launch, and do their findings reach the people who can act on them?
- When something changed, such as a model update, a new use case or an incident, did it trigger a review, or was it noticed only by chance?
If most of the answers point to a single approval and little after it, the organization has a gate. That is a starting point, not a failure. The task is to add the parts that keep the loop running.
Conclusion
Interpretation: arguably the most important word in ISO’s description of ISO/IEC 42001 is easy to skim past: “continually.” The standard asks organizations to establish, implement, maintain and continually improve the way they manage AI, using a Plan-Do-Check-Act cycle. In practice, that means governance is not a single decision point.
For leaders, the practical message does not depend on certification. AI governance that is planned, operated, checked and acted on, on a rhythm, is better suited to systems that keep changing than a gate that is passed once and then left behind.
This article reflects the author’s personal views and interpretation of ISO’s public materials. It is not affiliated with or endorsed by ISO or IEC, does not reproduce the standard’s requirements, and is not legal, compliance or certification advice. Refer to the official ISO/IEC 42001 text for requirements.
Sources: ISO, ISO/IEC 42001:2023 — AI management systems, https://www.iso.org/standard/42001; ISO, ISO/IEC 42001 explained, https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html; ISO, Management system standards, https://www.iso.org/management-system-standards.html; ISO, ISO/IEC 23894:2023, https://www.iso.org/standard/77304.html (accessed October 14, 2026).