Yes. ISO/IEC 42001 applies to any organization that uses AI systems, whether it built them, bought them, or found them switched on inside software it already pays for. The management system it describes covers the AI systems inside your scope, whoever wrote the model. If an AI tool now touches your product quality, hiring, customer contact or planning, you are inside the standard's intended audience. The decision in front of you is how much of the standard to adopt and whether to certify. This article walks through that decision for four organizations that never wrote a line of model code (a manufacturer, a distributor, a testing laboratory and an electronics recycler) and ends with where the FDA's April 2026 warning letter on AI-written records puts a GMP manufacturer.
What the standard means by "AI system"
ISO/IEC 42001:2023 does not define AI on its own. It borrows the definition from ISO/IEC 22989, the AI vocabulary standard, and that definition is broad on purpose: an engineered system that generates outputs such as content, forecasts, recommendations or decisions for a set of objectives that people define. There is no requirement that you trained or host the model. The test is what the system produces and what you do with the output. By that definition an assistant drafting a procedure (content), the forecasting module in your ERP (forecasts), the resume ranking in your applicant tracking system (recommendations) and a chatbot that approves a return (decisions) all qualify.
The standard also asks you to name your role. Clause 4.1 expects an organization to determine its role with respect to the AI systems it deals with; the vocabulary includes AI provider, AI producer and AI customer, the term for an organization that uses an AI system someone else supplies. Most manufacturers, distributors, labs and recyclers are AI customers. That role carries real obligations under Annex A, which groups the AI-specific controls into nine areas. The ones that land on a user rather than a builder are:
| Annex A area | What it asks a user of AI to do |
|---|---|
| Assessing impacts of AI systems | Work out who could be affected by a wrong output (employees, customers, patients, the public) and how badly |
| AI system life cycle | Define the intended use, verify the tool does what you expect, monitor it in use, and know how to switch it off |
| Data for AI systems | Know what data goes into the tool, where it came from, and where it goes |
| Information for interested parties | Tell people when AI is involved and how to raise a concern |
| Use of AI systems | Set the rules for responsible use, including what the tool must never be used for |
| Third-party and customer relationships | Manage the vendor: what they change, when they change it, and who is accountable when it fails |
None of those require you to build anything. They require you to know what you are using, decide what it is for, put a qualified person between the output and the consequence, and keep records that prove it. If you already run ISO 9001, ISO 13485 or a GMP quality system, that is a familiar discipline applied to a new class of supplier, and our page on what ISO 42001 adds to an ISO 9001 system covers the overlap clause by clause.
Scope is yours to set, and an auditor will accept a reasoned exclusion: a spell checker, yes; a tool that drafts the batch record, no. The working rule we use is that if the output influences a decision about a product, a person or a customer, and someone could be harmed if it is wrong, it belongs in scope.
Four organizations that never built a model
Nobody decided to "adopt AI." A vendor shipped a feature, a manager tried a subscription, and six months later the tool was doing real work in four functions at once.
A GMP contract manufacturer
A supplement or pharmaceutical contract manufacturer with 120 employees is, in our experience, already using AI in every function an FDA investigator cares about.
- Quality. A general-purpose assistant drafts SOPs, specifications and deviation investigations, and a vision-inspection module bought as an add-on flags print defects on the packaging line.
- HR. The applicant tracking system ranks resumes for operator and QC analyst roles, and a scheduling tool builds shift rosters.
- Customer service. Complaint intake runs through a helpdesk that classifies and routes tickets with AI. Under 21 CFR 211.198 complaints are quality records, so that classifier now sits inside the GMP system.
- Planning. Demand forecasting in the ERP drives purchasing, and a predictive-maintenance service decides when a tablet press gets serviced.
The quality use has already drawn a citation, and an investigator who finds AI-drafted procedures will reasonably ask what else AI is writing.
A distributor
A 60-person distributor of medical devices or specialty ingredients rarely thinks of itself as an AI user, and yet:
- Quality. AI reads supplier certificates of analysis into the ERP, classifies returns, and drafts supplier corrective action requests.
- HR. Warehouse hiring runs through the same resume-ranking feature, and a workforce tool predicts who is likely to quit.
- Customer service. A website chatbot quotes lead times and answers product questions. If the product is a regulated device, the chatbot is now making claims about it.
- Planning. Replenishment forecasts decide what gets ordered, and route optimization decides what ships when.
The Annex A areas that bite hardest here are third-party relationships (the vendor changes the model and nobody tells you) and information for interested parties (the customer does not know it is talking to a bot).
A testing laboratory
A QC or contract lab, whether it runs under ISO/IEC 17025 or under GMP, lives on data integrity, and AI has arrived inside the instruments and the LIMS.
- Quality. The LIMS flags out-of-trend results with a learned model, chromatography software uses machine-learning peak integration, and an assistant drafts method-validation summaries and test reports.
- HR. Analyst hiring goes through a ranked shortlist, and competence-training content is generated rather than written.
- Customer service. A client portal answers "why did my result change?" with an AI summary of the data.
- Planning. Instrument scheduling and workload forecasting decide which samples wait.
A test report is the lab's product. If AI drafts it and an analyst signs it without reading it, the lab has released a result it cannot defend, and an FDA investigator or a 17025 assessor will treat that as a failure of the validity-of-results requirement, whatever the technology involved.
An electronics recycler or ITAD facility
An R2-certified recycler with 80 employees handles other people's data and other people's liability, which is where AI errors cost the most.
- Quality. Photo-based grading assigns condition codes to incoming devices, and an assistant drafts the certificate of destruction from the sanitization software's verification reports.
- HR. Hiring and safety-training content go through the same generated-content path as everyone else.
- Customer service. A chatbot schedules pickups and answers questions about certificates.
- Planning. Downstream vendor selection and commodity forecasting decide where material goes and when.
The certificate of destruction is the document a customer's auditor will one day ask you to defend. If the wording came from an assistant and nobody checked it against the sanitization log, the recycler has the GMP manufacturer's problem under a different standard. Our page for R2 and ITAD facilities covers where 42001 sits alongside R2v3's data-security and downstream due-diligence requirements.
What an auditor asks about each function
Here is what a certification auditor (or an FDA investigator) asks about each of the four functions. The questions are short, and most companies cannot answer them on the first try.
| Function | Typical off-the-shelf tool | The question you will be asked |
|---|---|---|
| Quality | Assistant drafting procedures, specs and records; AI inspection | Who reviewed this before release, and were they qualified to? |
| HR | Resume ranking, attrition prediction, rostering | Did you assess the impact on applicants, and can you explain a rejection? |
| Customer service | Chatbot, ticket classifier | Does the customer know it is AI, what happens when it is wrong, and how does a complaint reach the quality system? |
| Planning | Forecasting, route and maintenance optimization | What decision does the output drive, and what is the human check before money is spent or product ships? |
The HR row is where the law is moving fastest. Texas's TRAIGA took effect on 1 January 2026, and Colorado replaced its 2024 AI Act with a narrower law, SB 26-189, effective 1 January 2027. Neither requires ISO 42001 and both may change again, so treat US AI law as unsettled. Both expect you to have assessed the impact of an automated hiring decision before making it, which is what Annex A's impact-assessment control documents.
Where the FDA's 2026 warning letter puts a GMP manufacturer
In April 2026 FDA issued a warning letter to Purolea that cited "inappropriate use of artificial intelligence" under 21 CFR 211.22(c). The finding was that AI-written specifications, procedures and master records had been released without qualified review. It is the first time AI-generated quality records have drawn an FDA citation.
Section 211.22(c) requires the quality control unit to approve or reject all procedures and specifications that affect the identity, strength, quality and purity of the drug product. The regulation dates from 1978 and does not care who or what wrote the draft; it cares that a qualified person in the quality unit read it, understood it and took responsibility for it before use. What broke the rule was the release without review. The AI simply made it easy to produce documents faster than the quality unit could read them.
Three practical consequences follow for any manufacturer under Part 211, Part 111 or Part 820:
- The question is now on the investigator's list. An investigator reviewing your procedures has a precedent for asking whether they were AI-drafted and who reviewed them. "We don't know" is the worst available answer, because it means you have no inventory.
- Speed is the risk, not the tool. An assistant can produce forty SOP revisions in an afternoon. If your quality unit approved forty revisions in an afternoon, an investigator will ask how carefully. You need a review step that cannot be skipped, with the reviewer's competence on record.
- Master records deserve the strictest rule. A batch record template drafted by an assistant and released without line-by-line verification against the registered process is a 211.186 problem on top of a 211.22 problem. In my experience the safe policy is that AI may draft, and a second qualified person verifies the master record against the source before approval, every time.
ISO 42001 does not replace Part 211, and FDA does not require it. What it gives a GMP manufacturer is the management-system answer to the investigator's question: an inventory of the AI systems in use, the intended and prohibited uses of each, the human review point, the reviewer's competence, and records that show the review happened. That is what the AI-in-the-quality-system review is for: a $5,000 fixed-fee review of the AI-generated records, specifications and procedures already inside your quality system, producing the finding list an investigator would, before the investigator does. The longer treatment is in ISO 42001 meets FDA expectations, the Part 11 angle is in AI and 21 CFR Part 11, and the GMP manufacturers page covers supplements, cosmetics and devices.
Using AI does not mean you must certify
ISO 42001 is voluntary. No US federal or state law requires it, and it does not satisfy the EU AI Act either. EN ISO/IEC 42001:2026 was adopted as a European standard on 18 March 2026, but no harmonized standard for the AI Act has been cited in the Official Journal, so the certificate gives no presumption of conformity; the standard being written for that job is prEN 18286, targeted for late 2026. Under the 2026 revisions the Act's high-risk obligations now start in December 2027 and August 2028, so unless you sell into the EU or use AI in a listed high-risk area such as employment, the AI Act belongs on your watch list, with no deadline attached yet.
The certificate market is still small: fewer than 100 organizations held a 42001 certificate in January 2026 and roughly 350 did by spring 2026 (there is no official register, so the count comes from announcements). Certification bodies report auditor backlogs, and some Stage 2 audits have waited six months or more. So the decision looks like this:
- Certify when customers or tenders are asking for independent proof, or when you already hold ISO 9001 or ISO 27001 and can extend the system cheaply. Organizations with a working 9001 or 27001 system are often at the short end of the four-to-twelve-month range from gap assessment to certificate.
- Run the management system without certifying when you want the discipline and nobody is asking for the badge. A 30-person distributor with three AI tools can do all of that for a fraction of the cost.
If you are weighing it against the NIST AI RMF, that is voluntary guidance you can align to, and 42001 is the one you can certify to; the full comparison is in which do you need.
What it costs to find out where you stand
Market pricing in 2026 is reasonably consistent. A two-day gap assessment for a small organization using one or two AI tools runs about $1,500 to $2,500, a scoped readiness review for a larger organization runs $5,000 to $20,000, and total first-year cost for a 50-to-200-person company, including internal time, tooling and the certification body, is commonly quoted at $85,000 to $150,000. Treat those as ranges.
Our own offers are fixed-fee. The ISO 42001 gap assessment at $9,750 inventories every AI system in scope, maps it against Clauses 4 to 10 and Annex A, and returns a prioritized list of gaps and what it will take to close them. The AI-in-the-quality-system review at $5,000 is the narrower engagement for FDA- and ISO-regulated manufacturers who want the records question answered first. The full budget picture is in the implementation cost guide, and the sequence from gap assessment to certificate is in the implementation guide.
A first step you can take this week
You do not need a consultant to start. Take a spreadsheet and list every AI feature inside the software you already pay for: the ERP, the ATS, the LIMS, the helpdesk, the document-control system, the general-purpose assistant accounts, and the vendor add-ons nobody remembers buying. For each one, answer four questions:
- What does it produce (content, a forecast, a recommendation or a decision)?
- What decision does that output feed, and about whom (a product, a person, a customer)?
- Who reviews the output before the decision is made, and are they qualified to?
- What happens when it is wrong, and would you know?
In our experience the list is two to three times longer than anyone expected, and questions three and four are blank for most rows. That spreadsheet is the first thing an auditor asks for and the first thing a gap assessment builds. If you would rather build it with us, the ISO 42001 consulting page describes how we work, and contact us starts the conversation.
Frequently Asked Questions
Does ISO 42001 apply to a company that only uses AI tools it bought from a vendor?
Yes. ISO/IEC 42001 is written for organizations that provide, produce or use AI systems, and an off-the-shelf tool you subscribe to is an AI system you use. The management system covers the AI systems inside your scope, whoever built them.
What counts as an AI system under ISO 42001?
The standard borrows its definition from ISO/IEC 22989: an engineered system that produces outputs such as content, forecasts, recommendations or decisions for objectives that people set. A chatbot, a resume screener, a demand forecast and an assistant drafting procedures all qualify.
Did FDA really cite a manufacturer for using AI to write quality records?
Yes. In April 2026 FDA issued a warning letter citing inappropriate use of artificial intelligence under 21 CFR 211.22(c), because AI-written specifications, procedures and master records were released without qualified review. It is the first FDA citation of its kind.
Do we have to get certified to ISO 42001 if we use AI?
No. ISO 42001 is voluntary, and no law in the US or EU currently requires the certificate. Many organizations run the management system without certifying; the certificate matters when customers, tenders or a regulated context ask for independent proof.
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.