ISO/IEC 42001 and TEAF: what an AI management standard covers, and what it leaves open

One question now keeps appearing in vendor questionnaires: "are you ISO/IEC 42001 certified, or working towards it?" It deserves a precise answer, and it forces TEAF to state where it stands. A management standard and an architecture framework do not answer the same question — and pretending otherwise would be exactly the kind of shortcut this framework rules out.

What the standard is, exactly

ISO/IEC 42001:2023 is the first management system standard devoted to artificial intelligence (an AIMS, for AI Management System). It follows the common structure of management standards — the same as ISO/IEC 27001 for information security — which explains its rapid uptake: an organization that already runs a management system knows precisely what is being asked of it.

It essentially requires: an AI policy, named roles and responsibilities, risk assessment, impact assessment of AI systems, lifecycle management, supplier control, and documented continual improvement. The companion standard ISO/IEC 42006:2025, published on 7 July 2025 and taken up by accreditation programmes during 2026, sets the requirements for bodies that audit and certify those systems; it supplements ISO/IEC 17021-1. In other words, the certification chain is now complete, auditors included.

What a certificate does not say

Two clarifications are worth writing down, because they are routinely glossed over in sales material.

First, the standard has been adopted in Europe as EN ISO/IEC 42001:2026, but it is not, to date, cited as a harmonised standard under the AI Act. A certificate therefore confers no presumption of conformity with the European regulation. It demonstrates that a management system exists and works; it does not demonstrate that a given AI system meets a specific regulatory obligation.

Second, a management system certifies a process, not an outcome. That is its strength — auditable, repeatable, comparable across organizations — and its limit: an organization can keep impeccable records while letting its architecture decisions go stale. "Do you have a process?" and "does your governance keep pace with your execution?" are not the same question.

What TEAF covers, and what it does not

The most direct correspondence sits between the AIMS requirements and three elements of TEAF: the AI Control Plane, which carries the inventory and the framing of AI systems; the AI Control Officer, the role accountable for it; and the Compliance Liaison, who attaches regulatory obligations to the Loop rather than handling them in a separate register.

What TEAF adds over that scope comes down to three mechanisms:

• Temporality. The Living ADR makes a decision's expiry visible. A standard asks you to review "at planned intervals"; TEAF asks you to know, at any moment, which of your decisions no longer holds.
• Qualifying knowledge. The Declared, Observed, Inferred, Validated taxonomy forces you to say where each finding comes from. An AI register filled with unverified declarations satisfies a documentary requirement; it tells you nothing about reality.
• Closing the loop. Observation and Learning bring what is seen in production back to the decision. That is the part a management system handles through periodic audit, at a frequency that is not the frequency of agentic systems.

And what TEAF does not cover must be said too: there is no recognised TEAF certification, no accredited body, no equivalent of ISO/IEC 42006. TEAF therefore does not replace ISO/IEC 42001 in a tender, and does not claim to.

The honest reading: both, in this order

An organization that needs evidence it can put in front of customers needs the standard. An organization that wants its governance to survive the speed of its agents needs a loop. The sequence that works is this one: lay the loop first, because it produces the material — a real inventory, dated decisions, instrumented observations — that the certification audit will then ask for. The reverse order produces a compliant binder and a drifting architecture.

It is the same reasoning applied to TOGAF, ITIL, COBIT and SAFe: TEAF was never offered as a replacement, but as the layer that closes what those frameworks leave open. ISO/IEC 42001 joins that list with the same status.

A caveat on the figures

Several publications quote rates at which the standard appears in tenders, or certification timelines and costs. Those figures come from vendors and consultancies that sell implementation support; they give a direction, not a measurement. What is verifiable, by contrast, is that several large digital service providers have been certified since late 2024, and that the auditor accreditation chain took shape during 2026. The knowledge status here is Observed for published certifications, and Inferred for anything concerning the scale of adoption.

• ISO/IEC 42001 certifies an AI management system, not the conformity of an AI system.
• It is not, to date, a harmonised standard under the AI Act: no presumption of conformity.
• ISO/IEC 42006:2025 frames the certifiers and makes the audit chain credible.
• TEAF is not certifiable and does not replace the standard; it adds temporality, knowledge qualification and loop closure.
• Lay the loop before the audit: it is what produces the evidence the audit asks for.

Sources

• ISO/IEC 42001 — official page
• ANSI — ISO/IEC 42006:2025, AIMS audit and certification
• Status of the ISO/IEC 42000 standards family in 2026