ISO 42001 explained, why an AI management certification matters more than a demo

 

Every AI demo works. The vendor chooses the case, the inputs are clean, and the output lands exactly where it should. Nobody books a demo to show you the case where the tool got it wrong.

That is the problem with judging AI on a demo. In a regulated advice business, the important question is not how the tool performs on a good day. It is what happens on a bad one: who notices, who decides what to do, and where that decision is written down. ISO 42001 is the closest thing the market has to an answer. It is also widely misunderstood, sometimes by the firms that hold it.

What ISO 42001 actually is

ISO/IEC 42001:2023 is the international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an artificial intelligence management system, usually shortened to AIMS. Published in December 2023, it sits in the same family as ISO 27001 and ISO 9001. ISO lists its methodology as a management system standard following the Plan-Do-Check-Act approach. It also applies whether you build AI, buy it, or merely use it.

In practice, certification means an organisation keeps an inventory of its AI, assigned accountability, assessed risks, and controls that an accredited auditor has examined and found working. The standard also gives explicit attention to the impact of AI systems on individuals and groups, not only on the organisation. That point matters in mortgage advice, where the person affected by an AI output is a borrower, not the firm. ISO/IEC 42001 is a voluntary standard. No regulator requires it.

What a certificate does not prove

This is where marketing tends to go too far. Certification attests to the management system, not to the accuracy or fairness of any individual model. A certified vendor can still ship a model that makes mistakes.

What certification does tell you is that the vendor has a system for finding those mistakes, owning them and fixing them. It also tells you that an auditor has checked that the system works. So if a vendor tells you its certificate proves its AI is unbiased or "safe", treat that as a warning sign, not a reassurance.

Why the system matters more than the demo

The FCA has said plainly that it does not plan to introduce extra regulations for AI. It relies on existing rules instead. Under SM&CR, responsibility must sit clearly within the SM&CR, even where systems are outsourced.

If your firm uses a third party's AI in sourcing, affordability or compliance checks, the accountability stays with you. Your oversight is only as good as the evidence the vendor can give you.

The FCA's own findings show where firms fall short. In its good and poor practice publication of 19 October 2026, some firms' decisions on AI tools were poorly documented with limited audit trails or supporting rationale. Others only had governance for specific AI lifecycle stages, e.g. post-launch. By contrast, good practice included named accountable individuals, with clear decision ownership and sign-off. A demo cannot show you an audit trail, a named owner, or how the vendor responds when a model drifts six months after launch. A management system exists to show exactly those things. That is why certification matters more than a demo. It does not prove the AI is right. It shows that someone is responsible for finding out when it is wrong.

How to check whether a certificate is worth anything

Before you rely on a certificate, ask four questions.

Who issued it, and are they accredited? Accreditation for this standard is still new. UKAS only granted BSI the first accreditation for certification of artificial intelligence (AI) management systems to ISO/IEC 42001:2023 in November 2025. One compliance vendor's guidance suggests checking current accreditation status using official sources, such as IAF CertSearch, ANAB directories, or UKAS registers, rather than relying solely on marketing claims.

What is in scope? A certificate can cover a narrow part of a business. Ask whether the AI features you will actually use sit inside the certified scope.

Is it current? Ask for the issue date and the date of the most recent audit.

What happened last time the tool was wrong? Ask the vendor to walk you through a real incident: how it was spotted, who owned it and what changed. A vendor with a working management system will have an answer.

Where we stand

Mortgage Magic™ announced it has achieved certification for ISO 42001 in January 2026, alongside ISO 27001 and ISO 9001. Hold us to the same test as anyone else. Ask for the certificate, the issuing body and the scope.

Certification is also only half the picture. It covers how we govern AI as an organisation. It does not explain any single recommendation to an adviser or a borrower. That is the job of the Glass Box AI approach set out in The Precision Paradox, which shows the reasoning behind an output rather than hiding it. The two answer different questions, and an advice firm needs answers to both.

What to ask at your next demo

Watch the demo. Then ask three questions. Who owns the risk when this gets it wrong? Can I see the audit trail for the last thing that went wrong? Is the feature I am buying inside your certified scope? If the answers are vague, the demo told you very little.