A new British Standards Institution (BSI) standard sets out requirements for bodies providing audit and certification of artificial intelligence (AI) management systems (AIMS).

BSI is the UK’s National Standards Body and represents the UK in international standards making, which is led by the International Standards Organisation (ISO). The new standard, BS ISO/IEC 42006:2025, aims to develop consumer confidence and promote consistency in the auditing of AI management systems. 

AI systems have unique characteristics such as continuous learning and adaptability, which can create challenges around transparency, data quality and accountability. 

A separate AI management systems standard, ISO/IEC 42001, published in December 2023, defines the purpose of an AIMS as being to establish policies, objectives and processes for the responsible development, provision or use of AI systems.

There are many factors that can have an impact on the quality and reliability of an audit, including the competence of the auditor, the suitability of audit procedures and the quality control measures in place. Increasing demand for independent assurance, and the continued spread of AI technologies across industry and society, means there is a growing need for frameworks governing AI auditing.

The complex nature of AI means that auditing an AIMS requires multidisciplinary skills that are not naturally present in one person, a subject explored in the skills session of ICAEW’s inaugural AI Assurance Conference. Necessary skills cut across several areas, including technical AI skills, auditing skills, ethics, legal and regulatory, and client and industry specific skills. 

Requirements for skills and wider considerations such as independence, confidentiality and process requirements are documented in the new standard.

The standard also provides a framework to assess and accredit UK certification bodies that wish to certify to ISO/IEC 42001. It also provides criteria to help certification bodies demonstrate their ability to perform these audits.

Esther Mallowah, Head of Tech Policy at ICAEW and a member of BSI’s AI Committee (ART/1), says: “Auditors will be familiar with performing their work in accordance with relevant audit frameworks and standards. While no overarching and comprehensive AI assurance framework exists, ISO/IEC 42006 is a helpful tool in addressing some of the challenges associated with the quality of AI audits. 

“However, it is important to note that the standard applies to a very specific audit – the audit of an AI management system against the ISO/IEC 42001 standard. ISO/IEC 42006 is not a standard for any and all AI audit and assurance activities as can sometimes be assumed.”

ISO/IEC 42001 was the world’s first AI management system standard. It provides AI developers, users and implementers with guidance on how to govern AI systems, including guidance on policies and processes, roles and responsibilities, risk management and evaluation and monitoring. 

The new standard further provides criteria for establishing, implementing, maintaining and continually improving an AIMS, and is designed to help enable international mutual recognition of AI certifications, simplifying market access for organisations adopting the 42001 standard.

Dr Sam De Silva, Partner and Global Co-Head of the Commercial Practice Group at international law firm CMS, says: “BS ISO/IEC 42006 is the essential companion to ISO/IEC 42001, translating management-system principles into a rigorous, internationally recognised assurance process. By setting out clear requirements for auditor competence, impartiality and methodology, it should give boards, regulators and the public confidence that AI management systems have been examined with consistency and depth. 

“The standard has the potential to become a cornerstone for trustworthy, scalable and globally accepted AI assurance,” says Dr De Silva, who is also a member of ICAEW’s Tech Faculty Board and BSI’s ART/1 Committee.

Dr De Silva has written an executive briefing of the standard, which can be downloaded by completing a form on the BSI Group pages. Gavin Jones, Lead Standards Development Manager (Quantum, AI and Digital Accessibility) at BSI has also written an article to provide further details about BS ISO/IEC 42006:2025. 

ICAEW will host a webinar on 26 September discussing AI governance and the role of ISO/IEC 42001. The webinar will cover the benefits and limitations of the standard as well as how the standard can help boards, audit committees and other oversight groups in supervising the management of AI risks within their organisations.