ISO 42001 won't stop the Questions. But perhaps that's not the Point.

A client of mine added a generative AI feature to their product a few months ago. Reasonable move — their customers were asking for it, competitors were shipping it, the roadmap made sense. Then their next round of customer security questionnaires landed, and one line changed everything: "Does your application use generative AI?"

They checked yes. Honestly, correctly — and probably without thinking too hard about what it would trigger.

What it triggered was a second questionnaire hiding inside the first one. Is customer data used to train the models? Are the models yours, or a third party's? Is there a human in the loop before an AI-generated output reaches a customer? Where does the data go, and who else can see it? None of this was in the original security questionnaire template. It got added, line by line, because AI changed what "vendor risk" means to the people filling out those forms.

My client's instinct, reasonably, was to look for something that would make this go away. That's when ISO 42001 — the new AI management system standard — came up. Get certified, the thinking goes, and the questions stop. Show the badge, skip the interrogation.

I don't think that's what's going to happen, and I said so.

Certification doesn't answer the question. It just means you have an answer.

ISO 42001 is a management system standard, not a product certification. It doesn't test what your AI does — it audits whether you have a consistent, documented process for governing what your AI does: risk assessment, human oversight, data handling, ongoing monitoring. That's genuinely valuable. It's also not the same thing as pre-answering "do you train on our data" for every customer who asks.

This isn't a new pattern. Companies with SOC 2 reports still fill out full security questionnaires. ISO 27001 doesn't exempt anyone from disclosing how they handle a specific customer's data. Certifications compress and speed up these conversations — they rarely eliminate them, because the customer's own legal and procurement teams need answers specific to their own risk, not a general attestation that a process exists somewhere.

I'd expect ISO 42001 to behave the same way. The AI-specific questions on a questionnaire aren't going anywhere, whether or not the vendor answering them is certified.

So what does it actually buy you?

Consistency. Right now, my client answers these AI-governance questions the way most companies do at this stage: ad hoc, whoever's on the call, best guess, hope it matches what was said on the last call. That's a real risk that has nothing to do with what the AI actually does — it's the risk of one salesperson promising "no, we never train on your data" while the actual policy is more nuanced, or a founder giving a slightly different answer to two different prospects in the same week.

An AI management system — the actual operational thing ISO 42001 certifies, not the certificate itself — forces that to be written down once, kept current, and answered the same way every time. The certification is the receipt. The value is upstream of it: the discipline of having settled, defensible answers before the questionnaire arrives instead of improvising when it does.

That's a smaller pitch than "customers will trust you more." It's also one I can actually stand behind, because I looked for evidence that certification measurably moves enterprise buying decisions and didn't find much — mostly forecasts and vendor marketing, not adoption data. Consistency and internal defensibility, on the other hand, are outcomes a company can verify for itself in the first week of doing the work, without waiting for the market to decide a badge matters.

Where my client landed — for now

They haven't decided yet, and I think that's the right call at this stage, not indecision. Their read, and I think it's a fair one: it may simply be too early. Most of the customers asking these AI questions are still working out what they're even trying to protect against — the questionnaire language itself is being written in real time, industry by industry. Asking those same customers to recognize and value a brand-new AI governance certification, on top of everything else on their vendor risk checklist, may be asking too much, too soon.

That doesn't mean the underlying work isn't worth doing. It means the badge and the business case for the badge are running on different clocks. The governance work — knowing your answers, keeping them consistent, being able to prove it internally — pays off immediately, questionnaire by questionnaire, whether or not a customer has ever heard of ISO 42001. Whether the certification itself becomes something buyers actively look for is a separate bet, and right now, nobody has enough evidence to make it confidently.

Get the posture right first. Let the badge catch up to the market whenever the market's ready for it.