The US Regulatory Case for an ISO 42001 AI Management System

The board wants to know which US AI law to comply with. That is the wrong question, because there isn’t one, and there may not be a federal one for years.

Most of what is written about US AI regulation is written by people who want you to buy something before a deadline that keeps moving. There is no comprehensive federal AI statute. The state that got furthest with one has just retreated from it. And a firm that waits for the rules to settle will wait a long time while its customers, its insurers and its regulators start asking questions anyway. The pragmatic move is not to chase every emerging state rule as it lands. It is to build one credible framework that answers most of them at once, and the strongest candidate for that anchor is ISO/IEC 42001, the international AI management system standard.

What the US landscape actually looks like right now

Start with the honest position, because the vendors will not give it to you. There is no federal AI law. On 11 December 2025 the President signed an executive order directing officials to draft a uniform federal AI framework that would pre-empt conflicting state laws. An executive order cannot do that on its own; only Congress or the courts can override state statutes. So what the US has is a stated direction of travel, not a rulebook.

The states are no more settled. Colorado passed the first comprehensive state AI law, SB 24-205, in 2024, then repealed and replaced it before it ever bit. The replacement, SB 26-189, was signed on 14 May 2026 and takes effect on 1 January 2027. In the process it dropped the algorithmic-discrimination duty of care, the mandatory impact assessments and the “high-risk AI system” terminology that had made the original notable, and narrowed to documentation of automated decision-making technology plus a set of consumer rights. Whatever else that tells you, it tells you the text is not stable enough to map a compliance programme against.

That instability is the point. You cannot bolt your controls to a specific statute when the statute is rewritten between drafting and enforcement. What survives every version, in Colorado and in the federal framing alike, is the same underlying demand: know your AI systems, document their intended and known harmful uses, be transparent, and be able to show a governance process operating. That is a management-system requirement, not a clause you can cite.

Why a management system beats a control checklist

ISO/IEC 42001 was published in December 2023 as the first international AI management system standard. It is not a list of controls to tick. It is a management system in the same mould as ISO 27001 for information security or ISO 9001 for quality, built on the same high-level structure: an AI policy, defined roles and accountability, a risk-assessment process, a set of controls drawn from its Annex A, internal audit, and management review on a cycle. Plan, do, check, act, applied to the AI you build and buy.

The reason that shape matters in the US context is that a management system produces evidence as a by-product of operating, rather than as a fire drill when a customer’s diligence questionnaire lands. The risk assessments exist because the system requires them, not because someone asked. The system inventory is maintained continuously, not reconstructed under deadline. If you want the detail of what an auditor will expect you to demonstrate, we have written that out separately. And because 42001 is certifiable by an accredited third party, the output is an external attestation. That is what turns “we have an AI policy” into something a counterparty will accept without re-auditing you line by line.

The two demands a certified AIMS answers at once

The first is state documentation. Whatever survives Colorado’s reset, and whatever Texas, Utah, California and the rest eventually land on, the common core is consistent: an inventory of your AI systems, documentation of intended and known harmful uses, disclosure to affected people, and some route to human review of consequential decisions. A management system whose system inventory and risk assessments are real already produces most of that as standing output. When a new state rule arrives, you are mapping an existing evidence base to it, not building one.

The second is customer diligence. Enterprise buyers now send AI questionnaires the way they have long sent security ones, and they send them whether or not a law compels you to answer. A recognised certificate short-circuits weeks of bespoke back-and-forth, because it lets a counterparty rely on an accredited auditor’s work instead of running their own. One artefact, produced once, serves both the regulator and the customer. That dual payoff is the whole argument for treating certification as a strategic bet rather than a compliance cost.

Where it does not save you

Certification is not compliance, and anyone who tells you otherwise is selling the certificate. A 42001 certificate evidences that you run a governance system; it does not make you compliant with any particular state law. If a statute imposes a substantive duty, a specific bias-testing requirement, say, or a disclosure in prescribed form, you still have to meet that duty. The AIMS is the scaffolding on which you hang it, not the thing itself.

A certificate is also only as good as its scope statement. “AIMS certified” covering one internal chatbot tells a diligent counterparty nothing about the model sitting in your lending or hiring decision. Read the scope before you rely on it, and write your own scope to cover the systems that actually carry regulatory and reputational risk. And because it is a management system, it can be run as theatre: an annual review that rubber-stamps an unchanged document satisfies the letter and none of the intent, the same failure mode that hollows out any ISO system.

Finally, 42001 overlaps with, but is not identical to, NIST’s AI Risk Management Framework, the voluntary US-origin framework many American buyers actually ask about. The two crosswalk cleanly enough that you should not have to choose, but you do have to map them deliberately rather than assume one answers for the other. We have set out how that crosswalk works in practice; the short version is that one control environment can satisfy several frameworks if you design it that way from the start.

The bet, stated plainly

Adopting a 42001 AIMS in the US is a bet that the regulatory direction, federal or state, will keep demanding the same underlying things: documented systems, risk assessment, human oversight and transparency. On the evidence that is a safe bet. Every version of every proposal, and the federal executive order’s own framing, converges on governance evidence rather than on any single prescriptive rule. Build the management system once, certify the scope that matters, and you hold a defensible posture that does not need re-engineering each time a legislature changes its mind.

The firms that will struggle are not the ones without a federal law to follow. They are the ones that read the absence of a law as permission to have no system, and discover, the first time a customer or a state attorney general asks, that “there is no rule yet” is not an answer anyone accepts.