ISO/IEC 42001 specifies requirements for an AI management system, and certification attests that the management system meets the standard. The Automation Report is a different document. It states how much of a company is automated, what it costs, and whether it works, for the board. A company can hold both. They answer different questions.
01 · The standard
ISO/IEC 42001:2023 was published in December 2023 by the International Organization for Standardization and the International Electrotechnical Commission. It is the first international standard for AI management systems. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organisation, and it applies to any organisation that provides or uses AI-based products or services, whatever its size or sector. The standard's stated aim is the responsible development and use of AI systems. Adoption is voluntary.
ISO does not certify organisations. Certification is performed by independent certification bodies, and those bodies may in turn be accredited by a national accreditation body. The standard is published at ISO/IEC 42001.
02 · The report
kn0w issues the Automation Report. Seven recorded sessions with the CEO and six function heads, in writing, then by voice, become six readings: Workflows, Tools, Skills, Oversight, Spend and Outcomes. The readings combine into the kn0w Score, 0 to 100, placed against companies of the same sector, the same country and 50 to 500 staff. The report is fixed at issue. Quarterly Reviews at months 3, 6 and 9 show movement against it, and the Annual Report at 12 months runs all seven sessions again. How each reading is made is published at kn0w.co/methodology.
03 · How they compare
| ISO/IEC 42001 certification | The Automation Report | |
|---|---|---|
| What is examined | The AI management system: the organisation's policies, objectives and processes for managing AI | How much of the company is automated, what it costs, and whether it works, across six readings |
| What is issued | A certificate that the management system meets the standard, with a defined scope | A report with the kn0w Score, its band, peer placement and a four-part identifier |
| Who issues it | A certification body, which may be accredited by a national accreditation body | kn0w, under a published methodology |
| Cadence | Maintained through the certification body's surveillance cycle | Quarterly Reviews at months 3, 6 and 9; the Annual Report at 12 months |
| What the board reads | The certificate and its scope statement | The Board Summary at the front of the report |
04 · Holding both
Certification answers whether the organisation's management system meets a published standard. The report states how much of the company is automated, what it costs and whether it works, at a point in time, against companies of the same sector, country and size. One attests to a system. The other states where the company stands.
APRA's April 2026 letter to industry lists recognised control frameworks among its minimum expectations on AI risk. What the letter expects is set out at What does APRA's AI letter to industry expect?
05 · Frequently asked questions
No. ISO develops and publishes the standard. Certification is performed by independent certification bodies, and those bodies may in turn be accredited by a national accreditation body.
No. Certification attests that a management system meets a published standard. The Automation Report states how much of a company is automated, what it costs and whether it works, across six readings placed against peers.
Adoption of the standard is voluntary, and certification is a choice an organisation makes rather than a regulatory filing. Where regulators have set expectations on AI risk, such as APRA's April 2026 letter, they have referenced recognised frameworks and independent examination of AI systems without prescribing a particular standard or instrument.
Yes. They examine different things and are issued by different parties. A certificate covers the management system. The report states where the company stands. Report 000142 is a published example.
It depends on the question being asked. A customer questionnaire or tender that names ISO/IEC 42001 points to certification. A board asking how much of the company is automated, what it costs and whether it works points to the report. One does not substitute for the other.
Published 24 August 2026. Updated 2 October 2026. Verified against ISO and certification-body primary sources on 24 August 2026.