Home / Answers / What does ISO 25568 change for ISO 42001?
What does ISO/IEC DTS 25568 change for ISO/IEC 42001?
Nothing in the 42001 requirements changes. The draft adds generative AI specific guidance on risk sources, stakeholders, risk analysis, treatment and controls. For an AIMS, that means the risk criteria, the impact assessment and the control evidence for generative AI get a closer reading, and the Annex A controls stay as they are.
Detail
The relationship in one line
Nothing in the 42001 requirements changes. The draft adds generative AI specific guidance on risk sources, stakeholders, risk analysis, treatment and controls. For an AIMS, that means the risk criteria, the impact assessment and the control evidence for generative AI get a closer reading, and the Annex A controls stay as they are.
What changes in the AIMS
The record separates what ISO has published from what it has not. The status, the stage history, the committee and the scope are public. The clause text is not. Every page on this site marks the difference, and the pages are written from the two published standards named in the record. None of them is a requirement of the draft.
What stays the same
Does ISO/IEC DTS 25568 replace ISO/IEC 42001?
No. 42001 remains the certifiable management system standard. The draft is guidance that sits under its risk work.
Which AIMS records are affected?
The AI risk assessment and treatment records, the impact assessment and the evidence for the Annex A controls that a generative AI use depends on.
Do the Annex A controls change?
The published 42001 control set does not change. What changes is the depth of evidence expected for a generative AI use.
Open the requirement record Run the free check
Related answers
Not legal advice; does not certify. Last updated: 2026-10-20.