By Jackie Stapleton
Recently, I was on a Zoom with a group of consultants organized by CertBetter. They host a monthly session to talk about all things related to ISO consulting and industry updates.
The hot topic this week was ISO 42001:2023—the new AI management system standard.
I’ve seen it mentioned online, and of course, we’ve just launched our ISO 42001 course here at Auditor Training Online. But sitting there listening to the conversation, I realized I hadn’t really stopped to think about it from my own perspective as an auditor.
So, after all these years of drilling “maintain vs. retain,” you can forget it. It’s all about to change.
But terminology, whatever ISO calls it, doesn’t change the core reality: clear, consistent documentation matters. Procedures, records, “things we maintain,” “things we retain”—however you label them, good documentation is non-negotiable.
So, I did what I always do—I became even more curious and started asking myself questions.
- How does this new standard cross over with what I already audit in ISO 9001, ISO 14001, and ISO 45001?
- What’s actually new, and what’s just familiar concepts applied in a new context?
- And maybe the biggest question: Do auditors like me need to start paying more attention to this?
As one Harvard Business Review author notes, “As AI becomes more powerful, it faces a major trust problem…. The good news is that there is one consistent approach to addressing the trust gap: training, empowering, and including humans to manage AI tools.” That idea really connects with me as an auditor.
ISO 42001 is built on foundations of trust, accountability, and evidence, which are the same things we already look for in quality, environment, and OH&S systems. It made me wonder whether we’re already touching parts of AI management without realizing it, and if those same principles apply across all standards. With that in mind, let’s look at where AI might already be crossing over into the systems we audit every day.
Where AI meets quality, environment, and OH&S
Those questions I asked myself sent me down a bit of a rabbit hole. The more I looked at ISO 42001, the more I realized it isn’t a separate, tech-heavy standard. It shares the same management system structure we are already familiar with.
Where it becomes relevant is in how AI starts influencing the very processes we audit for quality, environment, and OH&S. In many cases, it introduces new risks, new decision points, and new expectations for evidence.
Here’s where those crossovers start to appear.
/LTS%202025/LTS%20Ed%2026/LTS%20Diagram%2026%20(2).png?width=740&height=989&name=LTS%20Diagram%2026%20(2).png)
We may not be auditing AI itself, but we’re already seeing its fingerprints across the systems we audit every day.
Next steps for auditors
- Ask where AI is already in play. During audits, look for AI-enabled tools or automation-influencing decisions. This could be in quality checks, environmental monitoring, HR, scheduling, or safety reporting.
- Evaluate how AI affects risk and evidence. Consider whether AI-generated outputs influence product quality, safety outcomes, or compliance data. If they do, check that risks, validation, and human oversight are built into the process.
- Check leadership awareness and accountability. Ask leaders if they know where AI is used and who is responsible for its decisions and outputs. Lack of clarity here often signals weak governance.
- Review training and competence. Confirm that staff using AI tools understand how to interpret results and verify accuracy, not just rely on the technology.
- Include AI considerations in audit planning. Add questions about AI use and governance to your audit checklists. You’re not auditing AI itself; however, you are auditing how it’s managed within the system.
About the author
Jackie Stapleton is the director of Auditor Training Online and holds multiple Exemplar Global certifications.
A version of this article first appeared on Auditor Training Online‘s Lead The Standard newsletter and is published here with permission.