What Is ISO 42001? The AI Management Standard Explained: South Africa

Can you list every AI system your organisation uses? That’s often the first question in an ISO 42001 audit.

ISO/IEC 42001:2023 is the international standard for managing AI responsibly. It requires an AI management system, which is the set of rules, roles and checks you use to develop, provide or use AI. Certification is voluntary. For South African telecom teams, the ISO 42001 standard explained comes down to knowing which AI you use, who oversees it and what evidence you can show.

Many telecom teams find that list harder to write than expected. So, who should be building it? It depends on your role in the AI chain.

Who needs ISO/IEC 42001 in South Africa?

Any South African organisation that develops, provides or uses AI can consider ISO 42001. In telecom, that includes operators, network providers and service providers. ISO 42001 for telecom starts with your actual role. You choose controls through a risk and impact assessment, which means checking what could go wrong for people and the business. 

●      Telecom operators: AI in network planning, fraud detection or customer chatbots. Auditors look at risk assessments and human oversight.

●      AI developers and vendors: design, testing and data governance for the AI they supply.

●      Integrators: supplier control and change records when fitting third-party AI into telecom systems.

●      Users of third-party AI: you still need oversight; supplier checks and clear accountability.

Think you only use AI if you built it? Read the last bullet again.

Is ISO 42001 mandatory in South Africa?

ISO 42001 is voluntary. The standard itself doesn’t force any organisation to certify. But “voluntary” doesn’t always mean “optional in practice.” Customers, partners or regulators may still ask for it. Don’t assume a legal duty either way. Check current South African requirements with official sources. 

Voluntary is one thing. Is ISO 42001 also a legal requirement or approval?

Is ISO/IEC 42001 the same as AI regulations or POPIA?

ISO 42001 and legal requirements are different things. ISO 42001 is a management system standard, not a law, registration, licence or regulatory approval. It supports AI governance in South Africa, but it doesn’t prove you meet the Protection of Personal Information Act (POPIA) or any AI rule. 

What does ISO 42001 certification in South Africa involve?

The ISO/IEC 42001 requirements apply to a system you build yourself. The certification body only audits it. Here’s the path:

1. Define your scope.

2. Build your AI management system yourself.

3. Run an internal audit.

4. Hold a management review.

5. Stage 1 audit: the auditor reviews your documents and readiness.

6. Stage 2 audit: the auditor checks the system in practice.

7. Certificate decision.

8. Surveillance audits during the certificate cycle.

9. Recertification. 

What will an auditor actually ask to see?

A telecom company may be asked to show its AI risk assessment, where its data comes from and who can override an AI decision. The last question surprises people. If nobody can step in, the system isn’t under control. Evidence matters because it shows the rules work in daily operations.

Common ISO/IEC 42001 mistakes in South Africa: 

●      Leaving it to IT alone. AI touches legal, risk and operations too, so those teams need a seat at the table.

●      Forgetting the AI they didn’t build. Tools bought from suppliers often never make it onto the list.

●      Writing policies but showing no proof. A policy says people oversee the AI. The auditor wants to see who did it and when.

●      Treating the certificate as legal cover. It shows your management system works. It doesn’t prove you meet the law.

●      Picking an accredited certification body without checking its scope. Accreditation for one standard doesn’t mean accreditation for ISO 42001.

Example: A telecom operator lists its own AI tools but forgets a chatbot supplied by a vendor. The risk assessment never covers it. The gap stays hidden until someone asks.

ISO 42001 checklist for South Africa:

Tick what you can answer today. The gaps show where to start.

●      I know which AI systems my organisation develops, provides or uses, including supplier AI.

●      I know our role: developer, integrator, operator or user.

●      Someone owns AI risk and can show records.

●      I can show where our data comes from and who reviews AI outputs.

●      I understand ISO/IEC 42001 doesn’t replace POPIA or other legal duties.

●      I will check a certification body’s accreditation before choosing one.