ISO gave AI a management system. It did not define your training data.

ISO/IEC 42001 is a useful artifact for organizations trying to govern AI as an operating discipline. It is not a magic certificate that turns unowned data into governed data.

ISO describes ISO/IEC 42001:2023 as an international standard for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System. It frames AI governance as policies, objectives, processes, risk management, traceability, transparency, and reliability. In other words: a system, not a slogan.

That matters because AI programs keep pretending governance begins at the model boundary. It does not. The inputs have names, sources, purposes, retention rules, owners, exceptions, and dispute paths before the model ever sees them. A management system can require those things to be documented and reviewed. It cannot make the organization agree that 'customer', 'case', 'account', or 'ground truth' means the same thing across the teams feeding the system.

This is where certification theater tries to enter. A certificate can prove that a process exists. It cannot prove that the definition it carries is the right one, current one, or owned one. That is not a criticism of the standard. It is a reminder that a standard is strongest when the boring local nouns have already been written down.

Watch the implementation documents, not the badge. The valuable evidence is the register of AI systems, data assets, purposes, controls, exceptions, and accountable owners. If the implementation cannot point to the person who owns the training-data definition, the management system is holding a blank space very neatly.