ISO/IEC 42001 explained, and why it matters when your data room uses AI

ISO/IEC 42001 is the international management systems standard for artificial intelligence. It sets requirements for how an organisation governs AI: how risk is assessed before a feature ships, what data the AI is allowed to see, how humans oversee its outputs, and how it is monitored after release.

It is not a badge for having AI. It is an external audit of whether the AI is managed.

How it differs from ISO 27001

ISO 27001 covers information security: access control, encryption, incident response, the security of the system as a system. It says nothing about whether an AI feature was risk-assessed, whether its outputs are checked, or whether the data it trains or reasons over was permitted to be used that way.

ISO/IEC 42001 covers exactly that gap. The two are complementary, and a provider running AI over confidential documents should hold both.

Why it matters in a data room

When a data room offers to read the documents for you, three questions follow immediately. What does the AI see. Where does that processing happen. And who is accountable when it gets something wrong.

Certification does not answer those questions for you, but it means somebody independent has checked that the provider has answers, has written them down, and follows them. In a vendor review that is the difference between a claim and evidence.

What an auditor looks for

• A documented AI management system, with named accountability.
• Risk assessment of each AI feature before release, including the impact on people.
• Controls over the data AI systems may access, and the lawful basis for that access.
• Human oversight of outputs, and a route for someone to challenge one.
• Monitoring after release, and a process for withdrawing a feature that misbehaves.

Where Linkro sits

As of September 2026, Linkro is the only virtual data room provider we are aware of that holds ISO/IEC 42001 certification. We hold ISO 27001 as well. Based on our review of publicly listed certifications, last checked September 2026. If that has changed, tell us and we will update this page.

Linkro's AI features are opt-in, and security is identical whether they are on or off. AI inference runs in Australia, so document text is not sent to an offshore model provider.

What to ask any provider

Ask which standards they hold, on which public register you can verify each certificate, and what the scope statement on the certificate covers. Scope matters: a certificate can be narrower than the product. Then ask where inference runs and whether document text leaves the country.