Which ISO/IEC AI Standard Should a Health System Implement First?

What each standard is for

ISO describes ISO/IEC 42001 as the international standard for AI management systems. It provides requirements and guidance for organizations that develop, provide or use AI systems, and it defines how to establish, implement, maintain and continually improve an AI management system. For a health system, which mostly uses AI built by others, that scope applies directly.

ISO/IEC 23894:2023 is titled AI: Guidance on risk management. It describes processes for implementing and integrating AI risk management. It is guidance, not a set of requirements against which an organization is assessed. Its practical role is to give the risk process inside a management system some structure.

ISO/IEC 42005 addresses AI system impact assessment. It is best treated as a later input to how you assess individual systems, once the management system and risk process exist to receive its outputs. ISO/IEC 42003, planned guidance on implementing 42001, is still under development as of November 2026, so sequencing decisions should not depend on it.

One point applies to all of them. These standards define management and risk processes. Treat them as describing what your organization should decide, assign and review, not as a specification for how a model call is permitted or blocked in production.

How the standards compare for a health system

The table summarizes the role each standard plays. It does not replace reading the standards themselves.

• ISO/IEC 42001: AI management system requirements and guidance. Role: program anchor covering policy, accountability, operation and continual improvement.
• ISO/IEC 23894: Guidance on AI risk management. Role: structure for identifying, assessing and treating AI risk within the management system.
• ISO/IEC 42005: AI system impact assessment. Role: per-system assessment input, sequenced after the program and risk process are working.
• ISO/IEC 42003: Planned guidance on implementing 42001, under development. Role: monitor only, do not plan around it yet.

A defensible adoption order

Start with scope, not with a standard. List the AI systems in use and identify which create, receive, maintain or transmit ePHI. That inventory determines where HIPAA technical safeguards apply and what a management system scope statement can honestly claim.

Then anchor on ISO/IEC 42001. It is the standard that gives you a management system to build around, and it is the one an organization can structure its program and scope statement on. If you already operate an ISO 27001 program, you have experience running a management system, and your compliance team will likely recognize the discipline involved. Whether specific processes can be reused is a scoping conversation to have with your certification body.

Adopt ISO/IEC 23894 alongside or immediately after, as the method for your AI risk process. Add ISO/IEC 42005 impact assessments when you are ready to apply them consistently to individual systems.

The tradeoff is that a management system can be documented well and still say little about what a deployed AI system did on a given day. That gap is why the order above ends with enforcement and evidence rather than certification paperwork.

Where HIPAA changes the priorities

ISO guidance does not substitute for the HIPAA Security Rule, and the two should be kept as separate evidence sets. Three provisions matter most when AI touches ePHI. The mapping below is editorial inference, not a published crosswalk.

The audit controls standard, 45 CFR 164.312(b), requires hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. The text is technology-neutral, but it requires both recording and examining, so a record nobody can review is not clearly sufficient.

The access control standard in 164.312 requires that systems maintaining ePHI allow access only to persons or software programs that have been granted access rights. Because the text covers software programs, AI systems acting on ePHI are within its reach. They should be attributable to an identity and an access right.

The information system activity review specification, 164.308(a)(1)(ii)(D), is a required implementation specification. It calls for regular review of records such as audit logs, access reports and security incident tracking reports. OCR's cybersecurity newsletters in January and October 2026 reference these provisions, so audit-log practice is a current area of regulatory attention.

In management-system terms, the controls you would expect to concern operation, monitoring and accountability for AI systems using PHI are the ones where documentation alone falls short. They need operational enforcement and retrievable records.