ISO/IEC 42001:2023, the first certifiable artificial intelligence management system standard, has moved from a vendor marketing claim to an enterprise AI procurement checkpoint through 2025-2026, appearing as a stated or preferred requirement in regulated-sector and EU AI RFPs; the certificate is a necessary-not-sufficient screen (it attests to a governance management system, not to any specific model's safety, accuracy, or data provenance), so the buying-committee discipline is to require the evidence behind it (scope statement, Statement of Applicability, certification body and accreditation, validity dates, product-level AI risk assessment) and to pair it with a control-baseline mapping (NIST SP 800-53 / AI RMF) and the buyer's own product evaluation rather than treating the certificate as proof.

Anchored on (a) ISO/IEC 42001:2023 at iso.org/standard/42001, published 18 Dec 2023, the first certifiable AI management system standard, same management-system family as ISO/IEC 27001; (b) isms.online procurement-and-tender analysis describing 42001 appearing in tenders with board-approved AI policy, auditable risk registers, and contractual audit rights as procurement criteria; (c) BSI Group ISO 42001 certification materials; (d) EU AI Act Regulation (EU) 2024/1689 Articles 9 (risk management) and 17 (quality management system) as the obligations 42001 maps toward. SOFT-SOURCING / VERIFY-BEFORE-PUBLISH FLAG: this claim was drafted 30 May 2026 against research conducted post the author's Jan-2026 knowledge cutoff. The DURABLE, verifiable core is the existence and nature of ISO/IEC 42001:2023 (pre-cutoff fact) and its management-system-not-product-certification structure. The POST-CUTOFF, root-domain-confidence elements Peter should verify before publish: (1) the strength and breadth of the 2025-2026 'appearing in RFPs' trend (sourced to isms.online + SAP community blog, characterised qualitatively, no hard adoption percentage asserted); (2) which specific major AI vendors now hold the certification; (3) that no EU AI Act implementing act has yet designated 42001 as a presumption-of-conformity route (stated cautiously in the piece). No adoption statistic is asserted as fact; the piece argues the pattern qualitatively. 90-day review cadence (28 Aug 2026). Trigger conditions: (1) a major vendor losing/failing to maintain certification, or a certification wave, materially shifts the landscape; (2) EU AI Act implementing acts or harmonised standards formally recognising or superseding 42001 strengthens or weakens the claim; (3) evidence of 42001 as a hard RFP gate (not preference) in North American procurement moves it from emerging toward established. Sibling AM-193 (nist-cosais-sp-800-53-ai-agent-security-gap) covers the runtime security-control layer; the procurement playbook and 60-question RFP pieces cover the wider buying process.