HCLTech just became one of the first organisations certified to ISO/IEC 42001:2023, the management system standard for artificial intelligence. If you read that and thought "good for them, doesn't apply to my plant" — you're wrong, and the gap will cost you. Not because the standard is coming for you tomorrow. Because the logic it applies is the same logic your customers already audit you against, and the AI systems sitting on your lines right now are not ready for it.

ISO 42001 doesn't care if your AI works. It cares if you manage it.

The signal flare

HCLTech's certification matters less for what HCLTech does and more for what it signals. Apollo Tyres is scaling AI across its manufacturing plants. McLaren is deploying FieldAI robots for QA and deviation handling on site. Semiconductor firms are feeding AI-driven data forward into chiplet-based test regimes. Every week another manufacturer bolts an AI system onto a production line and calls it innovation.

Here is what I actually find when I walk into plants — plants with solid AS9100 or IATF 16949 systems, where the PFMEA is current, the control plan is living, the 8D files actually close. The AI components sit entirely outside the quality management system. Deployed by IT. Validated by the vendor at a demo. Never risk-assessed against operational impact. Never integrated into the internal audit schedule. Never given a deviation-handling path.

ISO 42001 treats AI the way AS9100 treats welding or IATF 16949 treats machining: as a process that must be defined, assessed, controlled, and auditable. The standard isn't about ethics frameworks or philosophical debates about machine consciousness. It's a management system standard. Same skeleton. Different process.

What 42001 actually demands

If you know AS9100, you already understand the architecture of 42001. Risk assessment. Documented procedures. Competency records. Corrective action. Internal audit. Management review. The machinery is familiar to anyone who has been through a certification cycle.

The difference is that the process is your AI.

That means every AI decision point on your line — the vision system that clears or flags parts, the scheduling algorithm that sequences builds, the predictive maintenance model that halts equipment — is subject to the same discipline as any other process variable. Define what it does. Assess what happens when it's wrong. Document who is competent to operate and maintain it. Have a corrective action path when it fails.

I've seen what systematic process management delivers when it's done properly. At Airbus, we cut EASA audit findings by 50% in a single cycle — not by adding bureaucracy, but by making sure every process was actually mapped, owned, and auditable. The AI on your line deserves the same treatment. Right now it gets almost none.

A model you can't audit is a defect you haven't found yet.

The integration gap

Most manufacturers are exposed here, and they don't realise it until a customer auditor starts asking questions.

I've been in plants where the automated inspection system was bought by purchasing, installed by the vendor, validated on three golden parts, and has been running for eighteen months without anyone in quality touching the documentation. The AI model inside it has drifted. The training data doesn't match current product. The acceptance criteria were set by the vendor's application engineer during commissioning and never reviewed. When the system clears a part that fails downstream, there's no traceability between the AI disposition and the part history. The 8D opens, the team scrambles, and nobody can explain why the AI made the decision it made.

In an IATF 16949 or AS9100 context, that would be unconscionable for any other process. You wouldn't run a heat-treat oven without a documented temperature profile, a control plan entry, a PFMEA line item, and a competent operator. You wouldn't accept a machining centre where the capability study was done by the machine builder and never re-validated. But because the system has "AI" in its name, it gets a pass.

That pass expires the moment a customer auditor who understands 42001 — or even a customer who simply applies existing IATF or AS9100 logic rigorously to AI processes — walks your floor.

What audit-ready AI looks like

Getting AI into your quality system isn't complicated, but it requires deliberate work, and the framework already exists in the standards you're certified to. Take the control plan. If an AI vision system makes a pass-fail call on a critical characteristic, that decision point belongs in the control plan with the same structure as any other inspection: method, frequency, reaction plan, responsibility. A neural network instead of a gauge doesn't change the discipline. Then there's validation — real validation, not the vendor demo. Vendor validation proves the system works in the vendor's lab on the vendor's parts. You need your parts, your environment, your process variation, and defined re-validation triggers when product, process, or model changes occur. Same logic as any IATF 16949 process change.

Traceability is where it falls apart for most plants. Every AI decision must link to the specific part or batch it affected. When the model clears something it shouldn't, you need to know which parts, when, and why — fast enough to contain. And when it does go wrong, deviation handling kicks in: containment, investigation, root cause. The root cause may be model drift, training data deficiency, or a process change the model wasn't updated for. Corrective action closes the loop.

Key takeaways

  • ISO 42001 applies the same management system logic as AS9100 and IATF 16949 — if you can manage a welding process to audit standard, you can manage an AI process. The discipline transfers; the technology doesn't change the framework.
  • Any AI system on your line that doesn't appear in your PFMEA, control plan, and internal audit schedule is a gap your next customer audit will find. Map every AI decision point now, before someone else maps it for you.
  • Vendor validation is not process validation. Demand re-validation on your parts, in your environment, with defined triggers when product, process, or model changes.
  • Traceability is non-negotiable. If you cannot link an AI disposition to a specific part and reconstruct the decision path, you have no containment capability — and in aerospace or automotive, that is an escalation waiting to happen.

42001 will follow the same adoption curve as every management standard before it. Ignored. Feared. Then routine. The manufacturers who integrate AI into their quality systems now — while it's twenty nodes on a control plan and a handful of validation reports — will barely notice the transition. The ones who wait will learn the lesson during a customer escalation, when the cost is measured in stopped shipments and corrective action boards rather than documentation hours. I've sat in enough of those boards to know which side of that curve I want to be on.