Vocalbeats.AI Adds ISO/IEC 42001 to Its ISO 27001 Base: How to Extend an Existing Management System to AI

On 21 October 2026, GlobeNewswire published an announcement that Vocalbeats.AI Pte. Ltd., a Singapore-based AI innovation company that develops voice AI products and services, had achieved ISO/IEC 42001:2023 certification for its artificial intelligence management system. TUV SUD PSB Pte Ltd issued the certificate, and a presentation ceremony took place on 20 October 2026. The detail worth a quality manager's attention is not the new standard on its own but the company it sits beside: the same announcement says ISO/IEC 27001:2022 and ISO/IEC 27701:2019 were renewed in the same cycle.

That pairing is easy to misread, so it helps to separate what the announcement states from what we infer. The box below lists only what the release itself records.

Because the release is a company press statement, the benefits it describes are the company's own view. To judge what an auditor will actually test, read the standard itself. ISO describes ISO/IEC 42001 as the first global standard for establishing, implementing, maintaining and continually improving an AI management system, and lists its requirement areas as leadership and organisational context, AI policy and objectives, risk management for AI systems, data governance and lifecycle controls, transparency, performance evaluation, and continual improvement. It applies to organisations of any size that develop, provide or use AI, and ISO is explicit that certification is voluntary and does not substitute for legal compliance.

This is where an existing ISO 27001 system earns its keep. Openlayer reports that ISO 42001 follows the same high-level structure as ISO 9001 and ISO 27001, with ten clauses and requirements starting at Clause 4, plus an Annex A of controls in nine categories: AI policies, internal organisation, resources for AI systems, assessing AI system impacts, the AI system life cycle, documented information, relationships with interested parties, use of AI systems, and third-party and supplier relationships. Controls are selected through a Statement of Applicability that records reasons for any exclusion. The table below shows how familiar management system building blocks carry over, and where new evidence is needed.

Knowing the overlap, the next question is what the audit path looks like. Openlayer describes a gap assessment and Statement of Applicability first, then a Stage 1 documentation review by an accredited certification body, then a Stage 2 assessment that checks whether controls operate in practice, followed by a three-year certificate with annual surveillance audits. Synthesia, an AI video platform, offers a first-hand timeline in a blog post dated 25 September 2024: it began in January 2024 as soon as the final specification was available, its Stage 2 audit plan covered 18 days of audit activity, and it completed Stage 2 with no unresolved nonconformities. Synthesia also says it already ran its own responsible AI framework and used the standard to formalise it, which suggests that the audit rewards documented, working practice more than new paperwork.

Taken together, the Vocalbeats.AI and Synthesia accounts point to five moves that an organisation in the Asia-Pacific region can start without committing to certification.

A final caution keeps expectations realistic. An ISO/IEC 42001 certificate shows that a management system was audited; it does not guarantee that every AI output is accurate or unbiased. Openlayer also notes that certification does not satisfy obligations under laws such as the EU AI Act, although risk and governance records prepared for ISO 42001 can support that work. Organisations selling into several markets should therefore treat the certificate as evidence of maturity and keep checking the rules of each destination market.

Frequently Asked Questions