{
  "id": 9019919,
  "title": "ISO 42001 May Become a Payments AI Governance Benchmark",
  "url": "https://urgent.news/2026/09/21/iso-42001-may-become-a-payments-ai-governance-benchmark",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-21T22:01:47.000Z",
  "source": {
    "name": "PYMNTS",
    "slug": "pymnts",
    "url": "https://www.pymnts.com/news/artificial-intelligence/2026/iso-42001-may-become-payments-ai-governance-benchmark/"
  },
  "original_language": "en",
  "account": "Payments firms require a method to identify where artificial intelligence (AI) is employed, determine responsibility, and oversee system management over time. ISO/IEC 42001 provides a management framework for these systems, including AI products and services that companies buy rather than develop. Published in December 2023, the standard sets requirements for an AI management system (AIMS) covering establishment, implementation, maintenance, and continual improvement.\n\nThe primary goal is to govern how organizations manage AI throughout its lifecycle, focusing on responsibility, risk assessment, monitoring, and other management processes. For payments companies, the initial step in implementing ISO 42001 is to identify AI already operating within the business. This includes machine-learning components in fraud detection, transaction monitoring, onboarding, authentication, and other decision-making workflows. Once identified, companies must establish clear responsibility after deployment, as the management challenges arise in this phase.\n\nDavid Kemmerer, co-founder and CEO of CoinLedger, explains that payments companies may already have established processes for security, fraud, privacy, model risk, and compliance. However, the difficulty lies in determining ownership of an AI system after it enters production, as well as the governance of changes in the model. ISO 42001 provides coverage for the entire lifecycle, from creation and implementation to maintenance and improvements. This requirement for ongoing oversight is crucial because AI systems can change effectiveness as data, behavior, and operating conditions evolve.\n\nRustam Bagautdinov, director of processing at Payzon, highlights the significance of managing AI in payment routing. AI can be used to select an acquiring route based on variables such as expected approval rates and cost. Any change in the model's behavior can alter transaction routing, potentially leading to false declines. ISO 42001 ensures there is a traceable, documented logic to understand the rationale behind such decisions, rather than simply blaming the algorithm. This example illustrates the operational purpose of governance without turning certification into a performance guarantee.\n\nPayments companies also depend on third-party technology, including AI-enabled services. A processor might rely on other technology suppliers while providing services to banks and merchants. For ISO 42001 certification, the scope statement is crucial. A vendor can be certified, but a customer's particular configuration, integration, or tuning may fall outside the audited scope. Certification should enhance third-party due diligence rather than replace it. Payments firms should inquire about the extent of third-party audits and the scope of the certification to ensure a comprehensive understanding of the AI management system's capabilities and limitations.",
  "summary": "Payments firms need a way to identify where artificial intelligence is being used and who’s responsible for it, as well as to monitor how those systems are managed over time. ISO/IEC 42001 puts a management framework around those systems, including AI a company buys rather than builds. Published in December 2023, the standard establishes requirements […] The post ISO 42001 May Become a Payments…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}