Hybrid Mamba/Transformers architecture, reasoning-focused models, shared-expert mechanisms… IBM has a few updates to highlight with the latest generation of Granite LLMs.
This model comes with another notable feature: an ISO 42001 certification. IBM secured it in mid-September* for the underlying management system.
This standard, published in late 2023, actually governs the design, implementation, and operation of an AI management system. It is, in a sense, what ISO 27001 is to information security, ISO 9001 to quality, and ISO 27701 to privacy protection. Being compliant is meant to signal an ethical and responsible approach.
ISO 42001 is potentially applicable to any organization that develops, provides, or uses products or services relying on AI systems. Many of its requirements resemble the measures imposed by the AI Act, covering governance as well as documentation, risk analysis, and informing interested parties.
The standard requires considering both the internal context (governance, procedures, contractual obligations…) and the external context (legislation, cultural and competitive landscape, impact on third parties…). It addresses, among other things:
- Involvement of the top management. Alignment of the AI policy with the organization’s strategy, integration of the management system requirements into business processes, etc.
- Planning. Impact analyses, continuous improvement and risk treatment plans, exception management, etc.
- Support. Provision of the resources necessary for the management system (data, tools, IT systems, human skills).
- Relations with third parties. Documentation addressed to them, complaint/reporting mechanisms, incident communications, supplier management, etc.
The certification is valid for 3 years and subject to annual audits. IBM states that the process took 3 months, presenting the announcement alongside its bug bounty partnership with Hacker One and the generalization of cryptographic signing for the Granite models’ checkpoints.
From AWS to Zendesk, a few other holders of the 42001 certification
Among foundation-model providers, Anthropic earned ISO 42001 certification in January 2025. It covers Claude LLMs on the API, within the Claude Enterprise offering as well as in Amazon Bedrock and Vertex AI.
Cohere earned it in June 2025.
AWS had been certified in November 2024 for the Amazon Bedrock, Q Business, Textract and Transcribe services. Google had achieved certification in December for ten products including Vertex AI, Gemini for Google Workspace, and the Cloud Translation and Document AI APIs. Microsoft joined in March 2025 for Copilot and Copilot Chat in Microsoft 365. Red Hat, in September, for OpenShift AI.
365Talents and Workday have respectively held ISO 42001 since February and June 2025. Autodesk has held it since August for its core platform aimed at developing AI products and features. Zendesk has held it since September for its entire AI core, with two recent acquisitions (Local Measure and HyperArc excluded). Snowflake has held it since June.
Dozens of smaller publishers have obtained the certification. To name a few: Scrut Automation (India, GRC, February 2025), Noxtua (formerly Xayn; Germany, legal software, December 2024), FloQast (USA, accounting, January 2025), Gpi (Italy, healthcare software, July 2025) and Swimlane (USA, SOAR, June 2025). IT services firms as well, such as Datamatics (India, June 2024).
