ISO 42001 for Performance Management Software: What Buyers Should Ask

TL;DR: ISO 42001 sets requirements for an organisation's AI management system. For HR buyers, it provides a useful way to assess how performance management software vendors handle employee data, AI risks, bias, and human oversight. Before choosing a platform, verify the vendor's certificate, check its scope, and ask how it governs its AI features.

AI is changing how organisations manage employee performance. The UK Government's 2026 Business Data Survey found that 79% of UK businesses with employees handle digital employee data. Yet among businesses using AI, only 17% reported having a policy or guidelines for its use, and just 5% had a formal written policy.

But when AI handles employee information or influences workplace decisions, HR teams need to understand how the performance management software provider manages AI risks. Understanding AI governance in HR is an important first step. ISO 42001 gives buyers a way to assess how a vendor governs its AI systems before they choose a platform.

What Is ISO 42001 and What Does It Certify?

ISO/IEC 42001:2023 is an international standard that specifies requirements for establishing, implementing, maintaining and improving an Artificial Intelligence Management System (AIMS).

Published in December 2023, it is the first international management system standard dedicated to AI. It applies to organisations that develop, provide or use AI-based products and services, regardless of their size or industry.

An AI management system defines how an organisation manages AI throughout its lifecycle. It covers policies, responsibilities, risk assessments, impact assessments, controls and ongoing reviews.

What does ISO 42001 certification assess?

Certification assesses whether an organisation's AI management system meets the standard's requirements within a defined scope.

It examines how the organisation:

• Establishes an AI policy and assigns responsibilities.
• Identifies and assesses AI-related risks.
• Evaluates the potential impact of AI systems on people.
• Manages AI development, deployment and use.
• Monitors AI systems and addresses identified problems.
• Reviews and improves its AI management processes.

ISO 42001 does not certify an individual AI model or guarantee that every AI output is accurate, fair, or free from bias. It assesses the organisation's management system, not the performance of each AI feature.

ISO 42001 certified vs aligned: What is the difference?

These terms describe different levels of assurance.

Claim	What it means
ISO 42001 certified	An independent certification body has assessed the organisation's AI management system against the standard within a defined scope.
ISO 42001 aligned	The organisation says its AI practices follow some or all of the standard's principles. This does not establish independent certification.
Working towards certification	The organisation is preparing its AI management system for an assessment. It does not hold certification on that basis alone.

Buyers should ask for the actual certificate rather than rely on a website badge or a vendor's statement that it follows an AI governance framework.

Why Does ISO 42001 Matter for Performance Management Software?

Performance management software stores information that can affect an employee's career. This includes performance ratings, manager feedback, review records, competency framework, objectives, and development plans.

When vendors add AI to these workflows, buyers need to understand how the system handles that information and how it influences employee-related decisions.

The OECD's December 2025 research found that 90% of managers in surveyed US organisations reported that their firms had adopted at least one algorithmic management tool. Across France, Germany, Italy and Spain, the average adoption rate was 79%. The research also found that nearly two-thirds of managers using these tools had concerns about their impact on workers.

Four areas deserve attention when evaluating HR performance management software.

1. Employee data protection

AI features may process employee reviews, feedback, skills information, and development records. Buyers should understand what information the vendor collects, where it goes, who can access it, and whether external AI providers process it.

2. Bias in employee assessments

AI-generated summaries or recommendations can reflect problems in the data used to produce them. Buyers should ask how vendors test for bias and correct inaccurate or unfair outputs.

3. Transparency in AI recommendations

Managers need to understand the information behind an AI-generated recommendation. Employees should also have a clear way to question inaccurate information that affects their reviews.

4. Human oversight

AI can support performance review calibration, but managers and HR teams should retain responsibility for decisions about ratings, promotions, and development. The ICO highlights the need for meaningful information and human intervention when organisations use certain forms of automated decision-making about workers.

10 Questions to Ask Performance Management Software Vendors About ISO 42001

A vendor's ISO 42001 certification is a useful starting point, but it does not automatically confirm that every AI feature in its performance management for enterprises falls within the certified scope. Buyers need to understand how the vendor governs the AI features they intend to use, from review summaries and feedback suggestions to competency assessments and development recommendations.

Use these questions during product demos, security reviews, and procurement discussions.

1. Is your organisation ISO 42001 certified?

Why should you ask?

This helps you establish whether an independent certification body has assessed the vendor's AI management system or whether the vendor follows its own internal AI governance practices. These are different levels of assurance.

What should a good answer include?

The vendor should confirm whether it holds an active ISO/IEC 42001:2023 certification. It should identify the covered legal entity, the certification body, the certificate number, and the current validity period. If it is not certified, it should explain which AI governance for HR team controls it follows.

What evidence should you request?

• A copy of the current ISO/IEC 42001:2023 certificate.
• Certification body details.
• Certificate number and validity dates.
• Certification scope.

2. Which business activities and services does your ISO 42001 certification cover?

Why should you ask?

ISO 42001 certification applies to a defined management system scope. A certificate may cover specific business activities, services, locations, or organisational entities. A vendor's certification claim does not automatically extend to every product or service it sells.

What should a good answer include?

The vendor should identify the certified legal entity and explain which activities, services, and locations fall within the scope. It should also clarify whether the performance management platform is included.

What evidence should you request?

• The certificate's full scope statement.
• Details of the legal entity and locations covered.
• Supporting documentation that explains the scope, where necessary.

3. Are the AI features we plan to use included in your certified AI management system?

Why should you ask?

Performance management software may use AI for different tasks, such as drafting review comments, summarising employee feedback, suggesting ratings, assessing competencies and recommending development actions. These features can involve different AI systems and risks. You need to know whether the vendor governs the specific features your HR team will use.

What should a good answer include?

The vendor should identify the relevant AI features and explain how each one falls within its AI management system. It should also clarify whether any features rely on external AI providers or models that require separate controls.

What evidence should you request?

• A list of AI features covered by the management system.
• Documentation showing how those features fit within the system's scope.
• Details of third-party AI providers and relevant controls.

To understand where AI can support different HR activities, explore how AI can be used in HR, from performance reviews and meeting summaries to competency development.

4. How do you identify and assess risks in AI-powered performance management workflows?

Why should you ask?

AI risks depend on how a feature is used. For example, an AI-powered tool that drafts review comments may create inaccurate statements, while a feature that suggests employee ratings may influence appraisal outcomes. A general AI policy may not explain how the vendor assesses these specific risks.

What should a good answer include?

The vendor should describe how it identifies, assesses, and records risks across the AI lifecycle. Its process should consider inaccurate outputs, biased recommendations, data exposure, inappropriate use, and the effect of AI-generated suggestions on employee decisions. It should also explain who owns each risk and how the vendor tracks corrective actions.

What evidence should you request?

• AI risk assessment policy or methodology.
• Examples of risk assessments for relevant HR use cases.
• Risk ownership and escalation procedures.
• Records of corrective actions, where available.

5. How do you test AI-generated ratings, feedback and competency assessments for bias?

Why should you ask?

AI-generated assessments can reflect gaps or patterns in the data used to produce them. For example, a system may give greater weight to documented achievements than to work that is less visible in employee records. This can affect how managers interpret an employee's performance.

What should a good answer include?

The vendor should explain what bias tests it conducts, which employee groups or outcomes it evaluates, how frequently it reviews results, and what it does when testing identifies a problem. It should also explain the limits of its AI-generated assessments and where human judgement is required.

What evidence should you request?

• Bias testing methodology and assessment records.
• Documentation of the data and criteria used in testing.
• Examples of identified issues and corrective actions.
• Procedures for reviewing disputed or potentially biased outputs.

AI-generated ratings still need clear criteria and manager review. Read our guide to performance review calibration to understand how organisations can make employee ratings more consistent.

6. How do you collect, process, store and retain employee data when AI features are used?

Why should you ask?

Performance management systems can contain sensitive workplace information, including appraisal comments, competency records, development plans and manager feedback. Buyers need to understand where this information goes when an AI feature processes it and who can access it.

What should a good answer include?

The vendor should explain what employee data each AI feature uses, where it is processed and stored, how access is controlled, how long it is retained, and whether third parties receive it. The answer should also cover data deletion and the responsibilities of the vendor and customer.

What evidence should you request?

• Data processing agreement.
• Privacy and data retention policies.
• Data flow or data location documentation.
• Access control and security documentation.
• Details of third-party processors.

7. Is employee data shared with external AI providers or used to train AI models?

Why should you ask?

Some performance management platforms use third-party AI models to generate summaries, draft feedback, or produce recommendations. Employee information may pass through these services. Buyers should understand whether providers retain that information or use it to train their models.

What should a good answer include?

The vendor should identify its AI model providers and explain what information is shared with them. It should clarify whether employee data is used for model training, how long providers retain submitted data, and what contractual restrictions apply. If the vendor does not use employee data for training, it should confirm this in writing.

What evidence should you request?

• Written confirmation of employee data use for model training.
• List of external AI providers and subprocessors.
• Relevant contractual data protection terms.
• Data retention and deletion commitments from the vendor or its providers.

8. Can HR teams and managers review, correct or reject AI-generated recommendations?

Why should you ask?

An AI-generated rating, feedback suggestion, or development recommendation can influence a manager's judgement. HR teams need to know whether employees and managers retain meaningful human oversight or whether the software applies recommendations without sufficient review.

What should a good answer include?

The vendor should explain when human approval is required, who can edit or reject an AI-generated output, and how the system records those changes. It should also clarify whether AI recommendations can affect an employee's formal rating or other employment decisions without human review.

What evidence should you request?

• A demonstration of the review and approval workflow.
• Documentation of user permissions and approval controls.
• Examples of how managers can correct or reject AI outputs.
• Audit trail details showing changes and approvals.

Human oversight should be part of the AI adoption process from the start. Our guide to how to use AI in HR explains how to introduce AI into HR workflows while keeping people accountable for decisions.

9. How do you monitor AI output quality and assess the impact of model changes?

Why should you ask?

An AI feature may produce different results after a model update, changes to its data sources, or modifications to the software. A feature that performed as expected during a product demo may behave differently after an update or when used across different employee groups.

What should a good answer include?

The vendor should describe how it tests AI outputs before and after changes, monitors accuracy, and identifies unexpected results. It should explain how it handles incidents, communicates material changes to customers, and reviews whether updates introduce new risks.

What evidence should you request?

• AI testing and monitoring procedures.
• Model or feature change management documentation.
• Incident reporting and escalation procedures.
• Records of corrective actions and relevant customer notifications.

10. Can you provide audit evidence showing how your AI governance controls work in practice?

Why should you ask?

A certificate and a written AI policy show part of the vendor's approach. They do not, on their own, demonstrate how the vendor applies its controls to the AI features your organisation will use. Evidence helps you assess whether its governance processes operate in practice.

What should a good answer include?

The vendor should be able to explain how it documents AI risks, assigns accountability, monitors systems and reviews controls. It should provide relevant evidence while protecting confidential information and details belonging to other customers.

What evidence should you request?

• Current ISO/IEC 42001:2023 certificate and scope.
• AI governance policy and risk assessment methodology.
• Relevant audit summaries or assurance reports.
• AI testing and monitoring documentation.
• Incident management and corrective action procedures.

These questions help buyers assess more than a vendor's certification claim. They show how its AI management system applies to employee data, performance assessments and the decisions managers make using the platform. Compare the answers with your organisation's requirements, intended use cases and internal policies before making a purchasing decision.

How StaffCircle Approaches AI in Performance Management

StaffCircle provides performance management software that brings employee reviews, objectives, skills and development activities into one platform.

Its AI capabilities include StaffCircle Intelligence, AI Assist and AI-supported workforce insights. These capabilities help HR teams and managers work with employee information, prepare performance-related activities, and access workforce insights.

StaffCircle describes its AI approach as aligned with ISO/IEC 42001 and outlines governance measures such as approved AI models, data controls, and oversight through its Safety Ethics Council.

For buyers evaluating the platform, the same questions covered in this guide still apply: which AI features fall within the management system scope, how does StaffCircle assess AI risks, and what human oversight is available?

You can review the original document here: View StaffCircle's published ISO 42001 certificate.

Final Thought

ISO 42001 gives HR buyers a way to assess how software vendors manage AI risks. However, certification alone does not establish that every AI feature is suitable for employee assessments or that its outputs are free from bias.

StaffCircle brings performance reviews, objectives, skills, and employee development into one platform, with AI capabilities that support HR workflows. Buyers should review its current certification status and scope alongside its product capabilities.

Ready to review your performance management processes? Book a StaffCircle demo to see how the platform supports employee performance and development.

FAQ

Is ISO 42001 certification mandatory for HR software vendors?

No. ISO 42001 certification is voluntary. However, buyers can use it to assess how a vendor manages AI risks, responsibilities, and governance. Other legal and contractual requirements may still apply.

Why does ISO 42001 matter when AI is used in performance reviews?

It provides a framework for managing risks associated with AI-generated employee assessments. It helps buyers examine how vendors address data quality, bias, transparency, and human oversight.

What is the difference between ISO 42001 and ISO 27001?

ISO 42001 focuses on AI management and governance, while ISO 27001 focuses on information security management. A software vendor may hold both certifications because they address different areas of organisational risk.

How can I verify that a vendor's ISO 42001 certification is genuine and in scope?

Request the certificate and check the certified organisation, certification body, accreditation, certificate number, validity dates and scope. Contact the certification body if you need confirmation of its current status.

How does ISO 42001 relate to the EU AI Act's rules on high-risk AI in employment?

ISO 42001 provides an AI governance framework, while the EU AI Act establishes legal obligations for certain AI systems. The Act classifies specific AI uses in recruitment and worker management, including certain systems used to monitor or evaluate employee performance, as high-risk. The relevant rules for Annex III high-risk systems are scheduled to apply from 2 December 2027 under the current amended timeline.

What are the risks of AI in performance management?

Key risks include biased assessments, inaccurate employee information, unclear recommendations, excessive employee monitoring, and decisions made without proper human review. Buyers should ask vendors how they test, monitor, and address these risks.

What questions should I ask a vendor about how its AI makes or suggests ratings?

Ask what employee data the AI uses, how it generates recommendations, how it handles incomplete information, and whether managers can review and reject its suggestions. Also ask for examples of how the system explains its outputs.

---