AI management system
ISO 42001 implementation
We implement an AI management system your customers can audit, built on the ISO 27001 controls you already run.
WHY IT MATTERS
THE QUESTION BUYERS NOW ASK
ISO/IEC 42001 answers the question enterprise customers now ask in procurement, and regulators increasingly ask too: not whether your AI works, but whether anyone is governing it.
LAW AND STANDARD
If you build AI products, deploy AI inside regulated processes, or sell to organisations that do, this is the structure that turns AI governance from a set of intentions into something an auditor can verify. The standard follows the same management system structure as ISO 27001, which matters practically: if you already run an ISMS, you are integrating rather than starting over.
ISO 42001 does not replace the AI Act: certification alone does not make you compliant.
EU AI ACT
Law. It applies whether or not you have a management system, and your obligations depend on your role and on the risk category of each AI system.
ISO/IEC 42001
A voluntary, certifiable standard. It gives you the operating machinery the law assumes you have: governance, documented risk decisions, human oversight arrangements and records. Build the management system once, and it serves both the regulator and the enterprise customer asking for assurance. The legal obligations themselves are covered on our EU AI Act compliance page.
WHY US
We are not describing AI governance from the outside. We operate our own AI platform in production, with human oversight built into how it works: an expert can override or stop any action, the system explains what it is about to do before an approval, actions are classified by risk with approval gates, and everything is written to an audit log. That means two things for you. The governance we design has been operated, not just documented. And when we say a control is impractical, it is because we have tried to run it.
WHO NEEDS THIS NOW
Companies selling AI-enabled products to enterprises, where security questionnaires now ask about AI governance. Organisations using AI in regulated decisions: credit, hiring, healthcare, insurance. Providers whose EU customers push AI Act obligations down the supply chain. And organisations that cannot say which AI systems are in use across the business.
What we do
AI system inventory
Identifying what is actually in use across the organisation, including AI features switched on inside existing SaaS products. This list is almost always longer than expected and it defines everything that follows.
Gap analysis
We compare your current practice with ISO/IEC 42001 and map it to your existing ISO 27001 controls where you have them, so the overlap is reused rather than rebuilt.
Implementation
Policy, roles, risk and impact assessment methodology, lifecycle controls, oversight arrangements and the records that evidence them.
Internal audit, readiness and certification support
Running the internal audit and management review with you before the certification body arrives, attending the audit, and helping you close the findings.
A gap analysis maps your AI systems and existing ISO 27001 controls against ISO/IEC 42001, and shows what is left to build.
What does ISO 42001 require?
Context and roles: Understanding where AI sits in your organisation, who is accountable for it, and which role you occupy for each system: whether you develop it, provide it, or use someone else’s. AI risk assessment and impact assessment: Two distinct exercises. Risk assessment looks at threats to your organisation. Impact assessment looks outward, at consequences for the people affected by the system’s decisions. Most organisations have never done the second one, and it is the part regulators care about most. Controls across the AI lifecycle: Data quality and provenance, model development and validation, human oversight, transparency to users, monitoring in production, and incident handling when a system behaves in a way nobody predicted. Operation and improvement: Internal audit, management review and corrective action, on the same cycle as any other management system. Certification is a two-stage audit followed by surveillance, with the certificate issued by an accredited certification body rather than by us.
Is ISO 42001 worth doing if we only use AI, not build it?
Often yes, but scoped differently. As a deployer, your management system is smaller, focused on selection, oversight, monitoring and incident handling rather than on model development. The trigger is usually commercial: a customer or partner asking how you govern the AI in your service.
We already have ISO 27001. How much extra work is this?
Considerably less than starting from zero. The management system clauses are shared, so the structure, internal audit process and management review carry over. The genuinely new work is the AI inventory, the impact assessment methodology and the lifecycle controls.
Can we be certified before the AI Act obligations bite?
Yes, and sequencing it that way is usually cheaper. Building the management system first gives you the structure into which the legal obligations then fit, rather than assembling documentation twice under time pressure.
How long does it take?
It depends on how many AI systems are in scope, whether you are a provider or a deployer, and whether an ISMS already exists. We size it after a scoping call and confirm scope, timeline and cost in writing before work starts.
Our certificates
Team portfolio
Where to start?
You can copy our materials only after making sure that your services are safe.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.