ISO 42001 readiness for AI you can stand behind.
We inventory your AI, run the risk and impact assessments, and build the AI Management System an accredited certification body audits for ISO/IEC 42001.
- Shipping AI:
- an AIMS scoped to the AI systems you put in front of customers.
- Holding ISO 27001:
- we extend your existing ISMS instead of building a second system.
- Every AI system inventoried, foundation models and shadow AI included
- Risk and impact assessments kept as two separate artifacts
- A Statement of Applicability traced to real risks
- Mapped to ISO 27001, GDPR and EU AI Act obligations
What is ISO 42001, and what does certification prove?
ISO/IEC 42001:2023 is the first certifiable standard for an AI Management System (AIMS): the policies, roles, assessments and controls that let you build and use AI responsibly, and prove it. It shares its clause 4–10 structure with ISO 27001, and its Annex A lists 38 controls in nine objectives.
Your AI
- AI features you ship
- Models you tune or host
- Third-party model APIs
- AI tools your staff use
- Training and retrieval data
- The people your AI affects
The standard
- Clauses 4–10 (the AIMS)
- AI policy and roles
- Risk assessment
- Impact assessment
- Annex A · 38 controls
- Internal audit and review
AIMS
A certified AI management system
An accredited certification body audits your AIMS in Stage 1 and Stage 2, then issues an ISO/IEC 42001 certificate valid for three years, with surveillance audits along the way.
It proves systematic AI governance. It is not the same as legal conformity with the EU AI Act.
Two assessments and one register
AI risk assessment
Looks inward: what could go wrong for you, your objectives and obligations. Clause 6.1.2.
AI impact assessment
Looks outward: how each system could affect people and society. Clause 6.1.4 and Annex A.5.
Statement of Applicability
Every one of the 38 controls: applicable or not, and why, traced to a risk or an impact.
Where ISO 42001 is asked for most
- AI & LLM products
- SaaS with AI features
- Fintech & credit
- Healthtech
- HR & hiring tech
- AI services & integrators
The trigger is usually an enterprise AI questionnaire, a buyer's AI governance clause, or exposure to the EU AI Act. Our AI role emulator shows whether you're a provider, a deployer, or both.
Read the ISO 42001 certification guide: steps, Stage 1 and Stage 2, the three-year cycleWho needs ISO 42001?
Any organization that develops, provides or uses AI systems and needs to show it governs them. Most product companies hold two roles at once: provider of the AI they ship, deployer of the AI tools their teams use.
01 · Who relies on you
Customers & affected people
- Enterprise AI questionnaires
- Users of your AI features
- People your AI decides about
- Regulators
Ask for evidence of AI governance, increasingly an ISO 42001 certificate.
02 · Your organization
Provider and deployer
- AI features you ship
- Fine-tuned or self-hosted models
- Internal AI tools
- AI in client deliverables
Audited by an accredited certification body against ISO/IEC 42001.
03 · Your suppliers
Model & data vendors
- Foundation-model APIs
- Data providers
- MLOps and hosting platforms
Assessed and monitored under A.10, using their own certifications.
If customers' security reviews now include an AI section, or a contract asks how you govern AI, an auditable AIMS answers it in one line.
Your model vendor is a supplier, not a shield. Its certifications cover its model and infrastructure; the impact assessment for your use, your guardrails, transparency and human oversight stay yours to evidence (A.10.3).
How an ISO 42001 readiness program works
Six phases, each with a named output and a clear ask of your team. The ISO 42001 readiness assessment covers the first two. The ISO 42001 program runs all six, through the certification audit.
- Inventory
AI inventory & AIMS scope
We list every AI system you build, buy or use, including embedded foundation models and shadow AI, decide the role you hold for each, and draw the AIMS scope.
- AI system inventory
- Provider / deployer roles
- AIMS scope
- Interested parties
- You get
- An AI system register and a written scope statement (clause 4.3).
- You provide
- Product and engineering leads, and a list of AI tools in use across teams.
- Assess
Risk & impact assessments
We run the AI risk assessment (inward: risk to you) and the AI system impact assessment (outward: effects on people), as two separate artifacts that feed each other.
- Risk register
- Impact assessments per system
- Gap analysis
- Roadmap
- You get
- A risk register, impact assessments and a ranked gap roadmap.
- You provide
- System owners for each AI system, and time for harm scenarios.
- Govern
AI policy & governance
We write a short, leadership-signed AI policy, assign an owner per AI system, set up a small governance forum, and align the policy with security, privacy and HR policies.
- AI policy (A.2)
- Roles (A.3)
- Governance forum
- Concern reporting
- You get
- An approved AI policy, named owners and a governance cadence.
- You provide
- Leadership sign-off and owners willing to be accountable.
- Implement
Annex A controls & SoA
We implement the controls your assessments call for: lifecycle (A.6), data (A.7), transparency (A.8), use and human oversight (A.9), suppliers (A.10). Then we write the Statement of Applicability.
- Lifecycle controls
- Data governance
- Human oversight
- Supplier reviews
- You get
- Controls in place and a Statement of Applicability traced to risks.
- You provide
- Engineering time for logging, testing and oversight changes.
- Verify
Internal audit & management review
We audit the AIMS against the standard the way a certification body will, close the findings, and run the documented management review Stage 1 expects to see.
- Internal audit
- Corrective actions
- Management review
- Evidence pack
- You get
- An internal audit report, closed findings and review minutes.
- You provide
- Leadership time for the management review.
- Certify
Certification audit support
An accredited certification body runs Stage 1 (documents and readiness) and Stage 2 (does the AIMS work). We support you through both, and plan surveillance after.
- Body selection
- Stage 1 support
- Stage 2 support
- Surveillance plan
- You get
- Support until the certificate is issued, and a plan for the three-year cycle.
- You provide
- Fast answers and staff available for auditor interviews.
No one-size timeline: it depends on how many AI systems are in scope, how risky they are, and whether you already run ISO 27001. You get a firm timeline in writing before work starts.
What you receive
Everything the program produces lands in one AIMS evidence file. Each item is paired with the question a certification auditor asks about it.
Each gap comes with the specific fix and a walkthrough with the system owner. We verify each fix and update the SoA, so closure is documented before the auditor arrives.
Only an accredited certification body can audit your AIMS and issue the ISO/IEC 42001 certificate. We prepare you; the body that certifies must be independent of us.
01, Inventory phase: AI system register & scope
Every AI system with its intended purpose, owner, role and risk level.
02, Assess phase: AI risk register
Bias, robustness, security, drift and third-party risks, each with a treatment.
03, Assess phase: AI system impact assessments
Per system: affected parties, harm scenarios, severity and mitigations.
04, Govern phase: AI policy
A short, signed policy (A.2) with its review cycle.
05, Govern phase: Roles & governance forum
Named owners, the forum's terms, and the concern-reporting route (A.3.3).
06, Implement phase: Statement of Applicability
All 38 controls, each traced to a risk or impact, exclusions justified.
07, Implement phase: Human-oversight & lifecycle evidence
Release checks, monitoring, event logs (A.6.2.8) and oversight records.
08, Verify phase: Internal audit & management review
The internal audit report, corrective actions and review minutes.
09, Certify phase: Certification support file
Stage 1 responses, Stage 2 preparation and the surveillance plan.
Illustrative example, not client data
What one row of the risk register looks like
- AI system
- Support chatbot built on a model API
- Risk
- Prompt injection exposes internal data (security)
- Affected
- Customers; brand
- Treatment
- Input filtering, output guardrails, retrieval limits
- Controls
- A.6.2, A.10.3
- Owner
- Engineering lead
Four common ISO 42001 misconceptions
Each one is reasonable, and each one stalls an AIMS.
Assumption 01
Assumption: We use OpenAI's API, so ISO 42001 is their problem.
What ISO 42001 actually means
Wrapping a model into your product makes the AI system yours. The vendor is a supplier; your use case, guardrails, transparency and oversight are yours to govern and evidence.
Assumption 02
Assumption: ISO 42001 certification means we comply with the EU AI Act.
What ISO 42001 actually means
The Act is law; ISO 42001 is a voluntary standard. A certified AIMS gives strong evidence for many of the Act's duties, but it isn't a legal presumption of conformity.
Assumption 03
Assumption: Our risk register already covers the impact assessment.
What ISO 42001 actually means
They're two artifacts. Risk looks at harm to you; the impact assessment looks at harm to people and society, per system. Auditors check that both exist.
Assumption 04
Assumption: We need all 38 Annex A controls.
What ISO 42001 actually means
Annex A is a reference set. You pick the controls your risks and impacts call for, and justify every exclusion in the Statement of Applicability.
Heard one of these from your team? An ISO 42001 readiness assessment shows where you really stand.
Get an ISO 42001 readiness assessmentWhat you can hold us to.
We don't publish client logos or case studies; we keep our clients' AI programs private. These are the commitments we make instead.
Our commitments
Experienced practitioners lead
Every engagement is led by experienced practitioners.
Peer review
Every deliverable is peer-reviewed before it reaches you.
Written scope and change control
You know what is covered, and what happens if scope changes, before work starts.
Governance your team can run
Controls and reviews built for how you ship AI, that keep working after we leave.
Want to speak to a client? Ask for a reference while we scope your work and we'll arrange it directly.
Ask for a referenceISO 42001 questions buyers ask
What is ISO 42001?
The certifiable standard for an AI Management System.
ISO/IEC 42001:2023 sets requirements for an AI Management System: context and scope, leadership and an AI policy, risk and impact assessments, operational controls, monitoring and improvement. Annex A lists 38 controls in nine objectives you select from.
AI governance and ISO 42001, explained.
Every ISO 42001 guide we publish: the governance basics, the controls and assessments, the road to certification, and how the standard sits beside the EU AI Act and NIST AI RMF. Plus an emulator to find your AI role.
Start here03
The standard02
Certification02
Know where your AI governance stands, before a buyer asks.
Send the basics
The AI you build and use, roughly how many people, who your customers are, and any certificates you already hold.
We scope the work
We respond within 24 hours, then agree the scope with you in writing.
Your ISO 42001 readiness assessment
You get an AI system register, a risk and impact baseline and a roadmap to certification.
- Shipping AI:
- an AIMS scoped to the AI systems you put in front of customers.
- Holding ISO 27001:
- we extend your existing ISMS instead of building a second system.
We prepare you for certification. The certificate comes from an accredited certification body.