List the AI systems
The AI systems you build, buy or embed, their purpose and who they affect, to set the scope.
// ISO/IEC 42001:2023 · AI MANAGEMENT SYSTEMShow customers your AI
Show customers your AI
is governed, not guessed.
ISO/IEC 42001 is the first certifiable management-system standard for AI. If your product uses AI and buyers are asking how you govern it, we help you build the AI management system, run it, and get ready for the certification audit.
ISO/IEC 42001:2023AI impact assessment38 Annex A controlsCertification ready
Dec 2023ISO/IEC 42001 published
38Annex A controls in the standard
9Annex A control objectives
// WHAT ISO 42001 ADDS
The same management system shape, aimed at AI risks.
Published in December 2023, ISO/IEC 42001 follows the structure of ISO 27001: clauses 4 to 10 describe the management system, and Annex A lists 38 controls under 9 objectives. The difference is what it governs: AI policy, roles, AI risk and impact assessment, data used for training and testing, the AI system life cycle, information given to users and relationships with third parties. Certificates are issued by accredited certification bodies. If you already run ISO 27001, much of the system can be shared.
// DELIVERY STANDARD
Built for decisions, evidence and accountable execution.
Whether this is a commercial engagement or a government program, the work is structured so technical teams can act and leadership can verify progress.
Gap and impact assessment
A gap assessment against ISO/IEC 42001 and the first AI risk and impact assessments for systems in scope.
Put the AIMS in place
Policy, roles, life-cycle and data controls, and the Statement of Applicability, integrated with ISO 27001 where you have it.
Audit and certification
Internal audit, management review and support through the certification audit by an accredited body you appoint.
// PROJECT OUTPUTS
What your team can take into the next review.
- AI system inventory and AIMS scope
- ISO/IEC 42001 gap report
- AI risk and impact assessment method and first assessments
- AI policy, roles and Statement of Applicability
- Internal audit report and management review minutes
// BUILT FOR
Designed around the people who own the outcome.
- SaaS products with AI features facing enterprise procurement
- Companies building or fine-tuning their own models
- Organisations deploying third-party AI in decisions about people
- ISO 27001-certified companies adding AI governance
AI policy and roles
An AI policy that matches what you actually build or buy, with named roles and accountability for each AI system in scope.
AI risk and impact assessment
A repeatable method for assessing the risks of each AI system and its impact on people and groups, recorded and reviewed when the system changes.
Data governance for AI
Where training, validation and test data comes from, its quality, provenance and permissions, and how it is prepared, documented for each system.
AI system life cycle
Requirements, design, verification, deployment, monitoring and retirement controls built into how your team ships models and AI features.
Users, oversight and suppliers
Information users need to use the system responsibly, human oversight where it matters, and controls over model and data suppliers.
Internal audit and certification
Statement of Applicability for Annex A, internal audit, management review and support through the certification body’s Stage 1 and Stage 2 audits.
// PRICING
Scoped to you, priced in writing.
Every engagement is scoped to your frameworks, your team and how much help you want — you get a written proposal before anything starts.
AI inventory and gap assessment
Talk to us
AI system inventory plus a written ISO/IEC 42001 gap report and roadmap.
Full readiness programme
Talk to us
Gap assessment to certification-audit support. The certification audit fee is billed separately by the accredited certification body you appoint.
ISO 42001 work depends on how many AI systems are in scope and whether an ISO 27001 management system already exists to build on. Talk to us and we'll send a written proposal.
Frequently Asked Questions
Do you issue the ISO 42001 certificate?
No. Certificates are issued by accredited certification bodies after their audit. We prepare you for it and support you during it, but we do not certify you ourselves.
Do we need ISO 42001 if we only use other companies’ AI models?
Possibly. ISO/IEC 42001 covers organisations that develop, provide or use AI systems. If AI features in your product affect your customers or their users, buyers increasingly ask how you govern them, whoever trained the model. The scope can be limited to the systems that matter.
We already have ISO 27001. How much is reused?
A lot of the management system: context, leadership, document control, internal audit, management review and improvement. The new work is the AI-specific part: AI risk and impact assessment, data governance, life-cycle controls and the Annex A controls.
Does ISO 42001 make us compliant with the EU AI Act?
Not on its own. The EU AI Act is a law with its own obligations depending on how your AI system is classified. An ISO/IEC 42001 management system gives you much of the governance, documentation and risk process those obligations rely on, so it is a strong foundation, but the Act needs to be checked separately.
How long does it take?
It depends on how many AI systems are in scope and what already exists. As with ISO 27001, the longest part is running the controls long enough to produce evidence. We give you a plan after the gap assessment.
Let's build together
Answer the AI governance question before the buyer asks.
Book a free 30-minute consultation with our engineering team — no obligation, just a clear, practical plan.