ISO/IEC 42001: Put AI use under consistent oversight.
ISO 42001 readiness helps organisations establish an AI management system for developing, providing or using AI responsibly. We bring intended use, risks, responsibilities and oversight into a working governance structure, then support implementation and evidence preparation for an independent certification assessment where certification is the objective.
- Discipline
- Governance, Risk & Compliance
- Engagement type
- Advisory
Start with how your organisation actually uses AI.
Developing a model, integrating a third-party service and giving employees access to an AI tool create different responsibilities. The management system needs to reflect your role, the people affected and the consequences of use, rather than treating every AI system alike.
Inventory and intended use
Identify the AI systems within scope, their purpose, suppliers, owners and dependencies, including uses that may sit outside a central product team.
Risk and impact
Assess risks and potential impacts on individuals, groups and the organisation; record treatment decisions and how they influence use or deployment.
Lifecycle and oversight
Define responsibilities for data, evaluation, approval, human oversight, changes, monitoring and incident handling across the relevant lifecycle.
Management system readiness
Develop policies, records and review arrangements that support internal evaluation, improvement and independent certification preparation where required.
Make oversight part of how AI is introduced and changed.
We map the decisions your teams already make, then identify where approval, review or supporting evidence is missing. The resulting controls should fit your role and use cases: who can authorise a new application, what needs to be evaluated, when human review is required and what happens if behaviour changes after deployment.
What you receive
AI system and responsibility map
Systems, intended uses, owners and supplier relationships within scope.
Risk, impact and treatment records
Documented concerns, decisions and actions proportionate to the use case.
Governance and review arrangements
Policies, lifecycle controls, monitoring responsibilities and a plan for remaining management-system gaps.
Is this only for companies building AI models?
No. ISO/IEC 42001 addresses organisations developing, providing or using AI. The scope and controls should reflect your role rather than assuming you train your own models.
Does this include testing AI applications for attacks?
Governance work defines responsibilities and oversight. AI security testing examines how an application behaves under specific attacks. Testing can inform the management system, but it is a distinct activity that needs its own scope.
Does ISO 42001 preparation establish compliance with AI legislation?
It can support governance practices, but legislative obligations depend on jurisdiction, role and use case. Certification preparation does not establish that every legal requirement has been met.
Where is AI already influencing your business?
Share the systems you develop or use and the questions your customers, leaders or teams need to resolve.
Related services: AI & LLM Security Testing and ISO/IEC 27001:2022.