ISO/IEC 42001 for companies that use or build AI
An AI management system that survives an audit: from mapping the gaps to the internal audit before the certification body arrives.
What ISO/IEC 42001 is
ISO/IEC 42001 (2023) is the first international, certifiable standard for an AI management system (AIMS). It defines how an organisation decides on, documents and controls its use of AI: who is accountable, how risks and impacts on people are assessed, how suppliers and data are kept in check.
It shares the structure of ISO 27001 and ISO 9001 (clauses 4 to 10), plus Annex A with AI-specific controls, from the AI policy (A.2) to third-party and customer relationships (A.10). It applies to anyone who develops, provides or simply uses AI systems.
Who needs it now
- AI and SaaS companies selling to enterprises or abroad, where supplier questionnaires now ask about AI governance.
- Organisations with ISO 27001 or ISO 9001, which can extend their existing system instead of starting from zero.
- Sectors that make decisions about people (hiring, credit, insurance, health, education), where the EU AI Act brings its strictest obligations.
- Any business using chatbots, AI agents or tools like ChatGPT with customer data, that wants to know what is actually running and who approved it.
How we work
Gap assessment
Inventory of your AI systems, comparison with the standard and Annex A, a prioritised list of gaps and a realistic plan. The entry point: you know where you stand before you commit.
AIMS set-up
AI policy, roles and owners, a method for risk and impact assessment, procedures for suppliers and data, documentation and staff training. Built on ISO 27001/9001 where it exists.
Internal audit
Internal audit (clause 9.2) and management review (9.3) before the certification body, so findings come from us and not from the official audit.
We do not issue certificates: certification is done by an accredited body, which is not allowed to also advise you. We prepare you so you arrive ready.
ISO 42001 and the EU AI Act
ISO/IEC 42001 is not, on its own, compliance with the EU AI Act. Much of the work is shared, though: risk management, documentation, human oversight, staff AI literacy (Article 4). A well-built AIMS gives you the base for the regulation's obligations, and we map the overlap together in the gap assessment.
Frequently asked questions
Do we need it if we don't build AI and only use it?
Yes, the standard covers use as well. Most companies don't develop AI but do use tools with customer and employee data. That is exactly where it helps: inventory, owners, supplier control.
We already have ISO 27001. What changes?
A lot is reused: the structure, internal audits, management review, document control. What is added is mainly the AI policy, the AI system impact assessment and the Annex A controls.
How long does it take?
It depends on how many AI systems are in scope and whether a management system already exists. The gap assessment is the first, short step and gives you a realistic timeline for the rest.
How much does it cost?
We give a fixed quote after the free 45-minute mapping session, once the scope is clear. We don't bill by the hour for something that hasn't been defined.
Do you issue the certificate?
No. Certification is done by an accredited certification body. Our role is to prepare you and run the internal audit before it.