ISO/IEC 42001
The first certifiable management system for artificial intelligence. The practical foundation for AI Act compliance.
AI management systems
- What is at stake
- The foundation for AI Act compliance
Who it applies to
- Companies building AI products
- Organisations deploying AI in key processes
- Suppliers who must prove responsible AI
Typical timeline
4 to 6 months
AI management systems
In detail
Managing AI with the same rigour as security.
ISO/IEC 42001:2023 is the first certifiable international standard for AI Management Systems (AIMS). It follows the same structure as ISO 27001, making them easy to integrate.
It requires you to identify the AI systems you build or use, assess their risks and impacts on people and society, and apply controls over data, transparency, human oversight, lifecycle and suppliers.
It is the most practical tool to prepare for the EU AI Act: many requirements overlap, and it shows customers and investors that your use of AI is under control.
Real scenarios
Who is adopting it.
Companies selling AI products
Enterprise customers already ask how models are trained, which data is used and how bias is avoided.
Internal generative AI use
Organisations that have rolled out assistants and copilots want to control data leakage and misuse.
Regulated sectors
Banking, insurance and health use the standard as the basis for governing risk, scoring or diagnostic models.
What you get
What you will have at the end.
- AI system inventory
- Leadership-approved AI policy
- Risk and impact assessment
- Annex A controls in place
- Model supplier management
- Certification readiness
How we engage
Three ways to approach it.
Gap analysis
Know exactly what is missing.
- 2 to 3 weeks
- Prioritised report
- Fixed quote
- Most chosen
Full implementation
We take you to the audit.
- Policies and controls
- Evidence prepared
- Audit support
Maintenance
Stay compliant year after year.
- Annual internal audit
- Change tracking
- Support with the auditor
ISO
What we focus on
- 01
AI system inventory and assessment
- 02
Risk and impact management
- 03
Data and model governance
- 04
Human oversight
ISO/IEC 42001
How we work
- 1
Diagnosis
Gap analysis against the framework, prioritised by risk.
- 2
Plan
A roadmap with owners, budget and schedule.
- 3
Implementation
Policies, technical controls and evidence, with your team.
- 4
Audit
Internal pre-audit and support in front of the auditor.
FAQ
Frequently asked questions
How much does preparing for ISO/IEC 42001 cost?
It depends on scope and starting point. After the first call we give you a fixed quote, no surprises.
Can I combine it with other frameworks?
Yes. We reuse shared controls so each additional certification costs far less.
Do I need ISO 42001 if I only use ChatGPT or Copilot?
It isn’t mandatory, but a light version of its controls helps prevent data leaks and meet AI Act duties as a deployer.
Can it be combined with ISO 27001?
Yes. They share structure, internal audit and management review, so they integrate into a single system.
Services
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.