ISO 42001
An AI management system that survives contact with reality
Certification is the outcome. A system your people actually run is the point.
It is easy to build an AI management system nobody uses
ISO 42001 is a good standard.
It is also new enough that most implementations are being done by people reading it for the first time, and the usual failure mode is a documentation set that satisfies an auditor and changes nothing. Having an ISO 42001 certified Senior Lead Implementer alleviates this risk.
The second failure mode is scope. Too wide and you will drown in evidence for AI you barely use. Too narrow and it will not cover the thing that actually worries your board.
ISO 42001 is purposely designed to closely follow the same process as ISO 27001, ISO 9001 and others so evidence and artefacts can be shared.
What you get
A defensible scope
The decision that determines how hard everything else will be.
Risk assessment that means something
Real exposures, assessed properly, not a heat map.
The documentation set
Policy, objectives, roles, controls, statement of applicability.
Alignment to what you already have
Mapped and aligned against existing standards such as ISO 27001, NIST AI RMF, or ISO 9001, so you build one evidence set.
Internal audit and review
The parts most implementations leave until the auditor asks.
A system your team can run
ISO 42001 is a joint effort with internal staff, which results in handover, not dependency.
How it works
- Scope and gap assessment. Where you are, what the standard asks, what it will cost to close.
- Plan against your deadline, not a generic project template.
- Build alongside your team, so they understand what they are operating.
- Map to existing systems. If you have ISO 27001, much of the management-system machinery already exists.
- Internal audit, then fix what it finds.
- Certification support. Ready for the auditor, and present when they ask the awkward question.
Who it is for
- Organisations where AI is becoming material to the service they deliver
- Anyone already certified to ISO 27001 who wants to extend rather than duplicate
- Providers whose clients or contracts are starting to ask about AI assurance
- Boards wanting external validation rather than internal assurance
The Certification Process
Who audits what I build?
Not me, and that is deliberate. I don’t get to mark my own homework!
A certification body cannot audit a management system it built itself, and nor should it.
Governance Works is a member of the SAI Global Consultants and Affiliates Program. I do the implementation; SAI Global audits it later as an independent certification body. The separation stays intact, and you are not left guessing whether what you built will survive the audit.
Of course, you are free to choose your own independent auditor, I have no commercial or other arrangement with SAI Global. This is necessary to ensure independence.
Not sure where to start?
Tell me what you're facing. You'll get a straight answer on whether this is the right piece of work, and what it would involve.