AI policies and governance
Establishing top-level commitments to responsible AI
ISO/IEC 42001 Consulting
Get ISO 42001 Certified — Structured AI Governance That Meets the Standard and the Regulation
Our ISO 42001 consulting services help organisations across Europe build practical AI Management Systems and achieve certification. Whether you develop AI, deploy it, or rely on third-party AI tools, we get your governance audit-ready and aligned with the EU AI Act before enforcement begins.
AI Is Everywhere in Your Business — Your Governance Hasn't Caught Up
You're already using AI across your operations. Your customers, regulators, and procurement partners increasingly expect you to prove you're governing it properly.
The EU AI Act is making that expectation law. Obligations for high-risk AI systems — covering employment, credit assessment, insurance, law enforcement, and critical infrastructure — take effect on 2 August 2026, with regulated products following in August 2027. Organisations will need to demonstrate documented risk management, human oversight, data governance, and transparency, with fines reaching €35 million or 7% of global turnover.
But regulation isn't the only driver. Enterprise buyers and regulated industries are already filtering out vendors who can't evidence responsible AI governance. Without a certifiable framework, you risk losing deals, failing audits, and carrying unquantified liability from systems you don't fully understand.
ISO 42001 gives you the internationally recognised management system to close that gap — and third-party certification to prove it.
What ISO 42001 Actually Is (And Why It Matters Now)
ISO/IEC 42001:2023 is the world's first international standard for Artificial Intelligence Management Systems. Published in December 2023, it provides a framework for establishing, implementing, maintaining, and continually improving an AI Management System (AIMS) that governs how your organisation develops, deploys, and uses AI responsibly.
An AIMS is not software, a policy document, or a technical audit. It is a documented system that brings together your AI governance policies, risk assessments, ethical commitments, operational procedures, and monitoring processes into a single, auditable structure. The goal is to move AI governance from ad hoc decisions made by individual teams to a deliberate, repeatable process that is visible to leadership, understood by staff, and verifiable by external parties.
The standard is built around the Harmonised Structure (HS) common to management system standards like ISO 9001 and ISO 27001, which means it integrates naturally with management systems your organisation may already operate. Its requirements span ten clauses, with Clauses 4 through 10 containing the mandatory certification requirements. In addition, Annex A defines 38 controls across nine domains covering:
Risk and impact assessment
Identifying both organisational risks and societal consequences of AI systems
AI system lifecycle management
Governing design, development, deployment, monitoring, and retirement
Data governance
Ensuring data quality, provenance, and representativeness for AI training and operation
Transparency and stakeholder communication
Informing users and affected parties about AI capabilities and limitations
Third-party and supplier oversight
Managing governance obligations across your AI supply chain
What certification means in practice: an accredited, independent certification body audits your AIMS against the standard's requirements. If you pass, you receive a certificate valid for three years, subject to annual surveillance audits.
The ISO 27001 connection: If your organisation already holds ISO 27001 certification, you have a significant head start. The two standards share the same high-level structure, which means much of your existing documentation and governance infrastructure — context analysis, leadership commitment, competence records, internal audit processes, and management review — carries over directly. Put simply: ISO 27001 protects your data; ISO 42001 governs the logic and output of the systems that use it. They are designed to be combined, and organisations with a mature ISMS can typically reach ISO 42001 certification in 3 to 4 months rather than the 6 to 12 months a greenfield implementation requires.
What ISO 42001 Certification Actually Gets You
A clear path through the EU AI Act.
The EU AI Act requires documented risk management, data governance, technical documentation, and human oversight for high-risk AI systems. ISO 42001 maps directly to these requirements. Certification provides the auditable evidence that national regulators and notified bodies will expect as enforcement milestones arrive from August 2026 onward — and it does so through a framework that works across jurisdictions, not just within the EU.
Access to enterprise and public-sector contracts.
Regulated industries — banking, insurance, healthcare, public sector — are increasingly requiring an accredited AI governance story from their vendors and technology partners. ISO 42001 certification satisfies the security, ethics, and governance questionnaires that stall procurement cycles. For AI providers and service companies, it is becoming the table-stakes credential that ISO 27001 became for information security a decade ago.
Governance over Shadow AI.
Most organisations have employees using LLM wrappers, AI-powered browser extensions, and third-party AI services without formal oversight — so-called Shadow AI. An AIMS forces you to inventory all AI systems, classify them by risk, and bring them under managed governance. This eliminates hidden liabilities around data privacy, intellectual property, and security that organisations often do not know they are carrying.
Reduced regulatory and reputational risk.
A documented AIMS means your organisation identifies potential harms — bias, unfair outcomes, privacy violations, and safety failures — before an AI system reaches production, not after a public incident. The AI System Impact Assessment required by ISO 42001 creates a traceable record of due diligence that protects you in regulatory inquiries, procurement reviews, and legal proceedings.
Faster implementation of other AI frameworks.
ISO 42001 aligns with the NIST AI Risk Management Framework and the forthcoming wave of national AI regulations beyond the EU. Organisations that implement ISO 42001 first typically find that meeting these additional requirements takes a fraction of the effort, because the governance structure, documentation, and risk methodology are already in place.
A Practical Path from AI Inventory to Certified AIMS
Every organisation's AI landscape is different. Some are developing their own models. Others are deploying commercial AI tools across departments. Many are doing both, plus dealing with employees using unsanctioned generative AI services. Our job is to meet you where you are and guide you through a structured process that results in a certified AI Management System that actually reflects how your organisation uses AI.
Phase 1 — Discovery and Gap Analysis
We start by understanding your AI landscape: what AI systems you operate, how they are used, who is responsible for them, and where unmanaged AI tools have appeared across the organisation. We define the scope of your AIMS — which AI systems, processes, and business units the certification will cover — and conduct a formal gap analysis against ISO 42001 requirements. This gives both of us a clear, prioritised picture of what needs to be built.
What you get:
Phase 2 — Risk Assessment and Impact Analysis
This is where ISO 42001 differs most from traditional management system standards. Beyond the standard organisational risk assessment, we help you conduct AI System Impact Assessments and evaluations of the potential consequences your AI systems could have on individuals, groups, and society. We build your AI-specific risk methodology, document each risk and its treatment, and produce your Statement of Applicability — the document that maps every Annex A control to your specific situation and justifies any exclusions.
What you get:
Phase 3 — Implementation and Documentation
This is where the AIMS takes shape. We work with your team to implement the controls identified in your risk treatment plan, develop the policies and procedures the standard requires — AI policy, data governance policy, acceptable use policy, incident response procedures — and build the documentation that auditors will review. We don't hand you generic templates; we build documentation that reflects your actual AI operations, so it's practical to maintain after certification.
What you get:
Phase 4 — Internal Audit and Certification Preparation
Before the external auditors arrive, we conduct a full internal audit — essentially a dress rehearsal. We review your AIMS with the same rigour a certification body would, identify any nonconformities, and help you close them. We then prepare your team for the Stage 1 (documentation review) and Stage 2 (implementation audit) certification audits, so nobody walks in unprepared.
What you get:
AI Governance Built on 25+ Years of Management System Experience
ISO 42001 is a new standard, but management system implementation is not. We've guided over 500 organisations through ISO 27001 and other management system certifications across Europe. That experience means we understand what auditors look for, where implementations stall, and what separates a system that passes an audit from one that works in practice.
- Your ISO 27001 investment accelerates ISO 42001. If you already hold ISO 27001, you're not starting from scratch. We know the standard's shared structure inside out. We'll identify exactly which existing documentation, processes, and controls carry over and focus your team's effort on the AI-specific requirements: impact assessments, AI lifecycle governance, data provenance, and transparency obligations. This approach compresses your implementation timeline significantly.
- We tailor the system to your AI reality, not a theoretical framework. A SaaS company deploying a single customer-facing AI feature doesn't need the same AIMS as an AI model provider training large language models. We scope and build accordingly. Every control, every policy, every documented procedure serves a purpose in your specific context. We won't build governance architecture for AI risks you don't have.
- We focus on practical outcomes, not documentation for its own sake. Every policy and procedure we help you develop should serve a real purpose. If a document exists only to satisfy an audit checkbox and nobody will ever reference it again, we'll find a better way to meet the requirement.
- We stay with you through the audit. Our engagement doesn't end when the documentation is done. We prepare your team, conduct the internal audit, and remain available through the certification process to handle anything that comes up.
500+
Certifications Delivered
25+
Years of Experience
0
Failed Certification Projects
ISO 42001 FAQ
ISO/IEC 42001:2023 is the first international standard for AI Management Systems. It provides a framework for organisations to establish, implement, maintain, and continually improve how they govern artificial intelligence. The standard applies to any organisation that develops, provides, or uses AI-based products or services, regardless of size or industry. It was published by the International Organisation for Standardisation (ISO) in December 2023.
An AIMS (AI Management System) is the documented system at the heart of ISO 42001. It covers how your organisation identifies AI-related risks and societal impacts, establishes governance policies, implements controls across the AI lifecycle, and monitors whether those controls are working. It is similar in concept to an ISMS under ISO 27001, but focused on AI-specific concerns such as fairness, transparency, explainability, and the responsible use of data.
The standard is relevant to any organisation with a meaningful AI footprint. This includes AI providers (companies developing AI models or tools), AI deployers (companies using AI systems in their products, services, or operations), and organisations that rely on third-party AI services. If the EU AI Act classifies any of your AI systems as high-risk, ISO 42001 provides the governance framework that aligns most directly with the Act's requirements.
The EU AI Act is a mandatory regulation. ISO 42001 is a voluntary, certifiable management system standard. They are complementary: the Act tells you what you must comply with, and ISO 42001 gives you a structured, auditable way to demonstrate that compliance. The Act's requirements for risk management, data governance, technical documentation, transparency, and human oversight map directly to ISO 42001 clauses and Annex A controls. Certification provides the kind of documented, third-party verified evidence that regulators and notified bodies expect.
The two standards share the same high-level structure and are designed to be integrated. ISO 27001 governs information security — confidentiality, integrity, and availability of data. ISO 42001 governs AI-specific risks — fairness, transparency, explainability, and societal impact. Organisations with an existing ISO 27001 certification can reuse significant portions of their documentation and governance processes, which substantially reduces the effort and timeline for ISO 42001 implementation.
It depends on your starting point. Organisations with a mature ISO 27001 system can typically reach certification in 3 to 4 months. Those building from scratch should expect 6 to 12 months, depending on the number and complexity of AI systems in scope, the maturity of existing governance processes, and how quickly the organisation can dedicate resources to implementation.
The total cost includes consulting fees (if you work with an external partner like HEIC), the certification body's audit fees, and the internal time your staff invest in implementation. The investment is modest relative to the potential consequences of non-compliance with the EU AI Act — fines of up to €35 million or 7% of global annual turnover — and is often offset by the commercial access that certification unlocks.
An AI System Impact Assessment (AIIA) is a requirement unique to ISO 42001. Unlike a traditional risk assessment that focuses on organisational risks (financial loss, operational downtime), an AIIA evaluates the potential consequences your AI systems could have on individuals, groups, and society — including privacy violations, biased outcomes, and safety risks. AIIAs are treated as living documents, updated whenever the AI system's purpose, architecture, or data changes significantly.
Yes. The standard uses the same Harmonised Structure (HS) as ISO 9001, ISO 27001, ISO 14001, and other management system standards. Organisations that already hold one or more of these certifications can integrate ISO 42001 into their existing management system framework, avoiding duplication and reducing the total governance overhead.
Yes. Like all management system standards, ISO 42001 is designed to scale. A 20-person company using a handful of commercial AI tools will implement a far leaner AIMS than a technology company developing its own AI models. The standard does not prescribe a fixed set of controls; you select and justify the controls that are relevant to your specific AI risks and operations through the Statement of Applicability.
Ready to Get Your AI Governance Audit-Ready?
Talk to one of our experts about your AI landscape and regulatory obligations. We'll give you an honest assessment of what's involved and how we can help — whether you're starting from scratch or building on an existing ISO 27001 system.
- A clear project timeline based on your AI landscape and starting point
- Practical, tailored advice — not a one-size-fits-all approach
- An honest assessment of costs, effort, and what to expect from auditors
- No obligation — just a conversation about your options
Speak to an Expert
We'll get back to you within one business day.