ISO & Compliance Advisory
ISO/IEC 42001 consulting for AI you can evidence control of.
Build an AI management system that governs how your organisation develops, buys and runs AI, prepared for certification and grounded in how AI systems actually fail.
- Practice
- ISO & Compliance
- Standard
- ISO/IEC 42001
- Lead practice
- AI Security
- Pairs with
- ISO 27001, EU AI Act
What is ISO 42001?
ISO/IEC 42001 is the international standard for an AI management system (AIMS): how an organisation sets policy for AI, assesses AI risk and impact, controls the AI systems it builds or uses, and keeps evidence that it does. Like ISO 27001, certification is awarded by an accredited certification body.
Because AI security is our lead practice, the risk assessment behind the management system is informed by how AI systems are actually attacked: prompts, retrieval, agents, tools and the data they can reach.
Who it is for.
- Organisations building or deploying AI that customers ask about
- Companies already certified to ISO 27001 that want to extend to AI
- Teams preparing for EU AI Act obligations who want a management-system foundation
- Risk and compliance leads who need a defensible AI governance structure
What we do.
AI inventory and scope
Which AI systems you develop, deploy or buy, who owns them, and what the management system will cover.
Gap assessment
Where your current AI governance stands against ISO/IEC 42001, and a prioritised plan to close the gap.
AI risk and impact assessment
Identify, assess and manage risks introduced by AI adoption, deployment and autonomous decision-making.
AIMS implementation
AI policy, roles, controls and procedures, integrated with an existing ISO 27001 ISMS where there is one.
Internal audit and readiness
Internal audit of the AI management system and preparation for the certification body's audit.
What actually arrives.
An engagement that ends at a slide deck leaves you with an opinion. These are the artefacts this one produces.
Gap assessment report
Current AI governance against ISO/IEC 42001, with a prioritised roadmap.
AI system inventory
The AI systems in scope, their owners and their risk profile.
AIMS documentation
AI policy, risk and impact assessment method, control set and procedures.
Evidence pack
The records an auditor or customer will ask for, organised and current.
Frequently asked questions.
- Do we need ISO 27001 before ISO 42001?
- No, but they share the same management-system structure, so organisations with an ISMS can extend it rather than build a second system.
- Does ISO 42001 certification mean we comply with the EU AI Act?
- No. They overlap but are not the same thing. An AI management system gives you much of the governance foundation the EU AI Act expects; specific obligations still need to be assessed for each AI system.
- Do you issue ISO 42001 certification?
- No. Certification is issued by an accredited certification body. We prepare you for its audit.
- Does the work include technical AI security testing?
- It can. Many clients pair the management system with an AI security assessment so the risk register reflects how their systems can actually be attacked.
Next step
Talk to us about ISO 42001 Consulting.
Start with a scoping conversation.
Describe the system and the decision you need to make. You will get a practitioner's view of where the risk actually sits, and what the engagement should cover, before anything is scoped.