Prove it · ISO 42001
Govern your AI, and prove it.
ISO/IEC 42001 is the international standard for AI management systems. We turn it into working governance for the AI you use and build, with the evidence to go into certification with confidence.
- ISO/IEC 42001 practitioners and auditors
- Gap analysis first, so scope and cost are clear
- Governance first; certification follows
- Works alongside ISO 27001
What you get
Know what AI you run
An inventory of your AI systems, who owns them and the risks they carry.
Decisions based on evidence
Risk and impact assessment built into how AI is chosen, used and reviewed.
Assurance for customers
A recognised standard that answers customer, regulator and investor questions about your use of AI.
What is included
- AI scope definition and ISO 42001 gap analysis
- AI inventory
- AI management system design
- Risk methodology
- Impact assessment process
- Policies and controls
- Implementation support
- Internal audit preparation
Who it is for
Organisations using or building AI that need to show customers, regulators or investors it is governed properly, from mid-sized firms to private equity portfolios.
How it works
- 1
Discover
Identify your AI systems, the people involved and how mature your governance is today.
- 2
Assess
A formal gap analysis that sets out gaps, risks and priorities.
- 3
Design
Governance, risk methods, policies and documentation for your AI management system.
- 4
Implement
Put it in place and check the evidence, controls and documentation ready for audit.
Independently verified, continuously.
ISO 27001 certified since 2016, Cyber Essentials Plus, CREST-certified testers and an Assurix Trusted MSP.
See how we are verifiedQuestions we are often asked
What is ISO/IEC 42001?
The international standard for AI management systems: how an organisation governs the AI it develops or uses.
How is it different from ISO 27001?
ISO 27001 covers information security. ISO/IEC 42001 covers the governance of AI. The two work well together.
Does it make us compliant with the EU AI Act?
Not on its own. It is complementary to the EU AI Act and can support your approach, but it does not guarantee compliance.
How long does it take, and what does it cost?
It depends on your size, scope and starting point. We always begin with a gap analysis, which sets a realistic timeline and cost before you commit.
Do you carry out the certification audit?
No. Certification is carried out by an independent, accredited certification body. We prepare you for it and support you through the audit.
Is ISO/IEC 42001 suitable for a smaller organisation?
Yes. The standard scales, and we keep the system proportionate to your size and risk.
What happens after certification?
The system has to be kept running, with monitoring, internal audit and improvement. We can support you with that on an ongoing basis.
What is an AI management system?
An AI management system (AIMS) is the set of policies, roles, processes and controls you use to govern how AI is chosen, used and overseen in your organisation.
Is ISO/IEC 42001 a legal requirement?
No. But it helps you show responsible AI governance to clients, regulators and insurers, and it supports your wider regulatory obligations.
Often paired with
Talk to us.
A short, no-obligation conversation about what this would look like for your organisation.