ISO/IEC 42001 Readiness
End-to-end ISO/IEC 42001:2023 readiness — the first international standard for AI Management Systems (AIMS).
- Outcome
- The AI-management system regulators want to see.
- Timeline
- 4 phases3–4 weeks · 6–8 weeks · 3–5 months · 3 weeks
- Mapped to
- ISO/IECNIST · EU AI Act
- Includes
- Readout + retestFixed criticals and highs re-verified.
Know before you book.
We help you set up the AI management system in ISO/IEC 42001, so your AI is governed, documented and ready for certification.
- You build or deploy AI and customers ask how it's governed
- You're exposed to the EU AI Act or similar rules
- You want AI risk and impact assessments that stand up to scrutiny
- You already have ISO 27001 and want to extend it to AI
- You need your AI features attacked and tested firstAI Penetration Testing
- Your need is general information security, not AIISO/IEC 27001 Readiness
- An inventory of AI systems and models in use
- Data sources and third-party AI providers
- An owner for AI governance
Still not sure? Take the 2-minute check
What you walk away with.
- AIMS scope statement + AI-system inventory
- AI Impact Assessments (AIA) per ISO 42005 methodology
- Full control set (Annex A + B) implementation guidance
- Internal Audit + Management Review pack, certification-body-ready
What we cover
Agreed in writing before testing starts.
- Full 2023 Annex A control set + Annex B implementation guidance
- Clauses 4–10: Context through Improvement (mirrors ISO 27001 structure)
- AI-system inventory + role classification (provider / user / relevant party)
- AI Impact Assessments (AIA) — the operational heart of ISO 42001
- Data governance for AI — training, evaluation, deployment datasets
- Third-party AI risk (foundation-model vendors, MLOps platforms)
- EU AI Act certification directly (we support alignment; conformity assessment is a separate regime)
How we run it.
- 01
AIMS scoping
Which AI systems? Which roles do you play — provider, user, distributor, importer? Which jurisdictions?
- 02
System inventory
Every model in production, staging, and shadow. Row per system: lifecycle stage, risk classification, owner.
- 03
Impact assessments
An AIA per system — intended use, unintended use, impacted parties, mitigation. ISO 42005 methodology.
- 04
Control implementation
Annex A controls implemented with your ML/AI teams. Governance that ships, not governance that prints.
- 05
Internal audit + review
Clause 9.2 internal audit executed, Management Review packet delivered.
Technical detail.
The depth behind the engagement, for the engineer or CISO evaluating us.
- ISO/IEC 42001:2023 clauses 4–10
- Annex A AI controls
- Statement of Applicability for AI
- AI risk assessment
- AI system impact assessment
- Data quality and provenance controls
- NIST AI RMF 1.0
- EU AI Act obligations mapping
- Integration with an existing ISO 27001 ISMS
- AIMS documentation set
- Internal audit and management review
- Certification-audit evidence pack
What lands in your inbox.
- AIMS Scope Statement + AI-System Inventory
- AI Impact Assessments (one per in-scope system)
- Statement of Applicability (Annex A)
- Data & Model Governance policies + records
- Internal Audit Report + Management Review packet
Defensible under audit.
- ISO/IEC
- NIST
- EU AI Act
From call to report.
- 01Gap analysis + scoping
3–4 weeks
- 02AIMS design + AIA programme
6–8 weeks
- 03Control implementation support
3–5 months
- 04Internal audit + review
3 weeks
Asked before every engagement.
Do we need ISO 27001 first?
Not required, but strongly recommended. ISO 42001 mirrors 27001's structure — running them as one integrated management system is the efficient path.
How does this relate to the EU AI Act?
ISO 42001 isn't the AI Act, but it's the recognized baseline regulators cite. A certified AIMS materially reduces your AI Act conformity-assessment burden for high-risk systems.
Can you run this alongside an AI Pen Test engagement?
Yes. AI Penetration Testing produces evidence that plugs directly into ISO 42001 impact-assessment and data/resource controls.
Often paired with.
Ship AI with governance regulators trust.
Scoping call, program plan within 2 weeks, first internal audit inside 6 months for focused scopes.