ISO/IEC 42001 Implementation
Building an AI management system that passes external audit and is worth operating afterwards — scoped realistically, reusing the ISO 27001 machinery you already run rather than standing up a parallel one.
Certification is increasingly a commercial requirement rather than a badge — enterprise buyers and public bodies are asking for it in procurement. The risk is building a management system that satisfies an auditor and nobody else, which is expensive to maintain and produces no benefit between audits.
ISO/IEC 42001 is the international standard for an AI management system. It specifies requirements for establishing, implementing, maintaining and continually improving how an organisation governs its AI, and it is certifiable by an accredited body. Its structure mirrors ISO 27001, so organisations already certified there have most of the surrounding machinery in place.
Scope is the decision that determines cost
The scope statement defines what is certified, and it is where most of the programme's cost and duration are set. Getting it wrong in either direction is expensive:
- Too broad and every AI system in the organisation is dragged into the evidence burden, including experiments that will be retired next quarter.
- Too narrow and the certificate does not cover what your customers are actually asking about, which defeats the commercial purpose.
- Misaligned with existing certifications and you maintain two management systems that disagree about the same controls.
We scope against the commercial reason for certifying — which customers, which contracts, which systems they care about — and then confirm it is defensible to an auditor rather than merely convenient.
What the standard requires, in practical terms
Context, and an AI policy that means something
The organisation's purposes for AI, interested parties, and a policy that states actual positions rather than aspirations. Auditors read the policy and then look for evidence it is followed; a policy promising more than you do is worse than a modest one.
Roles, responsibilities and competence
Named accountability, defined responsibilities and evidence that the people involved are competent for their roles — which means training records, not assertions.
AI risk assessment and treatment
A repeatable process producing consistent results, applied to your real systems, with treatment decisions recorded and reviewed. See AI risk assessment and model cards.
AI system impact assessment
The standard's distinctive requirement: assessing consequences for individuals and society, not only risk to the organisation. This is the control most likely to be found immature at audit, because it asks a question ordinary risk processes do not.
Controls, with justified exclusions
The Annex A controls span the AI lifecycle, data, third parties and transparency. Not all apply to every organisation; what matters is that inclusions are implemented and exclusions are justified in writing.
Operation, monitoring, internal audit, management review
The continual improvement cycle. Certification requires evidence that it has actually run at least once, which is why a programme cannot be compressed below the time it takes to generate genuine records.
Reuse ISO 27001 rather than duplicating it
If you are already certified to ISO 27001, the management system structure, internal audit function, management review cadence, document control and corrective action process are all reusable. Organisations that build a separate AI management system pay twice and then maintain two sets of records that gradually disagree with each other.
The route to a certificate
| Stage | What happens | Typical timing |
|---|---|---|
| Gap assessment | Current state against the standard, scope drafted | Weeks 1 to 4 |
| Implementation | Policies, processes and controls built and put into use | Weeks 5 to 18 |
| Evidence generation | The system runs, producing genuine records | Weeks 12 to 24 |
| Internal audit and management review | Required before certification; findings corrected | Weeks 20 to 26 |
| Stage 1 audit | Certification body reviews documentation and readiness | After week 24 |
| Stage 2 audit | Implementation audited in practice; certificate issued | Typically 4 to 8 weeks later |
We are not a certification body and cannot issue the certificate — that is a deliberate separation, since a firm that both implements and certifies is not offering assurance. We prepare you and support you through the audits.
How the engagement runs
Evidence has to accumulate over time, which sets the floor on how fast certification can happen.
Gap assessment and scope
Current state against the standard; scope drafted against the commercial reason for certifying.
Build
Policy, roles, risk and impact assessment processes, and the applicable Annex A controls implemented.
Operate and evidence
The management system runs on real systems, generating genuine records rather than retrospective ones.
Internal audit and management review
Both conducted, findings corrected and the corrections evidenced.
Certification support
Stage 1 and Stage 2 audits supported, with findings addressed.
What you receive
A management system that passes audit and remains useful between audits.
Scope statement
Defensible to an auditor and aligned to the commercial reason for certifying.
Management system documentation
Policy, roles, procedures and document control, reusing existing ISO machinery.
Risk and impact assessment processes
Repeatable, applied to real systems, with decisions recorded.
Annex A control implementation
Applicable controls in operation, with justified exclusions written down.
Evidence pack
Genuine records from the system operating, organised for audit.
Internal audit and management review
Conducted, with findings corrected and the corrections evidenced.
Is this the right engagement?
Worth being direct. ISO/IEC 42001 Implementation is the wrong spend in some situations, and those are listed rather than buried.
Good fit if
- Customers or public procurement are asking for AI certification.
- You are already ISO 27001 certified and want to extend to AI.
- A structured, auditable AI management system is wanted regardless of the certificate.
- AI governance exists informally and needs to become evidenced.
- Certification is a stated commercial objective with a date attached.
Choose something else if
- You need EU AI Act readiness specifically. See EU AI Act compliance.
- You want governance without certification. See framework design.
- No management system experience exists anywhere in the organisation and there is no appetite to build it.
- The timeline demands a certificate within weeks, which no honest programme can deliver.
Frequently asked questions
Marked up with FAQPage schema so these answers can surface directly in search results and inside AI assistant responses.
What is ISO/IEC 42001?
The international standard for an AI management system — the requirements for establishing, running and improving how an organisation governs its AI. It is certifiable by an accredited body, and its structure mirrors ISO 27001, which is why organisations already certified there have most of the surrounding machinery in place.
How long does certification take?
Typically six to twelve months from a standing start. The binding constraint is not documentation but evidence: the management system has to actually run, produce genuine records, and complete an internal audit and management review before a certification body will audit it. Organisations already running ISO 27001 move considerably faster.
Do we need it if we are already ISO 27001 certified?
They cover different things. ISO 27001 governs information security; ISO 42001 governs AI-specific concerns including impacts on individuals and society, lifecycle risk and transparency. Being 27001 certified makes 42001 much cheaper to achieve because the management system structure is reusable, but it does not substitute for it.
Does ISO 42001 make us EU AI Act compliant?
No, and any claim otherwise should be treated carefully. They overlap substantially on governance, risk management and documentation, so a well-built 42001 system covers much of the groundwork. The Act imposes specific legal obligations — classification, conformity assessment, registration — that a management system standard does not address.
Can you certify us?
No, deliberately. Certification must come from an accredited certification body, and a firm that both implements and certifies is not providing assurance to anyone. We prepare the management system, generate the evidence and support you through Stage 1 and Stage 2 audits.
Often paired with this
Most clients combine two or three engagements from the AI Governance, Security and Compliance pillar. These are the ones that most often run immediately before or after.
AI Governance Framework Design
Proportionate risk tiers, named accountability and decision rights — a framework people follow rather than route around.
Read more →AI Audit and Third-Party Assurance
Independent assessment against a stated standard, with evidence tested rather than taken on assertion.
Read more →AI Risk Assessment and Model Cards
Risk assessments that end in decisions, and model cards that state limits honestly rather than advertising.
Read more →Is this the right engagement?
Tell us what you are trying to build. If a different service fits better, or if you do not need us at all, we will say so.