ISO/IEC 42001:2023
ISO 42001 consulting: certify how your company governs AI
We help you design, implement and certify an AI management system (AIMS) under ISO/IEC 42001 — led by a certified ISO 42001 specialist and integrated with ISO 27001 and the EU AI Act.
- ISO/IEC 42001:2023
- Annex A · 38 controls
- ISO/IEC 42005
- ISO/IEC 23894
- EU AI Act
- EU company · Estonia
- ISO/IEC 42001-certified specialist
- ECSO member network
- Certified ethical hackers
- Remote across the EU
Why ISO 42001
The first certifiable standard for AI governance
ISO/IEC 42001 is the international standard for AI management systems. It sets out how an organisation should govern the AI it develops, provides or uses: policies, roles, risk and impact assessment, data, transparency, human oversight and continual improvement. Certification gives clients, partners and regulators independent evidence that you use AI responsibly.
- Answer client and tender questions about AI with a recognised certificate
- Build the governance backbone for EU AI Act obligations
- Reuse your ISO 27001 management system instead of starting from scratch
- Reduce AI risks: bias, data leakage, unreliable outputs and misuse
Who it’s for
Is ISO 42001 right for you?
PROVIDERS
AI product companies
SaaS and software providers that build AI features into their products and need to prove trustworthiness to enterprise buyers.
DEPLOYERS
Companies using AI at scale
Organisations deploying AI in HR, customer service, credit, operations or decision-making that want control and accountability.
INTEGRATION
ISO 27001-certified organisations
Extend your existing ISMS into an integrated management system covering AI with minimal duplication.
SUPPLY CHAIN
Suppliers in regulated sectors
Vendors to banks, insurers, healthcare and public bodies, where AI governance is becoming a procurement requirement.
Roadmap
From AI inventory to certificate
AI inventory & scope
We identify the AI systems you develop, provide or use and define the scope of your AI management system.
Gap analysis
We assess your practices against clauses 4–10 and the Annex A controls of ISO/IEC 42001.
Risk & impact assessment
AI risk assessment and AI system impact assessment for people and society, aligned with ISO/IEC 23894 and ISO/IEC 42005.
Implementation
AI policy, roles, lifecycle processes, data controls, Statement of Applicability and supplier requirements.
Audit & certification
Training, internal audit and management review, then support through Stage 1 and Stage 2 audits with an accredited certification body.
Scope of work
What our ISO 42001 consulting includes
CLAUSES 5–6
AI policy & governance
AI policy, objectives, roles and responsibilities, and an approval workflow for new AI use cases.
ANNEX A
Annex A controls
Selection and implementation of controls across the AI lifecycle: data, documentation, transparency, human oversight and third parties.
ISO/IEC 42005
AI impact assessment
A repeatable method to assess impacts on individuals and society before deploying an AI system.
INTEGRATED
Integration with ISO 27001
One management system, one set of audits: shared risk process, document control, internal audit and management review.
TESTING
AI security testing
Our ethical hackers test your chatbots, assistants and agents for prompt injection, data leakage and insecure tool use.
REGULATION
EU AI Act alignment
We map ISO 42001 controls to your AI Act obligations so one programme supports both.
ISO 42001 vs EU AI Act
Standard and law: how they fit together
| ISO/IEC 42001 | EU AI Act | |
|---|---|---|
| Nature | Voluntary, certifiable international standard | Binding EU regulation |
| Focus | How the organisation manages AI (management system) | Obligations by AI system and risk level |
| Who | Any organisation developing, providing or using AI | Providers, deployers, importers and distributors in the EU market |
| Proof | Certificate from an accredited certification body | Compliance obligations, conformity assessment for high-risk systems |
ISO/IEC 42001 is not a harmonised standard under the AI Act and does not by itself give presumption of conformity. It does, however, provide the governance, risk and documentation processes that most AI Act obligations rely on.
FAQ
Frequently asked questions
What is ISO 42001?
ISO/IEC 42001:2023 is the international standard that specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS). It is certifiable by accredited certification bodies.
How long does ISO 42001 certification take?
Typically 4–9 months, depending on the number of AI systems in scope, existing governance and whether you already have ISO 27001, which shortens the project considerably.
Do we need ISO 27001 before ISO 42001?
No, they are independent standards. But they share the same high-level structure, so organisations certified to ISO 27001 can extend their existing management system to cover AI efficiently.
Does ISO 42001 make us compliant with the EU AI Act?
Not automatically. ISO 42001 is voluntary and is not a harmonised standard under the AI Act. It provides the governance processes — risk management, documentation, oversight — that make meeting AI Act obligations much easier.
Do you issue the certificate?
No. Certification is granted by an independent accredited certification body. Our ISO 42001-certified specialist prepares you and accompanies you through the audits.
Next step
Make responsible AI provable.
Start with an AI inventory and a gap analysis against ISO/IEC 42001.