ISO/IEC 42001: an AI management system that holds up in production.
The standard for governing the AI you provide or use: what it asks in business terms, where the effort belongs, and how we work with it.
Implementation · integration · internal audits · assessments
What the standard asks, in business terms
ISO/IEC 42001 asks for a management system for the AI you provide or use. The idea is plain: decide what AI is for in your organization, know what it could do to people and to the business, and be able to show that someone is accountable for it and that the controls work.
In the standard's own terms, that means a defined scope, an AI policy and objectives, roles and accountability, an AI risk assessment and an AI system impact assessment, and a set of controls chosen against Annex A's reference list. The controls run across the lifecycle of each system, the data it learns from and uses, the information you give to the people affected, how the system is used, and the third parties you depend on. Annex A groups them: A.5 for the impact assessment, A.6 for the lifecycle, A.7 for data, A.8 for the information you give to interested parties, A.9 for use, A.10 for third parties.
Around that sits the machinery every management system has: monitoring, internal audit, management review and improvement. Annex A is a reference set rather than a mandate. You determine the controls your risk treatment needs, then compare them against Annex A to check nothing necessary was left out. The Statement of Applicability records what you included, what you excluded, and why.
Where the effort usually goes, and where it should
The policy binder is the easy part. A control that exists only in a policy has not reached the system that runs the process, so the effort belongs where the control is enforced: in the pipeline, the access model, the logging, the review step a person has to perform.
The impact assessment earns its place when it reaches the people the AI affects, not only the organization. ISO/IEC 42005 gives the guidance for it. The same applies to evidence: a control designed well and never tested is an assumption, so the system needs a way to show that each control still works.
The Statement of Applicability is worth writing as a reasoned document. Each inclusion and each exclusion carries its reason. An auditor reads that first, and so do your own people when they ask why a control exists.
How we work with it
Implementation and integration into an existing ISMS or QMS is the principal offer: the shared processes reused, the AI-specific requirements added where they belong. Where nothing exists yet, we implement from the ground up.
The usual start is an AI governance and risk assessment against NIST AI RMF and ISO/IEC 42001, fixed scope, weeks. Internal audits and readiness assessments are done by an auditor independent of the build. Where we built the system, someone else audits it.
How it connects
AI systems enter an ISMS as supporting assets of the processes it protects, and the two standards' risk assessments can run as one risk process. An organization certified to ISO/IEC 27001 extends rather than duplicates.
An AI step inside a quality process is still a process step the QMS controls. The order-to-delivery example on the service page shows the three views of one process.
Article 50 transparency duties, and the enforcement of the general-purpose AI rules, have applied since 2 August 2026. The high-risk obligations of Chapter III apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems. Those are application dates, moved by the Digital Omnibus on AI; the duty to operate a quality management system in Article 17(1) was not amended. An ISO/IEC 42001 certificate contributes to the quality management system Article 17 asks of high-risk providers, and its reach ends where the Act's own requirements begin.
In North America, NIST AI RMF is the common frame. The assessment reads your system against both, and the two map onto one management system.
What we can say about our competence
PECB Certified ISO/IEC 42001 Lead Implementer. PECB Certified Artificial Intelligence Manager (CAIM). PECB Certified ISO/IEC 42001 Provisional Auditor. The full list, with the stages kept apart, is on the About page.
Valment also runs its own AI management system internally, under the same governance it advises on.
A good place to start is the assessment: a scored view of where you stand against NIST AI RMF and ISO/IEC 42001, and findings that write the next step.
Start a conversation
Tell us which systems you run and where the AI sits. We'll come back with a clear read on where you stand and a scoped first step.