ISO/IEC 42001, on the system you already run — or from the ground up.
AI governance and an AI management system that reuse what you have, and add what is AI-specific.
The question we hear
“Now AI is in scope too. I don't want a second system beside the one we already run.”
“We have no management system yet, and the customers are asking how our AI is governed.”
Extend the system you already run
An ISO/IEC 27001 ISMS or an ISO 9001 QMS already carries most of what an AI management system needs. Governance and leadership structures, policies and responsibilities, how risk is handled, documented information, competence and awareness, the internal audit programme, management review, corrective action and improvement: all of it can usually be reused or extended rather than built again.
What is specific to AI is added where it belongs. The AI policy and objectives. The AI risk assessment and the AI system impact assessment. Lifecycle controls, data and model provenance, human oversight, transparency to the people affected, and the third-party AI you depend on.
The result is one integrated system: common processes where they fit, and the AI requirements met in full.
| Standard | The question it asks of the process |
|---|---|
| ISO/IEC 42001 | What risks and impacts arise from the AI in it, and what could the AI improve? |
| ISO/IEC 27001 | What information does the process depend on, and what happens if it is compromised? |
| ISO 9001 | Can the process deliver what it should, every time? |
Take an order-to-delivery process with AI-based production planning. Through the quality lens, the risk is late deliveries from poor planning. Through the security lens, it is lost or corrupted planning data. The AI lens adds what the optimizer could get wrong because of model, data or performance limits, and what it could improve: utilization, lead times, delivery performance. One process, one risk architecture, three assessments inside it.
Or from the ground up
Where no management system exists, or the one you have is not the right base, we design and build the AI management system itself: scope and context, the AI policy and objectives, governance structures and responsibilities, the AI risk and impact assessment process, lifecycle governance and controls, monitoring and improvement, and readiness for the certification body's audit.
We build it in the order your organization can absorb, on the processes and systems it already runs. The aim is a system people use, rather than one they maintain.
Where to start
An AI governance and risk assessment against NIST AI RMF and ISO/IEC 42001. Fixed scope, weeks. The first engagement's job is to show where you stand; its findings write the next proposal.
What you get
- A scored gap register with the evidence behind each finding
- A system design: scope, shared processes, AI-specific additions, roles, the risk and impact method, the Statement of Applicability
- The documents the standard requires, and no more
- A readiness view before the certification body comes
What you provide
- Access to the people who own the processes and the systems
- The existing system's documents
- One decision-maker
We don't implement ISO/IEC 27001 or ISO 9001. Where the existing system itself needs building, we say so and refer you on.
Certificates come from accredited certification bodies after their own audits. We prepare you; we don't certify.
Where we built the AIMS, we don't later act as its internal auditor.
The next step would be a conversation about which systems you run and where the AI sits. We'll come back with a scoped proposal.
Start a conversation
Tell us which systems you run and where the AI sits. We'll come back with a clear read on where you stand and a scoped proposal.