ISO/IEC 42001
A practical, scoped engagement for organisations seeking ISO/IEC 42001 support.
How we work
We agree the engagement scope and adapt the activities to your environment, obligations and objectives.
- 01Inventory AI systems, stakeholders and intended uses.
- 02Define the AI management system scope and responsibilities.
- 03Assess AI-specific risks and impacts throughout the lifecycle.
- 04Implement governance, oversight, documentation and review processes.
- 05Conduct an internal review and prepare for independent assessment.
What you can expect
A documented scope, relevant findings or gaps, agreed actions and a clear record of ownership. Exact deliverables and timing are agreed for each engagement.
What we need to get started
Your objective, applicable locations or systems, current position, key stakeholders and any target date. Please avoid sending confidential information in the initial enquiry.
Artificial intelligence management system (AIMS)
Create accountable governance for AI systems your organisation develops, provides or uses, across their lifecycle.
- 01ScopeInventory AI and roles
- 02AssessEvaluate risks and impacts
- 03ImplementEstablish lifecycle controls
- 04ReviewMonitor and audit
- 05CertifySupport independent assessment
ISO/IEC 42001:2023: scope and objectives
Create accountable governance for AI systems your organisation develops, provides or uses, across their lifecycle.
ISO/IEC 42001 concerns the organisation’s AI management system. Certification is voluntary and does not by itself certify that an individual model or AI output is safe.
Proposed scope of services
We agree the scope, delivery responsibilities and outputs for each engagement. The activities below describe a practical path and are tailored to your organisation.
| Engagement phase | Activities |
|---|---|
| AI inventory and scope | Identify AI-enabled products, services and uses, lifecycle stages, organisational roles, suppliers and boundaries for the AIMS. |
| Leadership and governance | Define the AI policy, objectives, responsibilities and escalation routes, with oversight appropriate to the systems in scope. |
| AI risks and impacts | Assess risks and potential impacts on individuals, groups and the organisation; document decisions, owners and treatment actions. |
| Data and supplier governance | Review data sources, permissions, quality, supplier dependencies and contractual responsibilities relevant to AI use. |
| AI lifecycle controls | Define and improve controls for design, development, testing, deployment, change, operation and retirement as applicable. |
| Transparency and human oversight | Document intended use, limitations, responsibilities and oversight or intervention points appropriate to each system. |
| Monitoring and incident response | Establish processes to monitor performance, issues, changes and incidents, and to escalate or suspend use where appropriate. |
| Evidence and awareness | Organise AI inventories, assessments, approvals, review records and staff guidance. |
| Internal audit and management review | Assess the AIMS and evidence, record gaps, support leadership review and track corrective actions. |
| Independent assessment support | Coordinate readiness, auditor requests and follow-up with the selected independent certification body. |
Readiness and certification path
We work with your team to establish the management system, operate the agreed processes, review evidence and address internal findings. The selected independent certification body determines its own audit scope and conducts the assessment. Initial certification commonly includes a Stage 1 readiness and planning review followed by a Stage 2 assessment of implementation and effectiveness. We can support coordination, responses and corrective actions; the independent body makes the certification decision.
Typical deliverables
- AIMS scope, AI system inventory and governance map
- AI risk and impact assessment records and treatment tracker
- Lifecycle policies, procedures and responsibility matrix
- Monitoring, incident and evidence records
- Internal audit, management review and assessment-support records
Our engagement approach
- Scope-led: tailor the management system to the organisation’s activities, boundaries and objectives.
- Evidence-driven: connect documented processes to responsible owners and evidence of operation.
- Practical implementation: prioritise gaps and improvements with agreed owners and timeframes.
- Independent assessment: support the audit process while preserving the certification body’s independent role.
- Continual improvement: hand over actions and review arrangements so the management system can continue to operate.
Reference: ISO guidance for ISO/IEC 42001:2023. The applicable edition, scope, assessment arrangements and deliverables are confirmed for each engagement.
Where an independent certification or attestation applies, the relevant independent body makes its own assessment and decision. Scope and availability are agreed individually.