ISO 42001 Consultancy and Certification Support

ISO/IEC 42001:2023 is the first management system standard for artificial intelligence. It sets out how an organisation governs the AI it develops, supplies or uses, and it is the standard your customers will ask about before they ask about anything else AI-related.

We build AI management systems to ISO 42001 and support you through to certification. Accredited certification to ISO 42001 became available in the UK during 2026, so an accredited certificate is now obtainable rather than theoretical, though far fewer bodies hold accreditation for it than for the long-established standards.

What ISO 42001 actually requires

The standard follows the same harmonised structure as ISO 9001 and ISO 27001, which means clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement. If you already hold another ISO certificate, that machinery is built and reusable.

What is specific to ISO 42001 sits in two places. The first is Annex A, which provides 38 reference controls grouped into domains covering AI policy, internal organisation and roles, resources, impact assessment, the AI system lifecycle, data for AI systems, information for interested parties, use of AI systems, and third-party and supplier relationships. As with ISO 27001, you select the applicable controls and justify the rest.

The second is the AI system impact assessment, and it is the requirement that makes this standard different from anything you have implemented before.

The AI impact assessment

Conventional risk assessment asks what could go wrong for the organisation. An AI impact assessment asks what could go wrong for other people: individuals, groups and society. It expects you to consider intended and unintended consequences, the potential for discriminatory outcomes, privacy implications, and effects on human autonomy and decision-making.

That is an unfamiliar exercise for most management teams, and it is where implementations either become meaningful or become paperwork. It has to be done before deployment and kept current through the system's life, not written once and filed.

Who needs it

ISO 42001 applies whether you build AI, buy it, or embed someone else's model in your product. That last category catches people out. If you have added an AI feature to your software using a third-party model, you are providing an AI system and the standard is relevant to you.

In practice the demand is coming from three directions: software and technology businesses whose customers have started asking AI governance questions in due diligence; regulated sectors where automated decision-making already attracts scrutiny; and organisations supplying the public sector, where AI assurance requirements are appearing in procurement.

How we implement it

1. AI inventory and gap analysis. Establishing what AI you actually use, which is almost always more than the leadership team thinks once embedded features and departmental tools are counted.
2. Scope and policy. Defining what the management system covers and setting the AI policy and roles.
3. Impact assessment. Running the assessment properly on the systems in scope, and building a method you can repeat.
4. Controls and Statement of Applicability. Selecting from Annex A, justifying exclusions, and closing the gaps.
5. Lifecycle and supplier controls. Data governance, verification, human oversight, monitoring, decommissioning, and the supply chain for models you did not build.
6. Internal audit and management review, then support through stage 1 and stage 2.

For an organisation already certified to ISO 27001, this is typically eight to twelve weeks, because the underlying system exists and the information security controls overlap substantially. Starting from nothing takes longer.

ISO 42001 and ISO 27001 together

These two integrate well and most businesses coming to ISO 42001 already hold ISO 27001 or want both. Data governance, supplier management, access control and incident response serve both standards. Running them as one integrated system with a single audit programme and one management review is materially cheaper than running two, and certification bodies will generally combine the audits.

See our ISO 27001 consultancy if information security is also in scope.

Common problems we fix

Nobody knows what AI the business uses. The inventory is the first real piece of work, and it usually finds tools adopted by individual teams that no one has assessed.

The impact assessment is written as a risk register. If your assessment only lists risks to the organisation, it has missed the point of the standard and an assessor will say so.

Supplier controls are assumed rather than evidenced. Using a third-party model does not transfer responsibility. You still need to show you assessed it.

Human oversight exists on paper only. Claiming a human reviews an automated decision, where in practice the volume makes genuine review impossible, is a finding waiting to happen.

Getting certified to ISO 42001

We take you all the way to certification and we do not leave you to face the audit on your own. We build the AI management system, support you through your internal audit and management review so your team owns them, and close out anything an assessor would otherwise raise before the audit rather than after it. By the time the assessor arrives your people can answer for the system themselves, which is the whole point of building it around how you actually work.

We also help you choose the right certification body, based on an objective review of what you need rather than habit. For ISO 42001 that review matters more than usual, because far fewer bodies hold accreditation for this standard than for the long-established ones. That means less choice, less price competition and longer lead times, so availability is often the deciding factor rather than cost. We check whether accreditation is actually required for your customers before assuming it is.

Benefits of ISO 42001 certification

• Answers AI governance questions in customer due diligence with evidence rather than assurances
• Establishes what AI the organisation actually uses, and who owns it
• Demonstrates responsible AI practice to regulators and interested parties
• Integrates with an existing ISO 27001 system at modest additional cost
• Positions the business ahead of procurement requirements that are still forming