An ISO 42001 AI management system you can get audited
Gap assessment, implementation and internal audit for ISO/IEC 42001, built on the ISO 27001 processes you may already have. Our engineers know what the controls look like in code as well as in documents.
A management system for AI rather than a technical checklist
ISO/IEC 42001 asks the same questions as other management-system standards: what is the context, who leads, what are the risks, what resources and competence exist, how is operation controlled, how is performance measured and how do you improve. It then adds AI-specific controls.
Its annex groups controls into nine areas. They cover AI policies, internal organisation, resources, impact assessment and the AI system lifecycle. The remaining areas are data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships.
The standard applies whether you build models, buy them, or embed a provider's API into a product. Most of our clients are in the last group.
Who benefits
Vendors whose enterprise customers now ask for AI assurance alongside ISO 27001.
Regulated firms that want a recognised structure for AI oversight.
Organisations preparing for the EU AI Act that need an auditable management system.
Companies with an ISO 27001 programme looking for the shortest path to AI coverage.
Relationship to ISO 27001
Shared structure, different controls
Both standards follow the same harmonised clause structure, so leadership, risk, documentation, internal audit and improvement processes carry across. The controls do not: 27001 protects information; 42001 governs how AI is developed, used and assessed for impact.
What carries over and what is new. Teams with ISO 27001 typically reuse their governance machinery and spend their effort on AI-specific controls.
Gap assessment
How the gap assessment runs
Scope
Which AI systems, teams and sites are in scope. Whether you act as developer, provider, user or a mix. Existing certifications and policies.
Clause review
Interviews and document review against each management-system clause: context, leadership, planning, support, operation, evaluation, improvement.
Control review
Each annex control checked for existence, implementation and evidence. We look at the systems themselves as well as the policy that describes them.
Gap report and plan
Rated gaps, a prioritised implementation plan with effort estimates, and a statement of applicability draft.
What we deliver
From gap report to internal audit
Gap report
Clause-by-clause and control-by-control status with evidence references and a ranked remediation plan.
Policy and procedure set
AI policy, risk and impact assessment procedures, lifecycle and data standards, written to fit your existing document system.
AI impact assessments
Completed assessments for your in-scope systems, covering individuals, groups and society, linked to your DPIAs where relevant.
Technical controls
Model inventory, evals as release gates, logging, monitoring and supply chain checks, implemented with your engineers.
Statement of applicability
Which controls apply, why, and where the evidence lives. The document auditors read first.
Internal audit
A dry run against the standard before you engage a certification body, with findings closed or scheduled.
What goes wrong
Common failure modes
Treating 42001 as a documentation exercise: auditors check whether controls operate, and so do customers.
Scoping too wide at first. Start with the AI systems that matter and extend scope later.
A model inventory that is correct on audit day and stale a month later.
Impact assessments written by one person with no input from the teams who use the system.
No link between the management system and engineering: evals, logs and reviews that exist only on paper.
Our approach
We start from the systems and work up to the documents. The security audit, data privacy and supply chain work produce most of the technical evidence the standard wants; the management system wraps around it.
An international standard, published in 2023, that specifies requirements for an AI management system: the policies, roles, risk and impact assessments, lifecycle controls and reviews an organisation uses to develop or use AI responsibly. See the glossary entry.
Do we need ISO 27001 first?
No, but it helps. ISO 42001 uses the same management-system structure, so an existing 27001 programme gives you leadership, risk, documentation and audit processes to extend. Without it you build those foundations as part of the 42001 work.
Can Teksmobile certify us?
No. Certification is issued by accredited certification bodies after their own audit. We prepare you: gap assessment, implementation of controls, documentation and an internal audit so the external audit holds no surprises.
How long does it take to become certifiable?
With an existing ISO 27001 programme and a modest AI estate, three to six months. Without one, or with high-risk AI systems, plan for six to twelve months. The gap assessment itself takes two to three weeks.
Does ISO 42001 make us EU AI Act compliant?
Not automatically, but it covers much of the same ground: risk management, documentation, oversight, monitoring and improvement. We map the two so that evidence produced for one serves the other. See EU AI Act readiness.
Talk to us about your AI project
Tell us what you are trying to do, which systems are involved and what is in the way. We reply within one business day with an opinion and a suggested next step.