ISO/IEC 42001 Artificial Intelligence Management System Consultancy

The documents ISO/IEC 42001 asks you to have

A standard does not ask for a library. It asks for evidence that you decide things deliberately and can show how. This is what an auditor will look for on a ISO/IEC 42001 system — specific to the standard first, then the records every management system needs.

• AI policy and the scope of the AI management system
• Inventory of AI systems, with the purpose and the intended use of each
• AI risk assessment and impact assessment, covering people affected as well as the organisation
• Statement of Applicability for the Annex A controls
• Data governance records — provenance, quality and preparation of training data
• Records of human oversight, and the arrangements for explaining decisions
• Performance monitoring after deployment, and the criteria for withdrawing a system
• Roles, responsibilities and authorities, written down and known to the people holding them
• Competence and training records for anyone whose work affects the system
• Internal audit programme, audit reports and the findings raised
• Management review minutes, showing what was decided rather than that a meeting happened
• Nonconformity and corrective action records, with root cause and effectiveness checked
• Document and record control — what is current, who approved it, how long it is kept

Length is not compliance. A procedure nobody follows is worse than no procedure, because an auditor will find the gap between the two. Our test is whether the person who has to do the job recognises their own work in it.

How to start

The first instinct is usually to look for a template pack. It is the most expensive way to begin, because a system written before anybody looked at how the work is actually done has to be re-written once somebody does. Start here instead.

• Establish what is being asked, and by whom. A customer, a tender, a regulator and a parent company each want something slightly different, and the answer decides the scope.
• Fix the scope in writing — which sites, which activities, which products. Scope drives cost more than any other single decision, and a scope widened after the audit is booked is re-work.
• Have a gap assessment done against ISO/IEC 42001, on evidence rather than on a questionnaire. You can score yourself first with the free readiness checklist on this site; the expert assessment is what turns that score into a plan.
• Appoint somebody internally who owns it. Not necessarily full time, but named, and senior enough to get decisions made.
• Document only what the gap assessment showed is missing, in the words the people doing the work already use.
• Train, then run the system long enough to generate real records. Three months of genuine records cannot be produced in a fortnight, and this is the step organisations try hardest to skip.
• Audit yourself, hold a management review that actually decides something, then book the certification audit.

How to choose a certification body

The body you choose matters more than most people expect, and for a reason that has nothing to do with price: their accreditation is what makes your certificate mean something to the party that demanded it.

Four things decide it. Accreditation: the body should be accredited for your standard and your industry by a recognised accreditation body, and the certificate should carry that mark. Sector competence: an auditor who has audited your industry asks better questions and wastes less of your time. Recognition: ask the customer or tender that triggered this whether they name particular bodies. Cost and diary: audit days are set by your headcount and scope, so quotes should be comparable — and if one is far cheaper, look at the audit days before the price.

Among the bodies most widely recognised, in no particular order: BSI, TÜV, SGS, SIS Certifications, Intertek, DNV, BVQI.

MSCi works with a pool of accredited certification bodies rather than one. That is a commercial advantage to you, and worth being plain about why: bodies differ in audit-day rates, in travel cost to your location, in how quickly they can get an auditor to you, and in which sectors they are accredited for. Having several to approach means we can put your scope in front of the ones that fit it and bring you back comparable quotes, instead of you taking the first number offered.

What it does not change is the audit. We cannot influence a finding and would not try — the body's independence is the entire value of the certificate, and any consultancy offering otherwise is selling you something worthless. We prepare you so that the audit is uneventful, and the body decides.

Note also that whoever builds your management system must not be the body that certifies it. Accreditation rules prohibit it, which is why we prepare and never certify.

What ISO/IEC 42001 is usually taken with

Few organisations stop at one standard, and the second costs far less than the first — the clauses that take longest are the ones they share. Where ISO/IEC 42001 sits next to something else, this is what carries over.

• ISO/IEC 27001 consultancy — is the system this one sits on top of; the risk method and supplier controls are shared.
• ISO/IEC 27701 consultancy — handles the personal data most AI systems are trained on or make decisions about.

Certified to more than one, you hold a single management system with one set of objectives, one internal audit programme and one management review — audited in one visit. Run as separate systems they cost roughly twice as much to keep, which is the usual reason a second certificate feels harder than it was.

A management system for organisations building or using AI

ISO/IEC 42001 is the management system standard for artificial intelligence. It follows the familiar structure of context, leadership, planning, support, operation, evaluation and improvement, with a control annex specific to AI: acceptable use policy, roles and accountability, data governance across training and inference, documentation of system design, impact assessment for the people affected, and control over third party models and suppliers. It is certifiable, which sets it apart from most AI guidance published so far.

The organisations asking are those building AI products, those embedding a vendor's models into their own services, and those deploying AI internally in hiring, credit, claims or clinical support. Enterprise buyers have begun adding AI governance questions to procurement. The EU AI Act places duties on providers and deployers of higher risk systems, and a certified management system is a practical way to show those duties are being managed rather than improvised in each team.

Impact assessment, controls and the lifecycle of a model

We map every AI system you build, buy or use, which almost always uncovers more than the register held. Each is classified by purpose, degree of autonomy, data used and potential effect on individuals. Then comes an impact assessment covering fairness, safety, privacy, transparency, human oversight and the consequences of the model simply being wrong, written for the specific deployment rather than for the technology in the abstract. Vendor models are assessed on what the contract and documentation actually let you verify.

Around that we build the system: an AI policy people can apply, defined accountability including who may approve a deployment, data governance covering provenance, quality, labelling and retention, testing and validation before release, monitoring for drift and degradation in production, incident handling for when a model misbehaves, human oversight designed into the workflow rather than bolted on, and documentation kept current as models are retrained. Internal audit and management review close the loop.

Certification, and a defensible answer on how your AI is governed

You end up with an AI inventory, classification criteria, completed impact assessments, the policy and control set, model documentation templates, testing and monitoring records, supplier assessment files and audit evidence. An accredited certification body performs the assessment and issues the ISO 42001 certificate. Where a client is also preparing for the EU AI Act, we map the management system controls against the legal obligations so a single set of evidence serves both purposes.

The practical change is that AI stops being deployed on individual enthusiasm. Teams know what needs approval and what evidence to produce, which speeds up the safe cases and stops the reckless ones early. Customers and regulators receive a documented answer rather than reassurance. And when a model does behave unexpectedly, there is a record of what it was trained on, what was tested, who accepted the risk and how the problem was handled.