ISO/IEC 42001 · EU AI Act · NIST AI RMF
We don't just write your AI policy. We build the controls, automate the evidence, and make it legally defensible.
We help AI companies with 50–500 employees build an AI Management System that survives an audit — because the controls actually exist in your stack, not just in your policy document.
- Certification-ready in 3–6 months
- Fixed-fee, scoped engagements
- Evidence automated, not hand-collected
Frameworks and standards we implement against
ISO/IEC 42001:2023
AI management systems
EU AI Act
Risk classification & Art. 17
NIST AI RMF 1.0
Govern · Map · Measure · Manage
ISO/IEC 27001:2022
Information security
ISO/IEC 23894
AI risk management
Why us
Most AI governance consultants are lawyers or engineers. You need both.
Effective AI governance connects legal obligations, organisational responsibilities and the way technology works in practice. Policies need controls that people can implement, and technical safeguards need clear ownership, oversight and evidence that they work. At ai42001, our team brings legal, risk and compliance together with technical implementation on every engagement — designing policies, processes and technical controls in parallel. From the initial review through to an ISO/IEC 42001 AI Management System, this combined approach helps your organisation pursue AI's opportunities, manage its risks and demonstrate accountable governance.
Lawyers only
Policy without proof
- A polished AI policy referencing controls that were never implemented
- EU AI Act memos with no mapping to your actual model pipeline
- Evidence requests that land on engineering with no plan for who does the work
Engineers only
Controls without defensibility
- Technical controls that don't map to a clause an auditor recognises
- Impact assessments that miss the legal tests regulators apply
- Contracts and customer commitments the AI system quietly contradicts
ai42001
Both, in the same engagement
- Every policy commitment has a named technical control behind it
- Every control emits evidence an auditor will accept, automatically
- One crosswalk covering ISO 42001, the EU AI Act, NIST AI RMF, and your ISO 27001 work
Services
Start where you are
Four engagements, designed to be taken in sequence or on their own.
- 013–4 weeks
AI Governance Gap Assessment
A 3–4 week diagnostic that tells you exactly how far you are from ISO/IEC 42001 certification, and what it will cost to close the distance.
What's included - 023–6 months, depending on scope and AI system count
Full AIMS Implementation
A 3–6 month engagement that builds your entire AI Management System — documentation, technical controls, and automated evidence — to the point where you are audit-ready.
What's included - 034–8 weeks, plus audit days
Certification Audit Support
We prepare your evidence, rehearse your team, and sit with you through Stage 1 and Stage 2 so the audit is an inspection, not an interrogation.
What's included - 04Monthly, 3-month minimum, cancel with 30 days' notice
Fractional AI Governance Retainer
Ongoing senior AI governance capacity — legal and technical — for companies that need the function but not two full-time hires.
What's included
How it works
From "are we exposed?" to certified
A standard path from first call to certification. Most clients enter at step one and reach step four in six to nine months.
- Weeks 1–4
Scope and diagnose
We inventory every AI system you run — including the ones nobody put on a slide — classify them against ISO/IEC 42001 and the EU AI Act, and score you clause by clause. You get a costed roadmap and an honest verdict on timeline.
You get
- AI system inventory
- Clause-by-clause scorecard
- Costed remediation roadmap
- Months 2–4
Build the management system
Our team writes the policy set, risk methodology, and impact assessments, and implements the technical controls in your repositories and pipelines. This happens in parallel, which is why it takes months rather than quarters.
You get
- AI policy and procedures
- Statement of Applicability
- Controls live in your stack
- Months 4–5
Automate the evidence
We wire your controls to produce their own audit trail — evaluation results, approvals, review logs, training records — so the audit pack regenerates on demand instead of costing three weeks of someone's time every year.
You get
- Automated evidence pipelines
- Self-assembling audit pack
- Internal audit completed
- Months 5–9
Certify and keep it alive
We prepare your team, rehearse the audit, and attend Stage 1 and Stage 2 with you. Afterwards, the retainer keeps the system operating through new AI features, regulatory change, and surveillance audits.
You get
- Mock audit and interview prep
- Stage 1 and Stage 2 attendance
- Surveillance-ready AIMS
Plain English
What is ISO/IEC 42001?
ISO/IEC 42001 is the international standard for an AI Management System (AIMS) — a governance framework for how an organisation develops, deploys, and oversees artificial intelligence. Published in December 2023, it is the first certifiable AI management standard, which means an accredited body can audit you against it and issue a certificate. It follows the same clause structure as ISO/IEC 27001, so if you are already certified there, the shape of the work will be familiar.
What does it actually require?
Clauses 4–10 require the usual management-system machinery: defined scope, leadership commitment, an AI policy, risk and impact assessment processes, competence and training, operational controls, internal audit, and management review. Annex A adds 38 AI-specific controls covering areas like AI system impact assessment, data governance, model lifecycle documentation, human oversight, and third-party AI use.
How is it different from ISO/IEC 27001?
ISO 27001 protects information from harm; ISO 42001 governs the harm an AI system can cause to people and society. Where ISO 27001 asks "is this data confidential, available, and intact?", ISO 42001 asks "is this model fair, explainable, monitored, and overseen by a human who can intervene?" The management-system scaffolding is nearly identical, which is why ISO 27001-certified companies typically reuse 40–60% of their existing programme.
Does certification satisfy the EU AI Act?
No — certification is not automatic legal compliance, and no standard currently confers a presumption of conformity with the EU AI Act. But ISO/IEC 42001 covers a substantial share of what Article 17's quality management system obligation requires of high-risk AI providers, so it is the most efficient foundation available today. We map your AIMS controls directly to EU AI Act articles so the overlap is documented and the remaining gaps are explicit.
Who actually needs it?
Companies whose AI is being procured by enterprises, scrutinised by regulators, or scaled fast enough that informal governance has stopped working. In practice, the trigger is usually commercial: an enterprise buyer, an investor, or an EU customer asks for demonstrable AI governance, and a policy document is no longer a sufficient answer.
Who we help
Built for regulated, AI-native companies
The pressure to certify arrives differently in each sector. Here is where we do most of our work.
AI Software & Technology Companies
Helping your AI products meet customer expectations
Customers requesting evidence of AI safety, security and responsible use
Sector detailBanking & Financial Services
Making AI decisions accountable and trustworthy
Ensuring AI-assisted financial decisions are accurate, fair and explainable
Sector detailHealthcare & Medical Technology
Protecting patients while advancing AI innovation
Protecting patient information and sensitive medical records
Sector detailInsurance & Risk Management
Making AI-driven decisions fair, transparent and defensible
Ensuring AI-assisted pricing and underwriting decisions are fair
Sector detail
- Annex A controls
- 38Annex A controlsWe assess and implement every applicable one
- Months to audit-ready
- 3–6Months to audit-readyFrom kickoff to certification-ready AIMS
- Disciplines, one team
- 2Disciplines, one teamRegulatory law and AI engineering
- Frameworks mapped
- 4Frameworks mappedISO 42001, EU AI Act, NIST AI RMF, ISO 27001
Free resource
The EU AI Act + ISO 42001 Checklist for Mid-Market AI Companies
A 14-page working checklist that maps ISO/IEC 42001 clauses and Annex A controls against EU AI Act obligations, so you can see in one pass which requirements you already meet, which overlap, and which are genuinely new work.
What's inside
- Clause-by-clause ISO/IEC 42001 self-assessment grid (clauses 4–10)
- All 38 Annex A controls with a plain-English 'what evidence proves this' note
- EU AI Act article mapping, including Article 17 quality management system overlap
- Risk classification decision tree for your AI systems
- ISO 27001 and SOC 2 reuse map — what you don't have to rebuild
- The nine evidence artefacts Stage 2 auditors ask for first
PDF · 14 pages · no registration wall on the content itself
Next step
Find out how far you are from certified
A 30-minute call, no pitch deck. Tell us what you're building and what's forcing the question — an enterprise deal, an EU customer, an investor, or a board paper. We'll tell you honestly whether you need ISO 42001 yet, and what it would take.