ISO/IEC 42001, answered directly

Structurally it follows ISO's Harmonized Structure, the same clause 4–10 layout used by ISO/IEC 27001 and ISO 9001. That means leadership, planning, support, operation, performance evaluation, and improvement each get their own clause, with requirements written as things you must be able to demonstrate.

Annex A contains 38 AI-specific controls across nine themes, including AI policy, internal organisation, resources for AI systems, AI system impact assessment, AI system lifecycle, data for AI systems, information for interested parties, use of AI systems, and third-party relationships. Annex B gives implementation guidance for each.

The critical word is 'demonstrable'. An auditor does not assess whether your intentions are good; they sample records. Every requirement ultimately resolves to evidence that something happened, on a date, approved by someone identifiable.

In practice an AIMS includes an AI policy, an inventory of your AI systems, a risk assessment and treatment process, impact assessments for systems that affect people, defined roles and accountabilities, operational controls across the model lifecycle, training records, an internal audit programme, and management review minutes.

The most common failure mode is building the documentation without the operating reality. An AIMS that exists only as documents will pass no serious audit, because the auditor will ask for the records the documents promise and find none.

In our gap assessments, the systems companies forget are consistently the same: AI features inside SaaS tools other teams adopted, LLM API calls added to internal automation, copilots and browser extensions used on customer data, and models built by a data team for internal decisioning that quietly became load-bearing.

A defensible scope is drawn around a business boundary — a product, a legal entity, a set of processes — and not around whichever systems were easiest to document.

Your obligations shift rather than disappear. You still own how the system is used, what it is evaluated against in your context, what human oversight exists, what you tell your customers, and how you respond when it fails. Annex A includes specific controls for third-party and supplier relationships for exactly this reason.

Under the EU AI Act the distinction between provider and deployer matters a great deal, and it is easier to become a provider than most teams assume — substantially modifying a system or putting your own name on it can be enough.

Companies already certified to ISO/IEC 27001 with mature engineering practices can compress this to four to six months, because the management-system scaffolding already exists and much of the evidence discipline is habitual.

The hard floor is the operating evidence requirement. An auditor needs to see that the system has actually run — a completed internal audit, a management review, risk assessments with dates, records of decisions. You cannot create three months of operating history in a week, which is the constraint that defeats compressed timelines.

The most common cause of slippage is not the consultant or the auditor. It is internal capacity: whoever owns the AIMS internally has a day job, and the work stalls in the gaps.

We quote fixed fees per engagement after a 30-minute scoping call, so you are not exposed to open-ended hourly billing. We will also tell you on that call if we think the whole project is premature.

The cost nobody budgets for is internal engineering time. Implementing Annex A controls properly requires real changes to pipelines and workflows. Part of why we automate evidence is that the alternative — manual collection forever — is a permanent tax on your engineering team.

Certification body fees are paid directly to the certification body, never through us. Consultants cannot audit their own clients, and any firm offering you both should be treated with suspicion.

In Stage 1 the auditor reviews your scope statement, AI policy, risk methodology, Statement of Applicability, internal audit results, and management review records. The most common Stage 1 finding is an internal audit or management review that was never performed.

In Stage 2 they test operation. They will pick specific AI systems and ask to see the impact assessment, the approval record, the evaluation results, the change history, and the monitoring evidence. They will interview engineers and product managers directly, and compare what those people say to what your documentation claims.

Findings are graded. Minor nonconformities require a corrective action plan; major nonconformities must be cleared before certification is recommended. Certificates run three years with annual surveillance audits in between.

Certification is not legally mandatory anywhere today. It is a market signal and a governance discipline, and increasingly a procurement prerequisite in regulated sectors.

The clearest signals you are ready: AI governance questions are slowing your sales cycle; you have EU customers or EU market exposure; you are in a regulated sector deploying AI in consequential decisions; you already hold ISO 27001 and want the adjacent certification; or your board has asked who is accountable for AI risk and the answer was unclear.

Check that the certification body's accreditation actually covers ISO/IEC 42001, not just ISO 27001. Accreditation scopes for 42001 were still expanding through 2024 and 2025, and an unaccredited certificate is worth considerably less to a sophisticated buyer.

We review audit plans and quotes before you sign, because scope definitions in those documents have long-term cost consequences.