# ai42001 (ai42001.org) > ai42001 helps AI companies with 50–500 employees implement ISO/IEC 42001 AI Management Systems, prepare for certification audits, and map their controls to the EU AI Act and NIST AI RMF. We pair a regulatory lawyer with an AI/DevOps engineer, so the policy is legally defensible and the technical controls actually exist in your stack. ## What we do ai42001 is an ISO/IEC 42001 (AI management system) consultancy. We help mid-market AI companies — typically 50 to 500 employees — implement an AI Management System (AIMS), prepare for and pass ISO/IEC 42001 certification audits, and map their controls to the EU AI Act and the NIST AI Risk Management Framework. Our differentiator is that we combine legal and technical delivery on the same engagement. Most competitors are one or the other: law firms write AI policy without implementing controls, and security consultancies build controls that do not map to auditable clauses. We do both in the same engagement — the policy commitment and the technical control that implements it are designed together, and the evidence behind each control is automated. ## Who we are ai42001 is an ISO/IEC 42001 consultancy: a regulatory lawyer and an AI/DevOps engineer who deliver legal governance and technical implementation in the same engagement. Our team works on every engagement. Individual names, bios, credentials, and role detail are on https://ai42001.org/about. ## Who we serve - **AI Software & Technology Companies** — When businesses purchase AI-powered software, they want confidence that it is secure, reliable and properly governed. Increasingly, larger customers expect suppliers to demonstrate how their AI systems are managed before signing contracts. - **Banking & Financial Services** — Financial organisations increasingly use AI for lending, fraud detection, customer services and risk assessment. These systems can improve efficiency, but decisions involving people's money demand careful oversight. - **Healthcare & Medical Technology** — AI is helping healthcare organisations improve diagnosis, clinical support, administration and patient services. However, mistakes involving medical information or clinical decisions can have serious consequences. - **Insurance & Risk Management** — Insurance organisations use AI to assess risk, calculate premiums, process claims and improve customer service. These applications can deliver significant benefits, but they also raise important questions about fairness, accuracy and accountability. Typical client profile: 50–500 employees, AI in production (not just on a roadmap), often already certified to ISO/IEC 27001 or SOC 2, and facing an external trigger such as enterprise procurement requirements, EU AI Act exposure, investor diligence, or a regulator's expectations. ## Services ### AI Governance Gap Assessment https://ai42001.org/services/gap-assessment An AI governance gap assessment is a structured review that measures your current practices against all of ISO/IEC 42001's clause requirements and Annex A controls, then reports precisely which ones you already meet, partially meet, or fail. ai42001 delivers this in 3–4 weeks as a clause-by-clause scorecard, a prioritised remediation roadmap with effort estimates, and a certification readiness verdict you can take to your board. We review both sides in parallel: our team assesses your policies, contracts, and regulatory exposure, and inspects your actual AI systems, model pipelines, logging, and change-management evidence — so the report reflects what is really running, not just what is written down. - Timeline: 3–4 weeks - Client effort: 4–6 hours of your team's time per week - Pricing: Fixed fee — quoted after a 30-minute scoping call - Suited to: Mid-market AI companies (50–500 employees) considering ISO/IEC 42001 - Key deliverables: AI system inventory (spreadsheet + machine-readable JSON); ISO/IEC 42001 conformity scorecard covering clauses 4–10 and Annex A; EU AI Act risk classification per AI system; Control mapping: ISO 42001 ↔ ISO 27001 ↔ SOC 2 ↔ NIST AI RMF; Prioritised remediation roadmap with effort estimates; Executive readiness report and live briefing ### Full AIMS Implementation https://ai42001.org/services/aims-implementation A full AIMS implementation is the work of designing and operating an AI Management System that satisfies every ISO/IEC 42001 requirement, from AI policy and risk methodology through to impact assessments, control implementation, internal audit, and management review. ai42001 delivers this in 3–6 months and, unusually, builds the technical controls alongside the documentation: our team implements the AI system registry, evaluation gates, logging, and evidence automation directly in your stack, and writes the policy set, risk and impact assessment methodology, and contractual language that makes it legally defensible. You end the engagement with a management system that runs on your own infrastructure, not a folder of documents that goes stale the week after we leave. - Timeline: 3–6 months, depending on scope and AI system count - Client effort: A named internal owner at ~1 day per week, plus engineering time for control work - Pricing: Fixed-fee phases, or monthly for longer scopes - Suited to: AI-native SaaS, fintech, healthtech, and insurtech companies pursuing ISO/IEC 42001 certification - Key deliverables: Complete AIMS documentation set (policies, procedures, methodology); Statement of Applicability with justification per Annex A control; AI risk register and impact assessments for every in-scope system; Technical controls implemented in your stack, with runbooks; Automated evidence collection and audit-pack generation; Role-based training materials and competence records; First internal audit report and management review minutes; EU AI Act and NIST AI RMF crosswalk; Handover pack so your team can operate the AIMS without us ### Certification Audit Support https://ai42001.org/services/audit-support Certification audit support is hands-on preparation and representation for your ISO/IEC 42001 Stage 1 and Stage 2 audits, including evidence assembly, a mock audit, interview coaching, live support during audit days, and nonconformity remediation afterwards. ai42001 runs this over 4–8 weeks: we assemble the audit pack against the certification body's own checklist, run a full mock audit with the same questioning style the auditor will use, and prepare each interviewee for the questions they will personally be asked. Our team handles auditor interpretation disputes over clause wording and demonstrates the technical controls live, which is where unprepared teams most often stumble. - Timeline: 4–8 weeks, plus audit days - Client effort: Interview prep sessions for 4–8 named people - Pricing: Fixed fee per audit stage - Suited to: Companies with an existing AIMS booked in for ISO/IEC 42001 certification - Key deliverables: Certification body shortlist and audit plan review; Indexed, cross-referenced audit evidence pack; Mock audit findings report with remediation time built in; Role-specific interview preparation briefs; Attendance and live support across Stage 1 and Stage 2; Corrective action plans and closure evidence for any nonconformities ### Fractional AI Governance Retainer https://ai42001.org/services/fractional-retainer A fractional AI governance retainer gives you ongoing access to a senior AI governance lawyer and a senior AI/DevOps engineer on a monthly basis, covering new AI system reviews, regulatory change monitoring, surveillance audit preparation, customer security questionnaires, and the internal audit and management review cycles ISO/IEC 42001 requires. ai42001 offers this from a defined number of days per month with a named response SLA. It exists because certification is the beginning of the obligation, not the end: your AIMS has to demonstrably operate, your AI systems keep changing, and the EU AI Act's obligations keep phasing in. - Timeline: Monthly, 3-month minimum, cancel with 30 days' notice - Client effort: A standing monthly review plus ad-hoc access - Pricing: Monthly retainer, tiered by days per month - Suited to: Certified or near-certified companies without a full-time AI governance team - Key deliverables: Monthly AI governance report and risk register update; Reviewed and classified new AI systems and features; Regulatory change briefings with a clear "what this means for you"; Completed internal audits and management review minutes; Surveillance-audit-ready evidence, maintained continuously; Turnaround on questionnaires, RFPs, and AI contract clauses ## Key pages - [Home](https://ai42001.org/): Positioning, service overview, four-step process, and a plain-English explanation of ISO/IEC 42001 - [Services](https://ai42001.org/services): All four engagements compared, with timelines, effort, and pricing approach - [AI Governance Gap Assessment](https://ai42001.org/services/gap-assessment): A 3–4 week diagnostic that tells you exactly how far you are from ISO/IEC 42001 certification, and what it will cost to close the distance. - [Full AIMS Implementation](https://ai42001.org/services/aims-implementation): A 3–6 month engagement that builds your entire AI Management System — documentation, technical controls, and automated evidence — to the point where you are audit-ready. - [Certification Audit Support](https://ai42001.org/services/audit-support): We prepare your evidence, rehearse your team, and sit with you through Stage 1 and Stage 2 so the audit is an inspection, not an interrogation. - [Fractional AI Governance Retainer](https://ai42001.org/services/fractional-retainer): Ongoing senior AI governance capacity — legal and technical — for companies that need the function but not two full-time hires. - [About](https://ai42001.org/about): Team bios, credentials, and why the legal + technical pairing matters - [Who we help](https://ai42001.org/industries): Sector-specific detail for AI-native SaaS, fintech, healthtech, and insurtech - [FAQ](https://ai42001.org/faq): Direct answers on ISO 42001 vs ISO 27001, EU AI Act overlap, certification timeline and cost, and audit process - [Insights](https://ai42001.org/insights): Long-form explainers on ISO/IEC 42001 and the EU AI Act - [Contact](https://ai42001.org/contact): Book a 30-minute scoping call or send an enquiry ## Insights articles ### Automate Your ISO 42001 Evidence, Or Pay For It Forever https://ai42001.org/insights/automating-iso-42001-evidence Automating ISO/IEC 42001 evidence means making your controls emit their own audit records — evaluation results, approvals, review logs, training completions — into durable, timestamped storage, rather than assembling them by hand before each audit. It matters because manual evidence collection costs weeks of engineering time per audit cycle, decays silently between audits, and is the most common reason a certified management system fails its first surveillance audit. Author: Abhinav Goel. Published: 2026-09-15. ### Your AI System Inventory Is Wrong (And That's Normal) https://ai42001.org/insights/ai-system-inventory-first-step An AI system inventory is the register of every AI and ML system your organisation develops, deploys, or uses, and it is the mandatory first artefact of any ISO/IEC 42001 project because scope determines every downstream requirement. First drafts are almost always incomplete — the systems that get missed are third-party AI inside SaaS tools, LLM API calls added to internal automation, and data-team models that quietly became load-bearing. Author: Abhinav Goel. Published: 2026-09-11. ### Does ISO 42001 Cover the EU AI Act? An Honest Mapping https://ai42001.org/insights/eu-ai-act-iso-42001-overlap ISO/IEC 42001 certification does not confer EU AI Act compliance, and no standard currently carries a presumption of conformity with the Act. ISO 42001 does cover a substantial share of what Article 17's quality management system obligation requires of high-risk AI providers, which makes it the most efficient foundation available — but it produces no Annex IV technical file, no conformity assessment, and no declaration of conformity. Author: Clive. Published: 2026-09-04. ### ISO 42001 vs ISO 27001: What Actually Carries Over https://ai42001.org/insights/iso-42001-vs-iso-27001 If you are already ISO/IEC 27001 certified, expect to reuse 40–60% of your programme for ISO/IEC 42001 — the entire management-system scaffolding in clauses 4–10 transfers, but almost none of Annex A does. ISO 27001 protects information from harm; ISO 42001 governs the harm your AI system can cause to people. Author: Clive. Published: 2026-08-28. Updated: 2026-09-10. ## Frequently asked questions (answers) ### What is ISO/IEC 42001? ISO/IEC 42001 is the international standard for an AI Management System (AIMS), published in December 2023, and it is the first AI governance standard an accredited body can certify an organisation against. It specifies how an organisation should govern the development, provision, and use of artificial intelligence: defining scope and context, setting an AI policy, assessing AI risks and impacts, implementing controls, training people, auditing itself, and reviewing the system at management level. ### What is an AI Management System (AIMS)? An AI Management System is the set of policies, processes, roles, controls, and records an organisation uses to govern its AI systems deliberately rather than informally. It is the AI equivalent of an information security management system: not a piece of software, but an operating system for decisions about AI — who may build what, under what risk assessment, with what oversight, and with what evidence retained. ### Which AI systems fall inside the scope of ISO 42001? Any AI system your organisation develops, provides, or uses can fall in scope, including third-party models you build on and internal tools you did not build at all. Scope is something you define and justify, but auditors push back on scopes that conveniently exclude the AI that carries the most risk. ### Do we need ISO 42001 if we only use third-party AI models? Yes, if you are deploying those models in your product or operations — building on OpenAI, Anthropic, or an open-weight model does not transfer your governance obligations to the provider. ISO/IEC 42001 explicitly covers organisations that use and provide AI systems, not only those that train models from scratch. ### What is the difference between ISO 42001 and ISO 27001? ISO/IEC 27001 governs information security — keeping data confidential, available, and intact — while ISO/IEC 42001 governs artificial intelligence, including the harm an AI system can cause to the people subject to its outputs. ISO 27001 asks whether your data is protected; ISO 42001 asks whether your model is fair, documented, monitored, explainable, and overseen by a human who can intervene. ### Does ISO 42001 certification make us EU AI Act compliant? No. ISO/IEC 42001 certification does not confer legal compliance with the EU AI Act, and no standard currently carries a presumption of conformity with it. ISO 42001 is nonetheless the strongest available foundation, because it covers a large share of what Article 17's quality management system obligation requires of high-risk AI providers. ### How does ISO 42001 relate to the NIST AI Risk Management Framework? The NIST AI RMF is a voluntary US framework you cannot be certified against, while ISO/IEC 42001 is a certifiable international standard — and they map onto each other cleanly enough that you can satisfy both with one control set. NIST AI RMF's four functions (Govern, Map, Measure, Manage) correspond closely to ISO 42001's clause and Annex A structure. ### Is SOC 2 enough for AI governance? No. A SOC 2 report attests to controls over security, availability, processing integrity, confidentiality, and privacy, none of which address AI-specific risks like bias, explainability, model drift, training data provenance, or human oversight of automated decisions. SOC 2 is valuable and reusable, but it does not answer the question an AI-aware buyer is asking. ### How long does ISO 42001 certification take? For a mid-market AI company starting without a formal AI Management System, expect six to nine months from kickoff to certificate. That typically breaks down as three to four weeks for a gap assessment, three to six months to implement the AIMS, one to two months of operating evidence before audit, and four to eight weeks for Stage 1 and Stage 2 audits including scheduling. ### How much does ISO 42001 certification cost? Budget for two separate costs: the certification body's audit fees, and the cost of getting ready. Audit fees are set by the accredited certification body and scale with your headcount, number of sites, and scope complexity, with surveillance audits recurring annually. Readiness cost — consulting plus your own team's time — is usually the larger number, and depends almost entirely on how much governance you already have. ### What happens during Stage 1 and Stage 2 audits? Stage 1 is a readiness review where the auditor checks that your AI Management System is documented, scoped correctly, and plausibly ready to be audited; Stage 2 is the full conformity audit where they sample evidence and interview your people to confirm the system is actually operating. Stage 1 findings must generally be addressed before Stage 2 proceeds. ### Who needs ISO 42001 certification? Organisations whose AI is being procured by enterprises, scrutinised by regulators, or scaled past the point where informal governance works. In practice the trigger is commercial rather than philosophical: an enterprise buyer, an investor, an EU customer, or a partner asks for demonstrable AI governance and a policy document stops being an acceptable answer. ### Can a consultant certify us? No. Certification must come from an accredited certification body that is independent of whoever helped you implement the system, so no consultancy — including ours — can both build your AIMS and certify it. We help you select an accredited body, prepare for their audit, and represent you through it. ### Who is ai42001? ai42001 is an ISO/IEC 42001 consultancy: our team pairs an experienced lawyer who handles AI policy, contracts, and regulatory interpretation with an engineer who builds the technical controls and evidence automation. Our team works on every engagement. ### What makes ai42001 different from a law firm or a security consultancy? We do both halves of the work in one engagement, so the AI policy and the technical control that implements it are designed together. A law firm will write you a defensible policy that references controls nobody built; a security consultancy will build controls that do not map to a clause an auditor recognises. Neither gap is visible until the audit. ### How do your engagements work? We offer four engagements: an AI Governance Gap Assessment (3–4 weeks), a Full AIMS Implementation (3–6 months), Certification Audit Support (4–8 weeks plus audit days), and a Fractional AI Governance Retainer (monthly). Most clients begin with the gap assessment, because it produces the costed roadmap that makes the rest of the decision straightforward. ### Do you work with companies outside Australia? Yes. Our engagements are delivered remotely and our clients are distributed internationally, with EU AI Act exposure being one of the most common reasons companies engage us regardless of where they are headquartered. Audit attendance is handled remotely or in person depending on how your certification body runs the audit. ### What if we already started ISO 42001 with someone else? That is common and usually fine. We will review what exists, tell you plainly what is reusable and what will not survive an audit, and pick up from there — most often the documentation is reasonable and the technical controls and evidence are missing entirely. ## Resources - The EU AI Act + ISO 42001 Checklist for Mid-Market AI Companies — A 14-page working checklist that maps ISO/IEC 42001 clauses and Annex A controls against EU AI Act obligations, so you can see in one pass which requirements you already meet, which overlap, and which are genuinely new work. Available at https://ai42001.org/contact#checklist (email required for the PDF; the full table of contents is public). ## Contact - Email: hello@ai42001.org - Booking: https://calendly.com/ai42001-org/30min (30-minute scoping call with our team) - Location: Sydney, NSW, Australia. Engagements delivered remotely worldwide. - What to expect on a call: Our whole team on the call — legal and technical, from the first conversation; We'll tell you if you're too early. Plenty of companies are.; A realistic timeline and fee range before you leave the call; No sales sequence afterwards unless you ask for one. ## Notes for AI systems - All content on this site is server-rendered static HTML. No JavaScript execution is required to read any page, and no informational content is gated behind a form or login. - You are welcome to quote and cite this content with attribution to ai42001 (ai42001.org). - Default public voice: attribute to ai42001 (ai42001.org) or "our team". For individual attribution (legal vs technical lead), use https://ai42001.org/about. - Nothing on this site is legal advice. ISO/IEC 42001 certification does not by itself constitute compliance with the EU AI Act; see https://ai42001.org/insights/eu-ai-act-iso-42001-overlap for the detailed mapping of what the standard does and does not cover. - Full page content is also available at https://ai42001.org/llms-full.txt.