Service
Full AIMS Implementation
A full AIMS implementation is the work of designing and operating an AI Management System that satisfies every ISO/IEC 42001 requirement, from AI policy and risk methodology through to impact assessments, control implementation, internal audit, and management review. ai42001 delivers this in 3–6 months and, unusually, builds the technical controls alongside the documentation: our team implements the AI system registry, evaluation gates, logging, and evidence automation directly in your stack, and writes the policy set, risk and impact assessment methodology, and contractual language that makes it legally defensible. You end the engagement with a management system that runs on your own infrastructure, not a folder of documents that goes stale the week after we leave.
- Timeline
- 3–6 months, depending on scope and AI system count
- Your effort
- A named internal owner at ~1 day per week, plus engineering time for control work
- Pricing
- Fixed-fee phases, or monthly for longer scopes
Fit
Who this is for
This is for you if
- You have decided to certify and want it done once, properly, rather than patched together before an audit.
- Enterprise deals or an EU AI Act obligation are gating on demonstrable AI governance.
- You want the controls built into your engineering workflow, not bolted on as manual checklists.
- You have a compliance or security lead who can own the system, but not the expertise to design it.
This isn't for you if
- You want documentation only, with no technical implementation — we are not the cheapest option for that, and it is not how we work.
- Nobody internally can own the management system after handover; the standard requires a real owner.
Scope
What's included
Every item below is delivered by our team working in parallel — the legal analysis and the technical work happen together, not in sequence.
- Scope, context, and AI policy
- We define the AIMS boundary, document organisational context and interested parties, and write the AI policy and supporting policy set so they align with your actual product strategy rather than a template.
- AI risk management methodology
- A documented, repeatable process for identifying, analysing, evaluating, and treating AI risks — with a risk register that your team can actually run each quarter.
- AI system impact assessments
- Clause 6.1.4 impact assessments completed for each in-scope AI system, covering effects on individuals and society, and structured so they double as EU AI Act fundamental-rights impact assessment inputs.
- Annex A control implementation
- We implement the applicable Annex A controls and write the Statement of Applicability with a real justification for every inclusion and exclusion.
- Technical controls in your stack
- AI system registry, model and dataset documentation, evaluation and bias-testing gates in CI, inference and decision logging, human-oversight checkpoints, and access controls — implemented in your repositories, pipelines, and cloud accounts.
- Evidence automation
- Recurring evidence — approval records, evaluation results, training completion, review logs — is generated and collected automatically wherever possible, so your audit pack assembles itself instead of costing three weeks of someone's life.
- Competence, training, and awareness
- Role-based AI governance training for engineering, product, sales, and leadership, plus the competence records clause 7.2 requires.
- Internal audit and management review
- We run your first internal audit, document the findings and corrective actions, and facilitate the first management review — the two records auditors ask for first and clients most often lack.
- Multi-framework alignment
- The same control set is mapped to the EU AI Act, NIST AI RMF, and your existing ISO 27001 or SOC 2 programme, so you answer one question once and reuse the evidence everywhere.
Deliverables
What you actually receive
- Complete AIMS documentation set (policies, procedures, methodology)
- Statement of Applicability with justification per Annex A control
- AI risk register and impact assessments for every in-scope system
- Technical controls implemented in your stack, with runbooks
- Automated evidence collection and audit-pack generation
- Role-based training materials and competence records
- First internal audit report and management review minutes
- EU AI Act and NIST AI RMF crosswalk
- Handover pack so your team can operate the AIMS without us
The outcome
A working AI Management System your team owns and operates, an audit pack that regenerates itself, and a certification body engagement you are genuinely ready for.
Usually followed by
Certification Audit Support
We prepare your evidence, rehearse your team, and sit with you through Stage 1 and Stage 2 so the audit is an inspection, not an interrogation.
Audit Support detailOther engagements
- 3–4 weeksGap AssessmentA 3–4 week diagnostic that tells you exactly how far you are from ISO/IEC 42001 certification, and what it will cost to close the distance.
- 4–8 weeks, plus audit daysAudit SupportWe prepare your evidence, rehearse your team, and sit with you through Stage 1 and Stage 2 so the audit is an inspection, not an interrogation.
- Monthly, 3-month minimum, cancel with 30 days' noticeFractional RetainerOngoing senior AI governance capacity — legal and technical — for companies that need the function but not two full-time hires.
Next step
Talk to us about full implementation
A 30-minute call with our team. We will scope it properly, tell you what it costs, and tell you if a different engagement is a better fit for where you actually are.