ISO/IEC 42001 AI management system consulting

For Your Business

Who this service is for and when to start

Organizations providing or using AI products and services can evaluate adoption when AI usage increases, responsibilities are unclear, or customers require governance evidence. Companies using third-party models also need to confirm their own roles; it is not only applicable to those developing models.

Start by reviewing AI uses, affected parties and significant decisions, then define the management scope and priority controls.

The Challenge

Common challenges faced by businesses

A common gap is when departments use AI independently, but managers do not know where the data is sent or who checks the results. Another type of problem is when testing was done at launch, but after the model or data changes, it is not reconfirmed.

When AI outputs affect people or service decisions, accuracy alone is not enough. Define the intended use, potential impacts, human intervention and procedures for stopping use when problems arise.

Our Approach

Methods and applicable requirements

ISO/IEC 42001:2023 is the first version of the AI management system requirements, applicable to organizations providing or using AI product services. It manages AI-related risks and opportunities and continuous improvement, and does not guarantee the accuracy of each model's output.

AI scope, policies, and roles

Consulting organises the AI inventory, uses, suppliers and organisational roles, and confirms management objectives and permissions. Policies need to apply to real use cases, beyond a general statement prohibiting or encouraging AI.

Risk and impact assessment

Identify AI risks, affected parties and conditions of use, and clarify responsibilities for data, technology and people. Adapt the assessment method to the application; a single score cannot replace understanding the impacts.

Life cycle and control

Review data, testing, deployment, human oversight, monitoring and retirement arrangements. Record which controls apply and evidence of their use. When a model or its purpose changes, assess what needs to be checked again.

Preparation

What documents do companies need to prepare?

• AI and its applications: Application list, intended use, role, and supplier.
• Data and processes: Data sources, usage permissions, and lifecycle processes.
• Assessment and control: Risk and impact assessments, controls and human oversight methods.
• Testing and Changes: Testing, monitoring, events, versions, and improvement records.

For an initial discussion, provide a summary or de-identified sample. Share full records under the agreed scope, access permissions and confidentiality arrangements. Check whether existing records are still valid before filling gaps; there is no assumption that every document must be rewritten.

Project Planning

Estimating time and cost

Evaluate based on the number of AI applications, organizational roles, impact level, and existing governance data. Model development, technical evaluation, system modifications, and legal opinions will be confirmed separately; system guidance does not assume product engineering.

Each project specifies the number of on-site interviews, document revisions, training sessions, internal-audit support activities and improvement reviews, together with responsibilities. Third-party certification, specialist testing, engineering and legal services are not included in consulting fees by default. Confirm transition schedules for existing certificates with the certification body.