ISO/IEC 42001 Artificial Intelligence Consulting

ISO/IEC 42001 specifies requirements for an Artificial Intelligence Management System, or AIMS. It helps organisations govern the responsible development, provision or use of AI through defined accountability, risk and impact assessment, operational controls and continual improvement.

Certivanta helps organisations establish the management system and prepare for an independent certification audit. Certification decisions remain solely with the certification body.

The standard can support organisations that develop AI systems, embed third-party models into products, use AI in business processes or procure AI-enabled services. It is relevant to technology, finance, professional services, healthcare, customer operations and public-sector environments where AI decisions may affect people or important outcomes.

• AI management-system scope, policy, roles and accountability
• AI risk and impact-assessment processes
• Data, model, development, deployment and operational controls
• Transparency, incident, supplier and change-management processes
• Performance evaluation, internal audit, management review and improvement

AI governance needs to follow systems from initial purpose and data choices through development, procurement, testing, release, monitoring and retirement. We help teams define decision points, responsibilities, evidence and escalation paths that reflect how AI is actually used.

ISO 42001 can be coordinated with ISO 27001 information security and ISO 9001 quality management. These standards address different objectives, but aligned risk, supplier, change, competence and assurance processes can reduce duplication.

No. The standard can apply to organisations that provide or use AI systems as well as those that develop them. The scope, roles and controls should reflect the organisation’s position in the AI value chain.

No. A management-system certificate does not guarantee the outcome of every AI system. ISO 42001 provides a structured way to assign accountability, assess impacts and risks, apply controls, monitor performance and improve governance.

No. Certivanta provides implementation and certification-readiness support. An independent certification body conducts the audit and makes the certification decision.

A bank, insurer, software company or service provider may use third-party AI for customer support, decision assistance, analytics or content generation. An AI management system can record intended use, accountable owners, affected parties, impact and risk assessments, data considerations, supplier controls, human oversight and monitoring. ISO 42001 creates governance around these decisions, but it does not automatically establish compliance with POPIA, sector rules or every legal obligation connected to a specific AI use case.

Cost depends on the number and significance of AI systems, whether the organisation develops or procures them, lifecycle complexity, supplier reliance, existing model documentation and the maturity of data, security and risk governance. Technical model testing, legal opinions, privacy assessments, specialist assurance, software, the ISO standard and certification-body fees are separate unless agreed. Use the consultation package to frame an initial scope.

• Which AI systems and lifecycle roles are within scope?
• Who approves intended use, residual risk and material changes?
• Which people or groups may be affected by AI outcomes?
• What evidence is available from third-party AI suppliers?
• How will security, privacy, quality and human oversight connect?

Compare ISO 27001 and ISO 42001, review information-security governance, or discuss your AI scope.