Build an ISO/IEC 42001 AI management system around the services you develop, provide or use. Connect business purpose, risks and impacts to practical controls, operating evidence and preparation for independent certification.
ISO/IEC 42001:2023 specifies requirements for an AI management system. It applies to organisations involved in developing, providing or using AI-based products and services across sectors. Its focus is accountable management of AI, including context, leadership, risk, operation and improvement.
Start with the deployment: what it is intended to do, whose information it uses, who relies on its output and what action can follow. A purchased model, an embedded assistant and an AI-enabled product create different responsibilities. The programme should make those differences visible and assign the decisions to people with the right authority.
Certification concerns the defined management-system scope. Product accuracy, safety and legal conformity require their own evidence and analysis. An ISO 42001 certificate does not automatically establish EU AI Act compliance or approve every customer use.
Official references: ISO/IEC 42001 and independent certification.
Read the ISO 42001 AI management guide ↗
Explore scope, AI risks and impacts, lifecycle controls and the evidence needed for independent certification.
The proposal defines the deliverables, owners and acceptance criteria for your scope. A typical implementation plan can address the following connected areas.
Identify AI activities, deployments, interested parties and dependencies. Define the management-system boundary, leadership responsibilities, policy and objectives, including the interfaces with customers and suppliers.
Assess service-specific failure scenarios and consequences for people and society. Establish risk criteria, select treatments and maintain a reasoned Statement of Applicability with necessary controls, inclusion and exclusion justifications, and links to implementation evidence.
Connect intended use, data permissions and quality, evaluation, human oversight, deployment approval and monitoring. Define how prompts, models, retrieval sources and tool permissions change, how incidents are handled and how supplier responsibilities are managed.
Organise controlled records, role-specific competence and performance information. Plan internal audit and management review, address findings and verify corrective actions before assessing readiness for the independent certification process.
Agree scope, responsibilities and checkpoints around your AI services and business needs.
Discuss your AI scopeReview representative AI uses, confirm roles and boundaries, and identify the decisions or evidence gaps that need attention first. Agree responsibilities and the work included in the engagement.
Develop the management processes and selected controls with the people who operate the service. Test the assessment method, lifecycle decisions and evidence workflow against real deployment conditions.
Use internal audit, management review and corrective action to examine whether the system works. Coordinate readiness and scheduling with the independent certification body while maintaining ownership of unresolved work.
Reuse suitable information-security controls, document management, incident handling and review processes. Extend them for AI-specific intended use, impacts, evaluation and oversight. Keep the scopes and assurance conclusions of the two management systems clear.
Explore ISO 27001 support ↗Where the required capabilities are confirmed during scoping, Effivity can be considered for controlled records, ownership, actions and evidence workflows. The configuration must fit the agreed AI management process; software does not replace risk decisions or independent certification.
Where relevant course coverage and delivery availability are confirmed, Sterling Academy can support the learning plan. Match learning to the decisions people make, then evaluate competence through appropriate exercises or reviewed work. Course completion alone does not certify the organisation’s management system.
The following are hypothetical illustrations, not client case studies or claims of completed engagements.
An assistant that previously drafted advice can now propose changes to customer settings. The programme examines the new authority, access boundaries, validation and approval route. Earlier text-generation tests remain useful, but they do not establish that the new action path is ready.
The client controls the application while the provider supervises staff and quality. Governance clarifies local oversight, competence, error reporting and the response to platform changes. The scope reflects the provider’s actual responsibilities without implying control over the underlying model.
See how scope, responsibilities and implementation decisions apply in each market. Certification concerns the management system; local legal duties need a separate assessment.
Explore multilingual AI use, responsibilities shared with a group company, and a dated approach to privacy obligations.
Explore ISO 42001 in IndiaConsider client-owned AI, BPO supervision and privacy responsibilities across suppliers, clients and operations teams.
Explore ISO 42001 in the PhilippinesExamine regional oversight, permissions for AI agents and responsible use of customer data.
Explore ISO 42001 in SingaporeOur guarantee applies to the agreed ISO certification engagement. Confirm its scope and terms in your proposal. The independent certification body conducts the audit and makes the certification decision.
Discuss your AI scopeNo. It also addresses organisations providing or using AI-based products and services. Scope the activities you perform and the decisions you control, including purchased and embedded AI.
No automatic equivalence follows. Certification concerns the scoped management system. Legal obligations depend on the system, role and applicable provisions, and need a separate, current analysis.
Use the standard’s risk-treatment and selection process to determine necessary controls, compare them with Annex A and justify inclusion and exclusion. Additional controls may be needed. The Statement of Applicability records the reasoning; it is not a universal template.
Estimate the work after reviewing scope and maturity. Inventory gaps, evaluation needs, technical changes, supplier evidence and operational records can affect the schedule. Agree evidence milestones and dependencies before committing to assessment dates.
An external certification body assesses the management system and makes the certification decision. ISO develops the standard and does not issue the certificate. Check the body’s relevant competence, accreditation status and scope.
Share your main AI uses, organisational boundary, existing management systems and the business outcome you need. A high-level summary is sufficient for the initial discussion.
