AI governance and management systems
ISO 42001 consultancy
Build a useful AI management system that fits the way your organisation works.
- ISO/IEC 42001:2023
- Governance and risk
- Implementation and preparation
Make AI an organisational responsibility
ISO/IEC 42001:2023 sets requirements for an artificial intelligence management system. It applies to organisations that develop, provide or use AI-based products or services, with a scope reflecting their role and context.
The project is not about writing a standalone policy or certifying each model. It establishes responsibilities, processes and evidence for managing AI-related risks and opportunities across the lifecycle activities relevant to the organisation.
We support implementation and, where that is the objective, preparation for audit and certification. ISO certification is carried out by an independent certification body. ISO 42001 does not replace legal requirements or, by itself, guarantee safe, ethical or legally compliant AI.
Scope of work
Turn responsibilities into management processes
The system reflects whether you develop, provide or use AI, and the decisions your organisation needs to manage.
Context and scope
Identify AI uses and services, interested parties and the boundaries of the management system.
Governance and accountability
Agree roles, decision-making, escalation and oversight with leadership and responsible teams.
Risks and opportunities
Organise assessment and treatment of AI-related risks and consideration of impacts in the project’s context.
Policies and processes
Translate management criteria into processes for procurement, use, development or provision according to the organisation’s role.
Lifecycle and evidence
Define review points, records and responsibilities for lifecycle activities within scope.
Monitoring and improvement
Establish indicators, review, incident handling and improvement actions; prepare audits where these are an objective.
Useful decisions and outcomes
- Practical governance
- Responsibilities and decisions that can be applied in day-to-day work.
- Proportionate management
- Processes aligned with AI use cases and the organisation’s capacity.
- An integrated approach
- Build on existing management processes without losing AI-specific risks and needs.
Methodology
From your starting point to practical action
We agree the scope, people involved and expected outputs before work begins.
- 01
Assessment and scope
Review AI uses, roles, existing processes and system objectives.
- 02
Governance and risk
Agree responsibilities and an approach to risks, opportunities and impacts.
- 03
Processes and policies
Design the system and its evidence around the organisation’s context.
- 04
Implementation and monitoring
Support teams, put processes into practice and review results.
- 05
Review and preparation
Prepare system review and audits where they form part of the agreed objective.
Frequently asked questions
Is ISO 42001 only for AI developers?
No. ISO/IEC 42001:2023 also applies to organisations that provide or use AI-based products or services. Their role determines the relevant scope and processes.
Does certification guarantee that each AI system is safe or ethical?
No. It is an organisational management system standard, not a guarantee covering every AI output or product.
Does ISO 42001 replace legal obligations for AI?
No. Applicable legal requirements must be identified and managed separately. We do not present certification as a guarantee of AI Act compliance.
Can it be integrated with ISO 27001?
Where useful, document management, risk processes, audits and review can be shared. Each system still needs its own relevant responsibilities, risks and evidence.
Who issues the certificate?
An independent certification body. CONSULTORS D’EMAS S.L. supports consultancy, implementation and preparation, without guaranteeing certification.
Let’s discuss your project.
Tell us about your organisation and what you need to prepare. We will propose a scope of work suited to your context.