ISO/IEC 42001:2023
ISO/IEC 42001 AI management system implementation
Govern the AI you develop, provide or use with an ISO/IEC 42001 artificial intelligence management system (AIMS). Aegentra scopes the AIMS, inventories AI systems, runs risk and impact assessments, develops the Statement of Applicability, implements agreed controls and organises evidence for an independent certification body, with consultants based in Europe working remotely and on site in Germany.
What we deliver
What the implementation produces
Your written scope sets the deliverables and who owns each one. The programme is built around these outputs.
- AI system inventory
- A record of the AI systems in scope, including internally built models, third-party AI services and AI features in products and workflows, with accountable owners.
- AI risk assessment
- Risk criteria and an assessment of the risks AI systems create for the organisation, with treatment decisions.
- AI system impact assessment
- An assessment of the potential consequences of each AI system for individuals, groups and society, covering issues such as fairness, transparency, privacy and safety.
- Statement of Applicability
- The Annex A controls that apply, their status and the justification for any exclusion.
- AI policy and controls
- An AI policy, defined roles, human oversight, data and life-cycle controls, and obligations for suppliers of third-party AI.
- Evidence and handover
- Operating records, preparation for management review and an organised handover for the certification audit.
Context
What ISO/IEC 42001 is
ISO/IEC 42001:2023 is the international management system standard for artificial intelligence. It governs AI as a portfolio rather than a single model, and uses the same high-level structure as ISO/IEC 27001, so organisations with an ISMS will recognise Clauses 4 to 10. Annex A adds AI-specific controls, and the AI system impact assessment sits at the centre of the work.
Neither standard is a prerequisite for the other, but an operating ISMS may provide processes that can be reused after assessment.
ISO/IEC 42001 and the EU AI Act
The EU AI Act (Regulation (EU) 2024/1689) sets obligations that depend on the AI system, its risk classification, your role (for example provider or deployer) and the use case. An AI management system can help organise the governance, risk management and documentation that support those obligations.
ISO/IEC 42001 certification does not establish compliance with the AI Act. Applicable obligations need a separate assessment, with qualified legal advice where required.
What this service is not
It is not certification, legal advice or a conformity assessment under the AI Act. The internal audit of an AIMS we implemented is scoped separately and performed by a consultant who had no part in the implementation, or by a separate provider.
How it runs
From AI inventory to certification audit
Scoping call
We confirm which AI systems, roles and sites are relevant, what is driving the work and your target dates, then quote a fixed fee.
AI inventory
We build the inventory of AI systems in scope and assign accountable owners.
Risk and impact assessment
We assess the risks and the impact of each AI system, agree treatment and record the applicable controls in the Statement of Applicability.
Build
Policies, oversight arrangements, and data and supplier controls are implemented with your team and evidenced.
Internal audit and management review
An independent, separately scoped internal audit tests the AIMS, then leadership reviews results and actions.
Certification handover
We organise the evidence for the certification body’s Stage 1 and Stage 2 audits.
Who it suits
Organisations this suits
- Software companies that build AI features into their products.
- Organisations deploying generative AI or third-party AI services in their operations.
- Suppliers whose customers ask for evidence of AI governance in procurement.
- Organisations preparing for EU AI Act obligations that want a management-system structure for AI governance.
- Organisations with an ISO/IEC 27001 ISMS that want to extend governance to AI.
Questions
Frequently asked questions
Does ISO/IEC 42001 certification make us compliant with the EU AI Act?
No. An AI management system can organise governance evidence, but certification does not establish compliance with Regulation (EU) 2024/1689. Your obligations depend on the system, its classification, your role and the use case, and need a separate assessment.
Do we need ISO/IEC 27001 first?
No. Neither standard is a prerequisite for the other. If you already run an ISMS, some management-system processes such as document control, internal audit and management review may be reused after assessment.
Which AI systems go in scope?
You decide the scope. It usually covers AI in your products, the data feeding it, the model life cycle, human oversight and the third-party AI services you rely on.
Who issues the certificate?
An independent accredited certification body. Aegentra implements and prepares the AIMS and is not a certification body.
What does it cost?
We do not publish a price. After a scoping call we quote a fixed fee for the agreed scope. Certification-body fees are separate.
Governing AI with ISO/IEC 42001?
Tell us which AI systems are in scope and what is driving the work.