Insights
AI management systems under ISO/IEC 42001: AI inventories, risk and impact assessments, lifecycle controls, and how they relate to the EU AI Act.
ISO 42001 is a real, certifiable AI management system standard. The EU AI Act is law. They are not the same thing, and 42001 can never grant a presumption of conformity with the Act - the Commission has said so directly. Here is how they relate.
27 Oct 2026 · 7 min read
Inference logs that capture customer inputs can contain PII, confidential business data or legally privileged material. ISO 27001 requires you to classify what you keep, control who reads it, and align retention with your DPA commitments.
18 Aug 2026 · 5 min read
LLM API vendors process customer data on your behalf. If they are not on your sub-processor register with a current DPA and assurance evidence, enterprise buyers will find that gap before you do.
15 Aug 2026 · 5 min read
ISO 27001 does not certify model behaviour, bias or EU AI Act compliance. But it answers the information-security questions enterprise buyers gate on: access, sub-processors, data handling and documented evidence.
12 Aug 2026 · 5 min read
AI management system gap analysis, implementation, impact assessments and independent internal audits.