ISO 42001 / AI governance
We help organisations that build, buy or embed AI put governance around it: an AI system inventory with owners, risk and impact assessments, lifecycle controls and supplier oversight - organised as an ISO/IEC 42001 management system that can be certified.
ISO 42001 is voluntary. It is not EU AI Act conformity and cannot be, but it gives you the management system the AI Act's obligations are easiest to meet from. We are clear about both.
The standard
An AI management system standard: how an organisation decides, controls and reviews its use of AI. Not a model evaluation and not a law.
ISO/IEC 42001:2023 follows the ISO harmonised structure - context, leadership, planning, support, operation, performance evaluation, improvement. If you run ISO 27001 or ISO 9001, the machinery is the same.
Annex A carries 38 controls across 9 groups. Annex A and the implementation guidance in Annex B are both normative, and the controls are selected through a Statement of Applicability.
The standard requires an AI system impact assessment: the consequences for individuals, groups and society, not only the risk to your organisation. Nothing in ISO 27001 asks for this.
ISO 42001 is not required by law. Organisations certify because customers, investors or their own boards want evidence that AI is governed. Accredited certification is available now.
Who it is for
Nobody can list every AI system in use, least of all the ones reached through an API or switched on inside a SaaS tool.
A responsible AI policy exists, but no one decides when a model ships, changes or is withdrawn.
Risk registers cover the organisation; nothing assesses what an AI system can do to the people it affects.
Model providers and AI features in purchased software are adopted without assessment, terms or monitoring.
Why an external specialist
How it works
From a first gap assessment to a system that operates and can be certified. Each step can be bought on its own.
What you build, buy or embed, what data reaches it, who owns it - and a management system boundary that holds up at Stage 1.
Clauses 4-10 and the 38 Annex A controls against how you operate today, with gaps ranked by what would stop certification.
A risk method and an AI system impact assessment your team can repeat for every new system, not a one-off document.
Roles, decision rights, responsible AI policies and controls from design and data through deployment, monitoring and retirement.
Assessment of model providers and AI features in purchased software, contract terms and ongoing monitoring.
An independent internal audit, management review and a pre-certification check before the certification body's Stage 1.
ISO 27001 and ISO 42001
| ISO 27001 | ISO 42001 | |
|---|---|---|
| What it governs | Your information - confidentiality, integrity, availability. | Your AI systems across their lifecycle, and the people affected by them. |
| Direction of risk | Risk to your organisation. | Risk to your organisation, plus a required assessment of impact on third parties and society. |
| Structure | Harmonised structure, clauses 4-10. | Harmonised structure, clauses 4-10. Same spine, so one management system can carry both. |
| Controls | Annex A, with guidance in the separate ISO/IEC 27002. | Annex A: 38 controls in 9 groups, with normative guidance in Annex B. |
| Mapping between the two | No official ISO mapping to 42001 exists. | Any mapping you have been shown is third-party - ours included. We show the reasoning. |
EU AI Act
The AI Act applies in stages. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk dates. Whether a date applies to you depends on your role (provider or deployer) and on how each system is classified - which is what an applicability review establishes.
This is a summary for planning, not legal advice. Where a classification is contested we work alongside your legal counsel.
Last verified 16 October 2026 against EUR-Lex - OJ L 2026/1744 and European Commission - AI Act.
What you receive
What we need from you
Scope and pricing
Fixed-scope proposals after a scoping conversation. Certification body fees are separate and paid to the certification body.
Delivery
Boundaries
ISO 42001 certification does not show that you comply with the EU AI Act. Harmonised standards under the AI Act must be European standards adopted on a Commission request, and ISO/IEC standards are not eligible. ISO 42001 gives you the governance most AI Act obligations are easiest to meet from - we map that overlap, and we say where it ends.
Last verified 16 October 2026 against ISO - ISO/IEC 42001.
Related services
Self-check
Answer honestly. The result is a rough indication, not an assessment - but it shows where a gap analysis would start.
Questions
No. It is a voluntary international standard. Organisations certify because customers, investors or their own boards ask for evidence that AI is governed. Some contracts and tenders now require it, which makes it a commercial requirement for those suppliers, not a legal one.
Yes. Accredited certification is available now, with ISO/IEC 42006:2025 setting the requirements for certification bodies that audit AI management systems. Accreditation bodies including ANAB and UKAS accredit certification bodies for it. Unlike ISO 27001, ISO 42001 is not yet a named scope in the international mutual-recognition arrangement, so check how your certification body is accredited before you sign.
No. AI Act harmonised standards must be European standards produced by CEN, CENELEC or ETSI on a Commission request, so an ISO/IEC standard cannot give a presumption of conformity. A separate European quality management standard for AI Act compliance is being developed. ISO 42001 is still a strong foundation: inventory, risk and impact assessment, lifecycle control and supplier oversight are what most AI Act obligations need.
Regulation (EU) 2026/1744 entered into force on 27 July 2026. It moved the high-risk obligations for Annex III systems to 2 December 2027 and for AI embedded in Annex I regulated products to 2 August 2028, and softened the AI literacy obligation. Prohibited practices and the general-purpose AI rules continue to apply as before.
Above all, the AI system impact assessment - the duty to assess consequences for individuals and society, not only risk to your organisation. Then 38 AI-specific Annex A controls, data for AI systems and lifecycle governance. Context, leadership, internal audit and management review carry over, so you extend one management system rather than building a second.
No. ISO 42001 stands on its own. If you already run ISO 27001 or ISO 9001 we integrate with it; if you do not, we build the AIMS directly.
We are not aware of any AI Act enforcement decision with a fine. Figures circulating online, such as a supposed Belgian facial-recognition fine, are not real. The penalty provisions have applied since 2 August 2025, so the power exists.
Tell us which AI systems you build, buy or embed, and whether you already have ISO 27001 or ISO 9001. We reply within one business day with a suggested scope.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.