ISO/IEC 42001 · AI management
An independent audit of your AI management system (AIMS). We test whether the AI systems you build, buy or embed are inventoried, assessed for risk and impact, governed through their lifecycle and controlled where third parties are involved - and whether the management system around them works.
Most AIMSs are young. The first internal audit is usually where an organisation learns whether its AI inventory is complete and whether impact assessments are actually being done for new systems. Audits are led by auditors who hold ISO/IEC 42001 Lead Auditor certification.
Who it is for
The flagship model is listed; the AI features inside purchased tools, internal scripts and supplier services are not.
The AI system impact assessment was written for certification and never repeated when the model, data or use changed.
Controls are marked applicable or excluded without a link to the risks and impacts that should decide them.
Foundation-model providers and AI-enabled suppliers are covered by a contract, but not by the AIMS processes that should assess them.
How it works
Scope is agreed in the audit plan. A full-scope audit samples:
Your role for each AI system - developer, provider, user or a mix - and whether the AIMS scope matches the systems you actually operate.
Completeness of the inventory against what we find in interviews, architecture and supplier records, and whether each system has an owner.
AI risk assessment and treatment, and the AI system impact assessment for individuals, groups and society - including whether they are repeated when things change.
The applicability decisions and a sample of the 38 Annex A controls in operation: data, lifecycle, transparency, use and third-party relationships.
How a system moves from idea to design, verification, deployment, monitoring and retirement, with the records each stage should leave.
Monitoring of AI systems, previous audits, management review and corrective action, and whether objectives for responsible AI are measured.
What you receive
What we need from you
Scope and pricing
Quoted per scope. The proposal states the audit days and what is excluded.
Delivery
Boundaries
ISO/IEC 42001 is a voluntary, certifiable management system standard. It helps organise AI governance, but an internal audit or a certificate against it does not show conformity with the EU AI Act. The AI Act has its own obligations and dates; the Digital Omnibus on AI, in force since 27 July 2026, moved the high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Last verified 16 October 2026 against ISO - ISO/IEC 42001.
Last verified 16 October 2026 against EUR-Lex - OJ L 2026/1744 and European Commission - AI Act.
Related services
Questions
Yes. Like other management system standards, ISO 42001 requires internal audits at planned intervals, and certification bodies expect to see that the audit programme has started - with at least one audit and management review completed - before Stage 2.
ISO/IEC 42001:2023 Annex A contains 38 controls. Which apply depends on your risk and impact assessments and your role for each AI system; the audit tests both the decisions and the operation of the controls you selected.
Yes. Shared processes - document control, competence, management review, corrective action, supplier management - are audited once. AI-specific requirements, such as impact assessment and lifecycle controls, are sampled separately.
No. We can note where AI Act topics such as transparency or human oversight appear in your AIMS, but an ISO 42001 audit is not a legal compliance assessment and we do not provide legal opinions.
We will confirm the scope and send a written proposal with audit days, auditor independence and price.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.