Ongoing compliance - ISO 42001
An AI management system goes out of date faster than most. Models are retrained, providers change their terms, teams add AI features inside products and tools. Managed AIMS keeps the inventory, the risk and impact assessments and the governance around them current on a monthly retainer.
Who it is for
AI features arrive through SaaS updates and internal experiments that nobody records.
The assessment describes the model you had a year ago, not the one in production.
Providers update data-use and model-change terms; nobody reviews them against your obligations.
Metrics exist in dashboards, but no one is accountable for acting on them.
Why an external specialist
How it works
We review the inventory, risk and impact assessments, policies, supplier records and last audit report, and agree what needs catching up.
We agree with engineering and product what counts as a change that reopens an assessment, so updates are triggered, not remembered.
Inventory and assessment updates on change, monthly monitoring and action follow-up, quarterly supplier reviews.
Independent internal audit scheduled, management review prepared, surveillance readiness checked.
Operating calendar
Most AIMS work is triggered by change, not the calendar. Fixed cadences cover monitoring, suppliers and the annual cycle.
| When | Activity | What it involves |
|---|---|---|
| On change | AI system inventory upkeep | New, changed and retired AI systems recorded with owner, purpose, data, model or provider, and lifecycle stage - including AI features bought inside third-party software. |
| On change | Risk and impact assessment review | AI risk assessment and AI system impact assessment revisited when a model is retrained or replaced, a use case changes, new data sources are added or a supplier changes terms. |
| Monthly | Monitoring and incident follow-up | Agreed monitoring outputs reviewed with system owners - performance drift, complaints, misuse reports, AI-related incidents - and actions raised where criteria are breached. |
| Monthly | Corrective action tracking | Nonconformities and improvement actions from audits, incidents and monitoring tracked to verified closure. |
| Quarterly | Supplier AI governance | Foundation-model and AI service providers reviewed: contractual terms on data use, model changes, transparency and support for your own obligations. |
| Quarterly | Objectives and metrics | AI objectives and the measures behind them reviewed with owners and reported to management. |
| Annually | AI policy and procedure review | AI policy, acceptable-use rules and lifecycle procedures reviewed against how teams actually build, buy and deploy AI. |
| Annually | Competence and awareness | Roles involved in the AI lifecycle checked for the competence the AIMS requires; awareness material refreshed. |
| Annually | Internal audit coordination | Audit programme planned and scheduled with an independent auditor; findings fed into corrective action. |
| Annually | Management review | Inputs prepared on AI risks, incidents, objectives, audit results and changes in external requirements, including the EU AI Act timetable where relevant. |
The calendar is agreed at the start of the retainer and sized to the contracted monthly capacity. Activities that do not fit the capacity are scheduled across months or quoted separately - never squeezed in.
What you receive
What we need from you
Responsibilities
A managed system is still your management system. The retainer covers the coordination, upkeep and expert work; decisions, approvals and the controls themselves stay with your people.
Audit independence
Auditors must remain independent of the activities they audit. Where Kellwick has supported implementation or ongoing management, any subsequent internal audit is subject to an independence and conflict-of-interest review. The assigned auditor must not have participated in the work being audited. Where sufficient objectivity and impartiality cannot be assured, Kellwick will decline the affected scope or recommend independent external assurance.
The retainer coordinates the internal audit programme - scheduling, scope, follow-up of findings. The audit itself is either a separate independent audit by another Kellwick auditor, or performed by your own trained auditors or another provider.
Capacity and pricing
Managed AIMS retainers are scoped to the system: the number of AI systems in scope, how often they change, and whether the AIMS runs alone or with ISO 27001. The monthly days are stated in the proposal.
Retainer fees are Kellwick consulting fees only. Certification body fees, travel, taxes and third-party tools are separate.
Typical investment
Monthly retainerScoped on a call
Up to one advisory day per month (8 hours)
What changes it: AI systems in scope · Rate of change · Integration with ISO 27001
Delivery
Boundaries
ISO/IEC 42001 is a voluntary, certifiable management system standard. Maintaining it supports AI governance and can help organise evidence for AI Act obligations, but certification does not by itself demonstrate EU AI Act conformity. Where the AI Act applies, legal classification stays with you and your legal advisers.
Last verified 16 October 2026 against ISO - ISO/IEC 42001.
Last verified 16 October 2026 against EUR-Lex - OJ L 2026/1744 and European Commission - AI Act.
Related services
Questions
No service can promise that, and ISO 42001 certification does not by itself demonstrate AI Act conformity. A maintained AIMS keeps your inventory, risk and impact assessments and supplier governance current, which is useful evidence where AI Act obligations apply. Legal classification needs legal advice.
ISO 42001 expects assessments to be performed at planned intervals and when significant changes occur. In practice that means a review whenever a model, use case, data source or supplier changes materially, which is why the calendar is change-driven.
Not the people who maintain it. The internal audit is assigned to an auditor with no involvement in the work, as a separate engagement, or you can use another provider.
Possibly. If your AIMS scope covers AI you deploy rather than build, the work centres on the inventory, supplier governance, use-case impact assessments and monitoring. The retainer is sized accordingly.
Tell us how many AI systems are in scope, how often they change and where your AIMS stands today.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.