AI governance & ISO 42001

Establishing where AI decisions are made, how they are escalated and how oversight is reported to leadership.

Assigning ownership for AI systems, risk decisions and monitoring, including where responsibilities sit with suppliers.

Recording the AI systems the organisation develops, deploys or relies on, and their purpose, data and users.

Assessing risks to the organisation and impacts on individuals and groups, and deciding how each will be treated.

Setting controls for design, data, testing, deployment, change and retirement of AI systems.

Third-party AI. Assessing AI provided by suppliers or embedded in products you buy, and setting proportionate contractual and operational controls. Privacy. Aligning AI governance with data protection obligations, including impact assessments where personal data is involved. Monitoring. Defining how performance, incidents and changes in risk are monitored once systems are in use. Policies and evidence. Developing the policies and records that show governance is operating in practice. ISO 42001 readiness. Where certification is sought, preparing the AIMS for audit by an independent certification body.

No. ISO/IEC 42001 is a voluntary standard. Some customers ask for it, and it can support evidence of good governance under regulatory regimes, but holding it does not in itself demonstrate compliance with any specific law.

Not on its own. The EU AI Act sets legal obligations that depend on the role you play and the risk category of the system. An AI management system can support those obligations, but Act-specific requirements must be addressed separately.

Often, yes. Organisations that deploy third-party AI still need to understand how it is used, what data it processes and who is accountable. The work is usually lighter than for organisations that develop AI systems.