Responsible AI. Clear Accountability. Trusted Innovation.
Artificial intelligence brings new risks: bias, lack of transparency, misuse of data and unclear accountability. ISO/IEC 42001 is the international management system standard for organisations that develop, provide or use AI systems. We help you put governance, risk assessment and controls around your AI so that it is used responsibly and you are ready for certification.
Organisations are adopting AI faster than they are putting controls around it. Clients, regulators and boards want to know which AI systems you use, what risks they carry and who is accountable. ISO/IEC 42001 gives a management system structure to answer those questions.
We help you set up proportionate AI governance that supports innovation instead of blocking it.
About ISO/IEC 42001
ISO/IEC 42001 specifies the requirements for an artificial intelligence management system (AIMS). Organisations can be certified against it by an independent, accredited certification body.
1. Our ISO/IEC 42001 Consultancy Services
Our support can cover the whole journey or only the stages you need.
A. Gap Analysis & Readiness Assessment
Every project starts with a clear picture of where you stand. Our consultants compare your current practices, documents and records with the requirements of ISO/IEC 42001 and agree the priorities with you.
- Review of existing processes, policies, procedures and records.
- Interviews with top management, process owners and key staff.
- Site walk-through to see how work is actually done.
- Clause-by-clause assessment against ISO/IEC 42001.
- Identification of strengths, gaps and quick wins.
- A gap analysis report with a prioritised action plan and an estimated timeline.
B. AI Management System Design & Documentation
We design the AI management system around how your organisation really works, so that documents support the work rather than sit on a shelf. Documentation is kept proportionate to your size and risks.
- Definition of the scope, context and interested parties.
- Process mapping and interactions between processes.
- Policies, objectives and performance indicators.
- Procedures, work instructions, forms and records where they add value.
- Risk and opportunity registers.
- Document control and record management arrangements.
C. Implementation Support & Coaching
Our consultants work alongside your team, on site and remotely, while the new arrangements are put into practice and the first records are generated.
- Coaching of process owners and the management representative.
- Support in running the new processes and controls.
- Review of the first records and evidence.
- Practical advice on handling nonconformities and corrective actions.
- Regular progress meetings and status reports to management.
D. Training & Awareness
People make the system work. We train each group on what the standard means for their role.
- Awareness sessions for all staff.
- Workshops for top management on leadership responsibilities.
- Practical training for process owners on their procedures.
- Internal auditor training for your audit team.
- Training records to demonstrate competence.
E. Internal Audit & Management Review
Before the certification audit, the system must be tested. An experienced auditor carries out a full internal audit, and we help top management run an effective management review.
- Internal audit programme and audit plan.
- Full internal audit covering all requirements and all processes in scope.
- Audit report with graded findings and objective evidence.
- Support in root cause analysis and corrective actions.
- Preparation and facilitation of the management review meeting.
F. Certification Audit Preparation & Support
When your system is ready, we help you through certification. The audit is carried out, and the certificate is issued, by an independent accredited certification body; ITA does not issue certificates.
- Guidance on selecting an accredited certification body.
- Readiness check before the stage 1 audit.
- Preparation of your team for auditor interviews.
- Support during the stage 1 and stage 2 audits, where requested.
- Help in closing any findings raised by the certification body.
G. Transition, Integration & Ongoing Support
Management systems need to stay effective after certification. We continue to support you as standards, your organisation and your risks change.
- Transition to new editions of the standard.
- Integration with other management systems such as ISO 9001, ISO 14001 and ISO 45001.
- Periodic internal audits and health checks.
- Support before surveillance and recertification audits.
- Help with extending the scope to new sites, products or services.
2. Requirements We Help You Implement
Depending on your scope, our consultants support you across the key areas of ISO/IEC 42001, including:
- Inventory of AI systems and their roles (developer, provider, user)
- AI policy, roles and responsibilities
- AI risk assessment and risk treatment
- AI system impact assessment
- Controls for data, transparency, human oversight and the AI system life cycle
- Supplier and third-party AI
- Integration with ISO/IEC 27001 and ISO 9001
- Internal audit and management review
3. Key Documents and Records We Help You Develop
- AI policy and objectives
- Inventory of AI systems and their intended use
- AI risk assessment and risk treatment plan
- AI system impact assessments
- Statement of applicability for the standard’s controls
- Data management and data quality requirements for AI
- Procedures for the AI system life cycle, monitoring and human oversight
- Supplier and third-party AI requirements
Documentation is kept practical and proportionate: we build only what your organisation needs to work effectively and demonstrate conformity.
4. How We Deliver Our Services
Step 1: Understanding Your Organisation
We start by understanding your activities, sites, products and services, current practices, and what you want to achieve: certification, customer requirements, better control, or all of these.
Step 2: Gap Analysis & Project Plan
We assess your current situation against ISO/IEC 42001 and agree a realistic plan defining:
- Scope of the AI management system.
- Priorities and actions.
- Responsibilities on both sides.
- Timeline and milestones.
- Target date for the certification audit.
Step 3: System Design & Documentation
Together with your process owners, we design the processes, controls and documented information the system needs, building on what already works.
Step 4: Implementation & Training
Your team puts the system into practice with our coaching. We train staff at every level and review the first records to make sure the system is working as intended.
Step 5: Internal Audit
An experienced auditor audits the whole system against ISO/IEC 42001. Findings are graded and supported by evidence, and we help you correct them at the root cause.
Step 6: Management Review & Readiness
We help top management review the performance of the system and confirm readiness for certification.
Step 7: Certification & Beyond
We support you through the stage 1 and stage 2 audits by the certification body you choose, help you close any findings, and remain available for surveillance audits and continual improvement.
5. Business Benefits
- Win tenders and keep customers who require certification
- Reduce errors, waste and incidents
- Show regulators and clients that risks are under control
- Give staff clear roles, procedures and objectives
- Build a base for continual improvement
6. Who Can Benefit From This Service?
This service is particularly valuable for:
- Software and technology companies developing AI
- Organisations using AI in customer-facing services
- Banks, insurers and fintech companies
- Healthcare and life-sciences organisations
- Government entities adopting AI
- Organisations already certified to ISO/IEC 27001
- Suppliers whose clients ask for evidence of responsible AI
7. Why Choose ITA?
Practical, Not Paper-Based
We build systems around how you actually work, with documentation proportionate to your size and risks.
Experienced Consultants and Auditors
Your project is led by specialists with practical experience of implementing and auditing management systems.
Clear Plan and Accountability
You know from the start what will be done, by whom and by when, with regular progress reporting.
Your Team Learns as We Work
We transfer knowledge throughout the project so that your people can run and improve the system themselves.
Integrated Approach
One system can cover several standards, avoiding duplicated documents, audits and effort.
Bilingual Delivery
We work in Arabic and English, and our training courses are available in all languages.
8. Frequently Asked Questions
We already have ISO/IEC 27001. How much extra work is ISO/IEC 42001?
Much of the management system structure is shared, so the main additions are the AI-specific risk and impact assessments, controls and life-cycle processes. We build them into your existing system.
How long does a project take?
It depends on the size of your organisation, the number of sites and the controls already in place. We give you a timeline after the gap analysis.
Do you issue the certificate?
No. Certificates are issued by an independent, accredited certification body. We prepare you and support you through the audit.
Can several standards be combined?
Yes. We can build one integrated management system covering, for example, quality, environment and occupational health and safety.
9. Related Training
We can deliver tailored in-house awareness and practitioner training for your team as part of the project. Browse all training courses or our other consultancy services.
10. Request a ISO/IEC 42001 Consultancy Proposal
Tell us about your organisation, sites, scope and target dates. Our team will review your needs and send you a proposal with a clear scope, plan and fees.