ISO/IEC 42001 AI Management System Consulting
A management system for organizations that develop, provide and use AI
ISO/IEC 42001 is the first management system standard published for artificial intelligence. We turn your AI policy, risk and impact assessments, and data and lifecycle controls into a structure you can certify.
Who is it for?
The standard applies whatever your relationship with AI. We define the scope together, based on your organization's role.
Organizations that develop AI
Software and technology companies that build models, algorithms or AI-enabled products.
Organizations that provide AI services
Organizations that offer AI-based services or platforms to customers and need to show those services can be trusted.
Organizations that use AI
Companies that use third-party AI tools in hiring, credit assessment, customer service or production planning.
Companies selling into the EU
Suppliers with obligations under the EU AI Act, or whose EU customers ask for evidence of AI governance.
What the consulting covers
Context and roles
Your organization's role toward AI systems (developer, provider, user), the expectations of interested parties and the scope of the system.
Policy and responsibilities
An AI policy approved by top management, with roles, authorities and clear accountability.
Risk assessment
Identifying risks specific to AI systems (bias, lack of transparency, security weaknesses, wrong decisions) and a risk treatment plan.
Impact assessment
Assessing and recording the potential impact of each system on individuals, groups and society.
Annex A controls
Selecting controls for the AI lifecycle, data quality, information for interested parties, responsible use and third-party relationships through a Statement of Applicability.
Monitoring and internal audit
Performance indicators, an internal audit program and management review.
From implementation to certification
- 01
AI inventory
We list the AI systems you use and develop, their data sources and their owners.
- 02
Gap analysis
We compare your current practice with the requirements and the Annex A controls and report the priority gaps.
- 03
Risk and impact assessment
We carry out risk and impact assessments for each system with your teams and prepare the risk treatment plan.
- 04
Policies and processes
We write the policies, procedures and records in line with the management systems you already run.
- 05
Training and rollout
We brief your development, legal, information security and business teams according to their roles.
- 06
Internal audit and certification readiness
We run the internal audit and the management review and prepare you for the certification audit.
What sets our ISO 42001 work apart
One structure with your existing systems
We build ISO 42001 on the same common structure as ISO 27001, ISO 27701 and ISO 9001, so documents and audits are not duplicated.
Mapped to the law
We map the controls to the EU AI Act, KVKK and GDPR and show which record meets which obligation.
Documents people use
We write plain procedures that your teams will actually use in their daily work.
A team that knows the audit
We run our management system projects with lead auditors who audit in the field.
Frequently asked questions
Is ISO 42001 only for companies that develop AI?
No. The standard applies to any organization that develops, provides or uses AI systems. The scope depends on the organization's role toward those systems.
How does ISO 42001 relate to the EU AI Act?
The EU AI Act (Regulation (EU) 2024/1689) sets the legal obligations. ISO 42001 builds the management system you need to meet them. Certification alone does not mean legal compliance, but it gives you a solid base for requirements such as risk management, record keeping and human oversight.
We already hold ISO 27001. How much do we need to build again?
Both standards use the same common management system structure (clauses 4–10). Processes such as policy, internal audit, management review and document control are shared. The AI-specific risk and impact assessments and the Annex A controls are added.
Who certifies us?
An accredited certification body carries out the certification audit. HRQ does not issue certificates. We build the system, run the internal audit and prepare you for the certification audit.
Do you train our teams?
Yes. HRQ Academy's ISO 42001 programs are delivered in-house, online or on-site.
Related training
In-house training in this area from HRQ Academy.
Let us talk about what you need
In a free 30-minute discovery call, we listen to where your organization stands and work out the right path with you.