ISO/IEC 42001

AI governance with ISO 42001

We help you implement your artificial intelligence management system and get ready for certification by an accredited body.

Book a free consultation
— ISO/IEC 42001 —

What is ISO 42001?

ISO/IEC 42001:2023 is the certifiable international standard for artificial intelligence management systems. Published in December 2023, it requires a company to govern the AI it develops, provides or uses: policy, owners, risk and impact assessment, life-cycle and data controls, and continual improvement. It shares the structure of ISO 27001 and ISO 9001 (clauses 4 to 10) and has 38 controls in Annex A, so it integrates with the management systems you already run.

— Process —

How do we do it?

GAP assessment

Current state against the clauses and Annex A controls, with prioritized gaps.

Inventory and impact assessment

Which AI systems you have, what for, with what data and whom they can affect.

Policies and controls

AI policy, roles, procedures and statement of applicability, sized to your company.

Internal audit

We verify the system works and has evidence before the external audit.

Certification support

We prepare you and support you during the certification body's audits; that body issues the certificate.

— Context —

Why now?

Customers and tenders

Large companies and international buyers are starting to ask for evidence of how AI is governed.

Regulation

If your AI reaches Europe or the US: the EU AI Act requires risk management and US state laws (such as Colorado's, from 2027) require notices and human review when AI decides about people. ISO 42001 and the NIST AI RMF are the recognized way to show control.

Personal data

Privacy laws already apply to AI that processes personal data; the standard organizes how to comply.

If you already have ISO 27001

You reuse much of your system: risk, audits, suppliers and incidents.

— Certification —

Who issues the certificate?

An accredited body

T.I. RESCUE does not certify: an accredited body issues the certificate after its own audit.

We get you ready

Assessment, implementation, internal audit and support during the certification audit.

ISO experience

T.I. RESCUE holds Icontec certifications in ISO/IEC 27001, ISO 9001, ISO/IEC 20000-1 and ISO 22301.

— Free —

Free AI governance tools

ISO 42001 self-assessment

22 requirements, score by domain.

Shadow AI checklist

Is your team using AI without control?

AI risk classifier

Is your AI high risk under the EU AI Act or US state laws?

AI use policy generator

Your AI acceptable use policy in 2 minutes.

ISO 42001 frequently asked questions

What is ISO 42001?

It is the international standard ISO/IEC 42001:2023 for artificial intelligence management systems. It sets the requirements to govern AI responsibly and can be certified by accredited bodies.

Does T.I. RESCUE certify ISO 42001?

No. An accredited body issues the certificate after its audit. We run the assessment, implementation and internal audit, and support you during that audit.

Is ISO 42001 mandatory?

Not by itself, but it is the recognized way to show AI risk management to customers, auditors and regulators, and it supports compliance with laws such as the EU AI Act.

How is it different from ISO 27001?

ISO 27001 protects information; ISO 42001 governs AI systems (risk, impact on people, data, life cycle). They share a structure and can be implemented together.

How does it relate to the NIST AI RMF and the EU AI Act?

The NIST AI RMF is a voluntary US framework and the EU AI Act is mandatory for those who provide or use AI in the Union. ISO 42001 is the certifiable management system that helps meet both.

How long does implementation take?

It depends on how many AI systems you have and whether you already have ISO 27001. Measure your starting point with the ISO 42001 self-assessment.

How much does it cost?

It depends on the size of the company and the scope of the management system. Request a quote.

Want to know what you need for ISO 42001?

T.I. RESCUE is a Colombian cybersecurity company based in Medellín.

Contact us