ISO/IEC 42001 implementation

ISO/IEC 42001:2023 is the first international certifiable standard for AI management systems (AIMS). It follows the ISO high-level structure (Annex SL), the same as ISO 27001, ISO 9001 or ISO 14001, which makes it integrable with existing management systems. Its Annex A contains 38 AI-specific controls grouped in 9 domains: governance, policies, organisational structure, resources, AI system impact assessment, AI system lifecycle, data, stakeholder information and use. It is certifiable by accredited bodies (UKAS in the UK, ENAC in Spain).

Not mandatory, but it helps significantly. Both follow Annex SL (the common ISO management-system structure), so clauses 4 to 10 are practically equivalent. If you already hold a 27001 certificate, the 42001 effort is substantially reduced: you reuse governance, committee, risk management, nonconformities, continual improvement and internal audits. If you don't have 27001, we implement them in parallel (same SL clauses) and address the specific controls: 27001 Annex A has 93 controls, 42001 has its own 38 AI controls. We decide in the initial diagnostic.

It depends on scope (number of AI systems covered, organisational complexity, prior certifications). Pre-certification implementation with 1-3 AI systems and ISO 27001 already certified is faster and cheaper. Combined 27001+42001 implementation from scratch is the longest path. If only alignment without certification is sought, it is shorter. External certification (audit by accredited body) is invoiced separately by the certification body. Before quoting we always run an initial diagnostic.

Six blocks. Diagnostic (gap analysis against clauses 4-10 + 38 Annex A controls, identification of AI systems in scope, roadmap definition). Governance (AI policy, AI committee, role assignment, management indicators). AI risk management (procedure compatible with EU AI Act art. 9, register, system-by-system assessments). Annex A controls (effective implementation of the 38 applicable controls, justified exclusions documented). Operation (internal audits, management review, nonconformities, corrective actions, continual improvement). Pre-audit (simulation of external audit, final adjustments before the certification audit).

27001 is the classic ISMS for information security (confidentiality, integrity, availability). 42001 is the AI-specific MS (accountability, transparency, fairness, human oversight, reliability, AI safety, AI privacy). Clauses 4 to 10 are equivalent (Annex SL). Annexes are entirely different: 27001 covers 93 information-security controls (organisational, people, physical, technological); 42001 covers 38 AI-specific controls across 9 domains. An organisation can hold both, integrated as a single management system — the recommended practice when AI systems are in production.

ISO/IEC 42001 is the natural operating framework to sustain EU AI Act compliance. Annex A control A.6.2 (AI system impact assessment) covers the spirit of EU AI Act art. 9 (risk management system). A.6.1 (AI system objectives and processes) maps to art. 11 (technical documentation). A.8.1 (AI system use logging) to art. 12 (logs). Clause 9.2 control (AI system performance evaluation) directly covers what art. 15 EU AI Act requires on testing. Implementing 42001 does not certify EU AI Act compliance (different things), but it generates the evidence base the regulator will want to see.

Certification is granted by accredited certification bodies. The most relevant in Europe are AENOR, TÜV Rheinland, TÜV SÜD, Bureau Veritas, LRQA, SGS and BSI. For the certificate to be internationally recognised, the body must be accredited by ENAC (Spain), UKAS (UK) or another IAF MLA member. Hard2bit is independent: we are not a certification body and do not represent any. We prepare the organisation to pass the external audit, but the audit itself is performed by the body the client chooses. We coordinate with you and with the certification body so the audit runs cleanly.

Yes, for three reasons. Procurement: enterprise customers are starting to require 42001 in RFPs throughout 2026-2027, particularly SaaS providers with AI components. Competitive differentiation: the standard is new and few European organisations are certified; being early generates genuine commercial advantage. Operational: the AIMS framework gives you a structure to govern AI sustainably, not just to comply with the regulation reactively; without an operating framework, EU AI Act becomes a recurring reactive cost. ROI is typically recovered in 12-24 months for organisations with multiple AI systems or enterprise customers.

After implementation, the certification process with the accredited body typically runs in three to four months: documentary audit (stage 1) + implementation audit (stage 2) + time to handle findings + certification decision. If implementation has been done properly (with pre-audit included), the first-time success rate is high (over 80%). The certificate is valid for three years with annual surveillance audits. Realistic planning: a few months of implementation plus three to four months of certification, if ISO 27001 is already in place.

A 30-minute call to understand your starting point (AI systems in scope, existing certifications, ISO 27001 yes/no, current EU AI Act position, objective: certification or alignment only). If it makes sense, an initial diagnostic of a few weeks with gap analysis against the SL clauses plus the 38 Annex A controls. With that, we issue a firm proposal: scope, timeline, assigned team, deliverables and closed price. No commitments until signature. If we see that the client does not yet have enough AI systems in scope, we recommend aligning without certifying (cheaper, foundation prepared to certify when the time is right).