ISO/IEC 42001 is the first certifiable standard for AI management systems. It rewards organisations that already run a management system well.
What the standard asks for
Like ISO 27001, ISO/IEC 42001 follows the familiar structure: context, leadership, planning, support, operation, performance evaluation and improvement, plus AI-specific controls in its annex. It asks you to know your AI systems, assess their risks and impacts, assign responsibilities, and show evidence that you do what your policies say.
Where the time goes
Rarely in writing policies. In scoping, in turning abstract clauses into something that matches how your teams actually build and buy AI, and in producing records that hold up in an audit. Companies with ISO 27001 or 9001 can reuse much of their existing system, and that credit is where most of the time is saved.
Typically six to nine months, for a focused scope.
How we get you there
Clause-by-clause gap analysis. A scoped AI management system with roles and controls. Documentation produced from real work processes, not templates filled in for their own sake. Then an internal audit, a management review and a certification dry run. Certification itself comes from an accredited body; we prepare you and support you through it.