What's missing before we build an AI management system?
Certification bodies do not certify intentions. They certify a working AIMS that has survived its own internal audit. We find the gaps before the auditor does, then help you close them.
Last reviewed:
Sound familiar?
- Nobody has written down which AI systems exist, who owns them, and what risk class they fall into.
- Policies exist as documents nobody follows, not as controls that actually run.
- There is no internal audit history, so the certification body has no evidence the management system works in practice.
- Roles and responsibilities for AI risk are scattered across legal, engineering and product with no single accountable owner.
What we do
Gap analysis against ISO 42001
A structured review of your current state against the standard's requirements, prioritised by effort and audit risk.
AIMS build-out
Policies, procedures and records built to be used, not filed — matched to how your organisation actually operates.
Internal audit programme
A working internal audit cycle, run at least once before the external certification audit, with findings actually closed out.
Management review
A management review process that gives leadership real oversight and gives the certifier the evidence trail it expects.
Questions we get
How long does the gap analysis take?
For a single business unit with a handful of AI systems, typically two to four weeks. Multiple business units or a large AI inventory extend that.
Do we need to fix everything before the certification audit?
You need the management system to be functioning and evidenced, not perfect. Minor nonconformities found during certification are normal and correctable within a deadline.
Can our existing quality or security team run the internal audit?
Yes, if they are trained on the standard and independent from the systems they are auditing. We can train them or run the first cycle with them.
What's the difference between this and the certification process itself?
This is the preparation: building the management system and proving it works internally. Certification is the external body verifying that in a stage 1 and stage 2 audit.
Tell us what's running in production.
We'll tell you what we'd check first — and what we wouldn't bother with.
Book a call