AI governance with ISO/IEC 42001. Run AI with controls, not hope.
ISO/IEC 42001 is the international standard for AI management systems, published in December 2023. It defines how an organization sets policies, assesses risks and controls its use of AI. Rival Tech helps companies put it into practice alongside the NIST AI Risk Management Framework, in a way that connects to day-to-day operations.
Updated
What is ISO/IEC 42001?
It's a management system standard, like ISO 27001 for information security, but focused on artificial intelligence. It requires you to define responsibilities, assess risks and impacts, control data and models, and continuously improve the system.
What is the NIST AI RMF, and how does it relate to ISO 42001?
The NIST AI Risk Management Framework, version 1.0 released in January 2023, organizes AI risk management into four functions: Govern, Map, Measure and Manage. It's voluntary and complements ISO/IEC 42001: the standard defines the management system you need, and the framework helps you run risk management in practice.
What do you deliver?
AI governance your teams can actually use every day, not just a policy document:
- An inventory of AI use cases and their risk level.
- Policies, roles and responsibilities.
- Controls for data, models, permissions and human approval.
- Traceability for decisions made by AI agents.
- A gap analysis against ISO/IEC 42001.
Can you work with our US-based compliance and engineering teams?
Yes. We work from Bogotá, Colombia, in a time zone aligned with US Eastern and Central time, fully in English. Because we also build AI agents, the controls we recommend are designed to work in real systems, not only on paper.
How do we work?
01
Assessment
Inventory of current AI use cases, data and risks.
02
Design
Policies, roles and controls aligned with the standard and the framework.
03
Implementation
Controls running in your systems, with traceability.
04
Improvement
Periodic reviews and audit readiness.
Frequently asked questions
Do you issue ISO/IEC 42001 certification?
No. Certification is issued by an accredited certification body. We help you implement the management system and prepare for the audit.
Is ISO/IEC 42001 mandatory in the US?
It isn't mandatory today, but it helps you demonstrate responsible use of AI to customers, regulators and partners.
Does AI governance cover data privacy?
Yes. It includes how personal data is handled by AI systems, aligned with the privacy obligations that apply to your business.