How to prepare for ISO/IEC 42001

What is ISO/IEC 42001, and who needs it?

ISO/IEC 42001 is the international standard for AI management systems, published in December 2023. It follows the same high-level structure as other ISO management system standards like ISO/IEC 27001, so if you already run an information security program, much of the approach will feel familiar.

It applies to organizations that build AI, use it or embed it in their products and services. It's voluntary, but it's increasingly a way to answer AI questions in enterprise security reviews and vendor due diligence, and to show customers and partners that AI is managed with real controls.

Where should you start?

Start by finding out what you actually have. Most companies use more AI than they realize: copilots in productivity suites, models embedded in vendor products, internal automations and experiments nobody formalized.

The first steps:

• Build an AI inventory: each system, its purpose, the data it uses and who owns it.
• Understand your context: what customers, regulators and partners expect from your use of AI.
• Define the scope of the management system: which business units, processes and AI systems it covers.
• Get executive sponsorship and name owners with real authority.

What does the standard actually require?

You'll need an AI policy, defined roles and responsibilities, measurable objectives and a process to assess and treat AI risks. The standard also calls for AI system impact assessments that consider effects on individuals and groups.

Annex A provides a reference set of controls covering areas like the AI system lifecycle, data, information for interested parties, responsible use and third-party relationships. You decide which apply and justify those choices in a Statement of Applicability.

The NIST AI Risk Management Framework, a voluntary framework released in January 2023, is a useful companion. Its Govern, Map, Measure and Manage functions help you operationalize the risk management the standard requires.

How do you turn policy into practice?

This is where many programs fall short. A policy on paper doesn't help if your systems don't enforce it. Controls need to live in day-to-day operations:

• Least-privilege access for every AI system or agent.
• Human approval for sensitive decisions.
• Logging and traceability for what each AI system does.
• Controls over the data that goes into models, including personal data handled under your privacy obligations.
• Ongoing monitoring and periodic review of performance and incidents.

What mistakes should you avoid?

The most common one is treating the standard as a paperwork exercise. Policies get written, a risk register gets filled in and nothing changes in the actual systems. Auditors spot the missing operational evidence quickly.

Other pitfalls to watch for:

• Leaving vendor AI and shadow AI tools out of the inventory.
• Setting a scope so broad that the management system never gets fully implemented.
• Making AI governance an IT-only project, without business, legal and risk at the table.
• Assessing risk once and never revisiting it when systems or data change.

What does the certification process look like?

Before the external audit, the standard requires an internal audit and a management review. Together they surface gaps while there's still time to close them.

Certification is issued by an accredited certification body, typically in two stages: a review of your documentation and system design, then an assessment of whether the system works in practice. Surveillance audits follow to maintain the certificate.

Rival Tech doesn't certify. We help you implement the management system, connect controls to real operations and prepare the evidence auditors will ask for, working from Bogotá on hours that overlap US Eastern and Central time.

Frequently asked questions