AI governance

ISO/IEC 42001 AI management system implementation

Make AI governance repeatable across the full system lifecycle. We help organizations identify AI uses, assess impacts and risks, assign accountability, and build evidence for an AI management system.

Our implementation focus

Make the requirements operational.

  1. 01

    Inventory AI systems and use cases

  2. 02

    Define AIMS scope, policy, roles, and objectives

  3. 03

    Assess AI risks and impacts

  4. 04

    Establish lifecycle controls and records

  5. 05

    Create monitoring, review, and improvement practices

Independent assessment

ISO/IEC 42001 is a management system standard. It does not replace applicable AI law, and independent certification decisions are made by a certification body.

The delivery path

A sequence you can operate.

Each step leaves a clear decision or working artifact behind.

01 / 04

Find the AI estate

Record products, internal tools, supplier features, intended use, affected parties, data, and accountable owners.

Output: AI system inventory and scope proposal
02 / 04

Set the management system

Define policy, objectives, roles, risk criteria, and how decisions move from intake to escalation.

Output: AIMS operating model and governance charter
03 / 04

Control the lifecycle

Apply proportionate reviews from acquisition or design through testing, deployment, monitoring, change, and retirement.

Output: Risk, impact, and control records
04 / 04

Evaluate and improve

Test operation, review performance with management, resolve findings, and prepare for independent assessment where appropriate.

Output: Internal review and improvement plan

Questions we hear

Get the distinctions right.

Does ISO/IEC 42001 compliance satisfy the EU AI Act?

No. ISO/IEC 42001 provides a management system for AI, while the EU AI Act imposes legal duties that depend on the organization’s role and the system. They should be assessed separately.

Do organizations that only use AI need an AI management system?

ISO/IEC 42001 is designed for organizations that provide or use AI systems. The appropriate scope and depth depend on AI use, impacts, and the organization’s objectives.

Can ISO/IEC 27001 controls be reused?

Security governance, supplier oversight, and evidence workflows can provide a foundation. AI-specific risks, impacts, lifecycle decisions, and affected-party considerations still need explicit treatment.

Market context

The same standard, different buyer questions.

EuropeA practical route to SOC 2 customer assurance and ISO/IEC 42001 AI governance for European technology teams, with ISO/IEC 27001 as a security foundation.AustraliaHow Australian SaaS and service organizations can approach SOC 2, ISO/IEC 42001, and ISO/IEC 27001 alongside local security and privacy expectations.SingaporeA practical assurance and AI governance path for Singapore-based technology and service organizations serving regional and international customers.

Practical guidance

Read the next decision.

Implementation guide4 min read

ISO/IEC 42001

ISO/IEC 42001 implementation roadmap: from AI inventory to management review

A usable sequence for building an AI management system that governs both AI products and internal use.

Read resource
Implementation guide5 min read

ISO/IEC 42001

AI impact assessment for ISO/IEC 42001: make the decision traceable

A practical review of purpose, affected people, foreseeable harm, mitigations, and approval for each material AI use.

Read resource
Assurance readiness5 min read

ISO/IEC 42001

ISO/IEC 42001 internal audit and management review: what to test

An audit and review cycle that tests how AI decisions operate, not just whether templates exist.

Read resource

Work with Normstone

Build a defensible path to readiness.

Tell us the outcome you need and the markets involved. We’ll help define the work.

Start a conversation