ISO/IEC 42001, the AI management system (AIMS), and AI policies, in synergy with the EU AI Act and ISO 27001. Built by people who actually use AI, and govern it on themselves too.
An EU grant rewarding those with AI governance. An enterprise customer who, after the usual security questionnaire, now adds questions about models, training data, bias, transparency. The EU AI Act phasing in. You have AI in the product but no formalized governance, and you wonder whether ISO 42001 is the right answer or just another new standard to chase.
ISO/IEC 42001: the certification of an AIMS (AI management system): policies, risk & impact assessment, AI system inventory, data/bias/transparency governance, AI supplier management. It's voluntary and shows customers and grant bodies you govern AI in a structured way.
EU AI Act: a regulation (legal obligation, escalating for high-risk systems). It's not a certification: it's obligations. ISO 42001 helps you prepare, but doesn't replace AI Act compliance.
ISO/IEC 27001, information security: the AIMS often builds on the ISMS. If you have (or want) 27001, 42001 integrates well.
When you reach out we separate what's a legal obligation (AI Act, where it applies to you) from what's a voluntary competitive advantage (ISO 42001), and tell you where to start.
The standard, and who delivers it.
Support to the AIMS and AI policies, integrated where ISO 27001 is in place.
Go to serviceAIMS, its relationship with the EU AI Act, distinct scopes: the informational pillar.
Understand the standardThe information security the AIMS builds on, with no duplication.
Go to serviceIt depends: if you have EU grants rewarding it, customer requests on AI governance, or AI in product with sensitive data, yes. Otherwise maybe not, and we'll say so. That's exactly why we talk it through first: no fake urgency.
It's true it's new, and we say so openly. Our edge is that we actually use AI every day and govern it on ourselves: we're not improvising a standard read off a slide. And we lean on the solid ISO 27001 framework.
Sober tone, zero buzzwords. ISO 42001 is a real, technical standard (AIMS); the EU AI Act is law. We talk policies, risk assessment and inventory, not "revolutionary AI".
No. The EU AI Act is a regulation (a legal obligation for those in scope, with escalating duties on high-risk systems). ISO 42001 is a voluntary certification of an AI management system: it helps you prepare and demonstrate it, but doesn't replace AI Act compliance.
Yes, very well: the AIMS often builds on the ISO 27001 ISMS. If you have (or want) 27001, we build 42001 on the same framework, no duplication.
Increasingly, structured AI governance is a requirement or a scoring advantage in EU grants. We check the grants you're targeting and exactly what they ask.
First we check whether it's actually worth it. Then we build.
We check whether and when it's actually worth moving.
Integrated with ISO 27001 where present. Preparing an AIMS is similar to ISO 27001 (a few months given adequate readiness), then the body's audit.
Accredited body's audit → certification. AI governance evolves with your product and the law.
Tell us your situation: we honestly tell you whether ISO 42001 is worth it now, and where to start.