AI Governance & ISO/IEC 42001 Readiness
Govern the AI you build, buy and use, and get ready for ISO/IEC 42001 certification with a team that knows what an auditor will ask for.
Why AI governance now
Customers add ISO/IEC 42001 to their procurement questionnaires. Regulators and insurers ask how AI decisions are controlled. Boards want to know which AI systems the organization relies on and who is accountable for them.
ISO/IEC 42001, published in December 2023, is the first certifiable management system standard for AI. It gives you one structure to answer all of these questions with evidence, and it builds on the ISO 9001 or ISO/IEC 27001 system you may already run.
Who leads the work
Engagements are led by Michel Fotsing, CISSP and PECB-certified ISO/IEC 42001 Lead Auditor, who has built and run an AI system in production and worked as a security architect for public-sector organizations, including operational technology environments.
IOA-Tech prepares organizations for certification. Certificates are issued only by accredited certification bodies, and IOA-Tech does not issue them.
What we deliver
Start with a readiness assessment, or pick the engagement that matches where you are.
Typically 2 to 4 weeks
ISO/IEC 42001 Readiness Assessment
A gap assessment of your organization against ISO/IEC 42001, clause by clause and control by control, before you engage a certification body.
- Scope and context of your AI management system
- Review against clauses 4 to 10 and Annex A controls
- Reuse of what your ISO 9001 or ISO/IEC 27001 system already covers
- Gap report with a readiness level per clause
- Prioritized roadmap to certification
Phased, from 6 weeks
AI Governance Program
We help you build the AI management system itself: the policies, roles and records that make AI governance work day to day and hold up in an audit.
- AI policy and objectives
- Inventory of AI systems with risk ratings
- AI risk assessment and AI system impact assessments
- Roles, accountability and human oversight
- Controls for third-party and vendor AI
Typically 3 to 5 days
Internal Audit of Your AI Management System
Certification bodies expect at least one full cycle of internal audit and management review before the certification audit. We run it, independently from the team that built the system.
- Audit plan and sampling based on ISO 19011
- Interviews and evidence review
- Findings graded by severity
- Corrective action follow-up
- Input to your management review
Typically 2 to 3 weeks
AI Agent Governance
AI agents now book, buy, approve and change things. We help you decide what an agent may do alone, what it may only propose and what must stay human, and turn that boundary into testable controls.
- Decision map: autonomous, assisted and human-only decisions
- Agent identities, permissions and thresholds
- Escalation paths and a way to stop an agent
- Logging that produces audit evidence
- Questions to ask vendors before an agent goes live
Durations are indicative and depend on scope and on the number of AI systems.
Need an independent audit instead? See AI Audits with the Three Zones Framework.
The path to certification
Assess
Readiness assessment and roadmap.
Build
Policies, inventory, risk and impact assessments, controls.
Audit
Independent internal audit and management review.
Certify
Certification audit by the accredited certification body of your choice.
To protect impartiality, an organization we helped implement its AI management system should be certified by an independent, accredited certification body. Our work is technical and organizational; it is not legal advice.
Standards and frameworks we work with
ISO/IEC 42001
AI management system requirements
ISO/IEC 42005
AI system impact assessment
ISO/IEC 23894
Guidance on AI risk management
NIST AI RMF
AI Risk Management Framework 1.0
EU AI Act
For organizations placing AI on the EU market
ISO/IEC 27001
Integration with your existing security management system
How ready are you for ISO/IEC 42001?
Book a 30-minute call. We will look at your AI use, your existing management systems and the fastest path to certification.
Book a Readiness Call