Most organisations are already using AI, often more widely than leadership realises. ISO/IEC 42001 gives you a recognised way to show that this use is known, controlled and improving. This guide explains what the standard asks for, where consultancy support genuinely helps, and how to get from a standing start to a certification audit without wasted effort.
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is the international standard for an AI management system (AIMS). Published in December 2023, it is the first certifiable management system standard written specifically for artificial intelligence. It applies whether you build AI, buy it, or simply allow staff to use AI tools in their work.
It follows the same high-level structure as ISO 9001 and ISO/IEC 27001: clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement. Annex A then sets out AI-specific controls covering areas such as AI policy, impact assessment, data, the AI system life cycle, third-party relationships and responsible use. If you already hold ISO 9001 or ISO/IEC 27001, much of your existing management system can be reused.
Why organisations are pursuing it now
Three pressures are driving demand. First, customers and procurement teams increasingly ask suppliers how they govern AI, and a recognised standard answers that question quickly. Second, regulation is tightening: the EU AI Act is being phased in and affects UK organisations that sell into the EU, while UK regulators expect firms to manage AI risk within their existing rules. Third, boards want assurance that AI use is not creating hidden data, accuracy or reputational risk.
ISO/IEC 42001 is voluntary and does not by itself make you compliant with any law. What it does provide is a structured, evidenced way of managing AI that maps well onto regulatory expectations and gives auditors, customers and insurers something concrete to rely on.
What a good ISO 42001 consultant actually does
Good consultancy is not about producing a large binder of policies. It is about building a management system that fits how your organisation really works and that people will keep running after the consultant has gone. In practice that means:
- Finding the AI you already use, including AI built into everyday software and tools staff adopted on their own, and recording it in an AI inventory.
- Agreeing the scope of the management system so certification covers what matters without becoming unmanageable.
- Running AI risk and impact assessments that consider people affected by the system, not just the organisation.
- Writing a short, usable AI policy and the procedures behind it, mapped clause by clause to the standard.
- Preparing the Statement of Applicability, explaining which Annex A controls apply and why.
- Training the people who will own the system, then testing it through internal audit and management review before the certification body arrives.
A realistic route to certification
Timescales depend on your size, how much AI you use and whether you already run another ISO management system. As a guide, Aicatch structures the work in stages so you can stop and decide at each one:
- AI Governance Health Check (1-2 weeks): a rapid maturity assessment, a readiness score and a prioritised 90-day action plan.
- ISO/IEC 42001 Gap Assessment (2-4 weeks): a clause-by-clause review, an evidence map and an implementation roadmap.
- Implementation (typically 8-16 weeks): building and operating the management system until it is ready for a Stage 1 audit.
- Internal audit and management review (1-3 weeks): objective challenge and corrective actions before the external audit.
Consultancy and certification must stay separate
Certification itself is carried out by an independent certification body, ideally one accredited by UKAS for ISO/IEC 42001. A consultant who helps you build your management system should not also certify it, and you should be wary of anyone who promises a guaranteed pass. Aicatch prepares organisations for audit and does not issue certificates, which keeps the advice impartial and the eventual certificate credible.
How to choose an ISO 42001 consultant
Before you appoint anyone, ask:
- Will they start by finding out how AI is really used in your organisation, or go straight to templates?
- Can they explain how ISO/IEC 42001 fits with any ISO 9001 or ISO/IEC 27001 system you already run?
- Do they understand the regulation that applies to your sector, such as data protection, financial services or safety-critical rules?
- Will your own people be able to run the system once the engagement ends?
- Are they independent of the certification body you intend to use?
Where to start
The most useful first step is simply understanding who is using AI, how often and whether that use is approved. You can get a quick picture with our free five-question AI use check, or book an AI Governance Health Check for an independent view of your readiness and a clear plan for what to do next.