ISO 42001 AI Management System Training

Our ISO 42001 training helps organisations govern artificial intelligence responsibly with an AI management system (AIMS) that meets ISO/IEC 42001:2023. SSC delivers ISO 42001 Foundation, Lead Implementer, Internal Auditor and Lead Auditor courses, plus AI risk and impact assessment workshops, for teams that build, buy or deploy AI.

ISO 42001 courses at a glance

Why ISO 42001 matters now

ISO/IEC 42001:2023, published in December 2023, was the first certifiable management system standard for artificial intelligence. It follows the same harmonised structure as ISO 27001 and ISO 9001, so it integrates with management systems you already run. It asks organisations to set an AI policy and objectives, assess AI risks and the impact of AI systems on individuals and society, apply controls across the AI system life cycle, and manage third-party AI suppliers. Related standards include ISO/IEC 23894 for AI risk management and ISO/IEC 42005 for AI system impact assessment.

Customers, regulators and procurement teams increasingly ask how AI is governed. The EU AI Act applies to many organisations that offer AI systems in the European market, and governments in Australia, New Zealand, the Gulf and Asia have issued AI governance guidance. An AIMS gives you one structured answer.

Course details

ISO 42001 Foundation

Typical duration: 2 days. Who it is for: anyone who works with AI systems or needs to understand AI governance.

• Key AI concepts, roles such as AI provider, producer and user, and the AI system life cycle
• The clauses of ISO/IEC 42001 and the Annex A control objectives
• AI risk assessment, AI system impact assessment and the Statement of Applicability
• How ISO 42001 relates to ISO 27001, privacy law and the EU AI Act

You will be able to: explain what an AIMS requires and contribute to an AI governance programme.

AI risk and impact assessment workshop

Typical duration: 1 day. Who it is for: product owners, data scientists, risk and privacy teams.

• Identifying AI-specific risks such as bias, drift, opacity, misuse and over-reliance
• Running an AI system impact assessment covering individuals, groups and society
• Selecting controls for data quality, human oversight, transparency and monitoring
• Recording decisions so they stand up to audit

You will be able to: complete a defensible risk and impact assessment for a real AI use case.

ISO 42001 Lead Implementer

Typical duration: 5 days. Who it is for: AI governance leads, CISOs, chief data officers and consultants.

• Scoping an AIMS and defining your organisation’s AI roles
• Writing an AI policy, objectives and an AI system inventory
• Integrating AI risk with enterprise risk management
• Supplier controls for third-party models and AI services
• Preparing for certification

You will be able to: lead the implementation of an AIMS from first inventory to certification readiness.

ISO 42001 Internal Auditor and Lead Auditor

Typical duration: 3 days and 5 days. Who it is for: auditors who will assess an AIMS internally or lead certification-style audits.

• Applying ISO 19011 audit principles to AI management systems
• Testing AI risk and impact assessments, data controls and human oversight
• Sampling AI systems across their life cycle
• Reporting findings that technical and executive audiences both understand

You will be able to: audit an AI management system with confidence, and for Lead Auditor, lead the audit team.

Auditing AI in practice

Our exercises use realistic AI use cases such as a customer service chatbot, a credit decision model and a document classification tool. Participants inventory the systems, assess risks and impacts, select controls and audit the evidence. For private courses we can work on your own AI inventory.

How the ISO 42001 training is delivered

• Live online. Instructor-led virtual classes over Microsoft Teams or Zoom, with breakout exercises, shared workbooks and the option to split longer courses into half-day sessions across a week or two.
• On-site at your premises. Private training for your team at your office, delivered by a consultant who can use your own policies, systems and examples in the exercises.
• Private and tailored. Every course can be run for a single organisation, with case studies drawn from your sector and the depth adjusted to your team’s experience.

What participants receive

• A course workbook and the slides used in class
• Reusable templates and checklists, such as audit checklists, risk registers and report formats, depending on the course
• A case study pack and practice questions
• A certificate of completion from Security Solution Consultants

Certificates and accredited exams

Every participant who completes a course receives a certificate of completion from Security Solution Consultants. Lead Auditor and Lead Implementer courses can include an accredited certification exam through our accredited training partner, for standards where the partner offers one. Your quote confirms the exam body, exam format and certificate for each course, so there are no surprises on the day.

Why train with SSC

• Taught by practitioners. Our trainers are working consultants and auditors who advise clients on AI governance and build AI features into our own GRC platform, so examples come from real engagements rather than slides.
• We hold ourselves to the same standard. SSC is certified to ISO/IEC 27001 and follows a Secure by Design approach. See our Trust Centre.
• Hands-on with real tools. Exercises can use GRCLens, the GRC platform built by SSC, so participants practise with risk registers, control libraries and evidence the way they will at work.
• Training that connects to delivery. If your team needs help after the course, the same people can support implementation, internal audits and certification readiness.

Related: our certification and accreditation services cover ISO 42001 readiness, and the GRCLens ISO 42001 module tracks AIMS controls and evidence. See all training courses.