ISO 42001 Consulting and AI Governance

Our ISO 42001 consulting helps organisations govern artificial intelligence with an AI management system (AIMS) that meets ISO/IEC 42001:2023 and is ready for certification. Security Solution Consultants (SSC) takes you from a first inventory of AI use to a working management system: AI policy, risk and impact assessments, controls across the AI life cycle, supplier oversight, internal audit and certification support.

Why ISO 42001 now

ISO/IEC 42001:2023 is the first certifiable management system standard for AI. Customers, regulators and procurement teams increasingly ask how AI is governed, and the EU AI Act applies to many organisations that offer AI systems in the European market. A certified AIMS gives one structured, auditable answer, and because it follows the same structure as ISO/IEC 27001, it integrates with the information security management system many organisations already run.

Our ISO 42001 consulting services

• AI readiness and gap assessment against the clauses of ISO/IEC 42001 and its Annex A control objectives.
• AI inventory and roles: every AI system you build, buy or use, with its owner, purpose, data and your role as provider, developer or user.
• AI policy and objectives approved by leadership, with clear accountability.
• AI risk assessment aligned with ISO/IEC 23894, integrated with your enterprise risk framework.
• AI system impact assessment of effects on individuals, groups and society, in line with ISO/IEC 42005.
• Controls and Statement of Applicability for data quality, transparency, human oversight, monitoring and third-party AI services.
• Internal audit, management review and certification support through Stage 1 and Stage 2 audits with your chosen certification body.

From AI inventory to risk register

Most organisations find more AI than they expected: features inside SaaS tools, copilots, analytics models, chatbots and agents built by individual teams. We run a structured discovery, classify each system by risk, and link each one to the risks, controls and owners in a single register, so the AIMS covers what is really in use.

Impact assessments that hold up

ISO/IEC 42001 asks you to assess the potential consequences of AI systems for individuals, groups and society. We facilitate those assessments with product, legal, privacy and risk teams, record decisions and residual risks, and set the triggers for reassessment when a model, its data or its use changes.

How we deliver

1. Discover: inventory and gap assessment, two to four weeks depending on scale.
2. Design: policy, roles, risk and impact methods, Statement of Applicability.
3. Implement: controls, supplier requirements, monitoring and training.
4. Assure: internal audit and management review.
5. Certify: support through the certification audit and any corrective actions.

Why work with SSC

• We build AI into our own GRC platform, so we understand AI risk from the inside.
• SSC is certified to ISO/IEC 27001 and integrates ISO 42001 with your existing ISMS instead of creating a parallel system.
• The GRCLens ISO 42001 module holds your AI inventory, risks, impact assessments and evidence.

Related: ISO 42001 training, our agentic AI risk assessment checklist, ISO 31000 vs ISO 23894 and certification and accreditation services.