AI governance · The certifiable standard for AI
ISO/IEC 42001 AIMS Implementation
The AI management system standard, implemented as a working routine rather than a documentation pack: scope, an AI risk process, controls, evidence, the internal audit and the management review, all running before any certification body arrives. Fixed by scope after a scoping call, built on the ISO 27001 machinery you may already own, and mapped to the EU AI Act as amended.
The build at a glance
Definition
What is ISO/IEC 42001 AIMS implementation?
ISO/IEC 42001 is the certifiable international standard for AI management systems: the AI equivalent of ISO 27001. Implementation means building the working system the standard describes: scope and context, an AI risk process your team can repeat, the Annex A controls that apply, an evidence pack that accumulates as the system runs, and the internal audit and management review that certification bodies read first. A folder of AI policies is not an AIMS, and auditors know the difference within the first hour.
Intelance implements ISO/IEC 42001 end to end, fixed by scope after a scoping call and senior delivered throughout, with certification supported through both audit stages. The fee is driven by the size of your AI estate, the sectors you operate in and how much management machinery already exists. Where ISO 27001 runs, the shared clauses are reused rather than rebuilt.
To see how far you already are, the free ISO 27001 and ISO 42001 readiness checker scores the shared clauses and the AI specific controls in about six minutes.
The commercial clock is real: enterprise procurement increasingly names the standard, and the EU AI Act as amended puts Annex III high-risk obligations at 2 December 2027, one certification cycle away. Our guide to the EU AI Act and ISO 42001 shows how they fit together, and the wider practice is described under AI governance consulting.
Running before the audit
Reviews held, risks treated and evidence accumulating before anyone certifies it.
ISO 27001 reused
Shared clauses, shared machinery: one management system family, built once.
Mapped to the Act
The AIMS carries your EU AI Act duties, on the dates as amended.
Certification kept independent
An independent, accredited body certifies. We prepare you for both stages.
The anatomy
Six things a real AIMS is made of
Policy packs copy the documents and miss the system. These six parts are what a certification body audits, and each card shows the output the build leaves running.
Scope and context
Which AI systems, which sites, which roles: a boundary a certification body will accept, drawn from your real inventory rather than a guess.
OutputA scope statement that survives the opening interview.The AI risk process
Impact assessments and risk treatment your team can repeat without us: bias, safety, transparency, misuse and drift.
OutputA living AI risk register, run at least once for real.Controls and the SoA
The Annex A controls that apply, implemented and mapped to evidence, with every exclusion argued.
OutputA Statement of Applicability an auditor can walk through.The data and model layer
Data provenance, model documentation, human oversight and logging placed in real systems, reusing GDPR and security work already done.
OutputControls that generate their own evidence as AI runs.The running routine
Management review, internal audit and improvement living in diaries rather than in documents, on the cadence the standard expects.
OutputAn AIMS that runs monthly rather than existing on paper.Certification support
An independent, accredited certification body selected, the audits booked, and your team prepared for both stages.
OutputCertification with no surprises in the room.How it works
The route from discovery to certification
Management systems fail as documents and succeed as habits. The AIMS runs for real before the certification body meets it.
Discovery and scoping
The AI estate, the existing management machinery and the gap against the standard, ending in a fixed price for the build.
Design and implementation
Scope, risk process, controls and documentation built with the people who will run them, reusing ISO 27001 machinery where it exists.
The system runs
Impact assessments run for real, reviews held, evidence accumulating: the months that make certification a formality.
Internal audit and review
The mandatory internal audit and management review delivered properly, with findings fixed while there is still time.
Certify and carry on
Both certification stages supported, then the surveillance rhythm handed to your team or run for you.
Timelines depend on the estate and the machinery that already exists: organisations holding ISO 27001 move materially faster, because the shared clauses are reused. The realistic timeline is set at the scoping call, and the system must genuinely operate before the audits.
Published fees
The services around the build
Each service stands alone with its own published fee, and the evidence carries between them.
AI Governance QuickScan
The evidence base the AIMS is scoped from: every use case found including shadow AI, tiered and control-tested, in two weeks.Best whenNobody yet knows the real AI estate. FeeFrom £15,000 + VAT2 weeks 02
EU AI Act Readiness
The Act-specific assessment: roles, obligations and the dates that stand, feeding the AIMS the duties it must carry.Best whenThe Act is the driver and certification the vehicle. FeeFrom £18,000 + VAT4 to 6 weeks 03
AI Governance Office
The standing function that can operate the AIMS after certification: intake, tiering, approvals and board reporting.Best whenNobody will have diary space to run the system. FeeProgrammes from £30,000 + VAT 04ISO 27001 ISMS Foundations
The sibling system: where information security certification is needed too, the shared machinery is built once and reused.Best whenCustomers are asking for both standards. FeeFrom £25,000 + VAT3 to 6 months
The alternatives
This route against the alternatives
Three responses to customers asking about AI governance. The difference is what survives an audit, and what wins the deal.
AI policies and a responsible AI statement, assembled for questionnaires
Documents nobody follows, found out in the first interview
Questionnaires keep getting longer
Holding a line while a real build is planned
Answer security reviews ad hoc and hope certification never becomes a condition
Nothing. There is nothing to audit
The first lost deal names the standard
Organisations whose customers never ask
The management system the standard describes, built to run and to certify
A system that has run: reviews held, risks treated, evidence accumulated
Certified proof before procurement makes it a condition
AI vendors and regulated firms whose customers already ask
Scope
What is covered and what is not
You get
Scope, risk process and SoA built from your real AI estate and argued against your risks.
Controls in real systems, with evidence accumulating as AI runs rather than assembled for audits.
The internal audit and management review delivered properly, with findings fixed in time.
Certification support through both stages, with the body’s fees stated before you commit.
A post-certification rhythm your team runs, or the Office runs for you.
This is not
A documentation pack. The system runs before the audit, because certification bodies audit what happens.
A duplicate of ISO 27001. Shared machinery is reused. Only the AI-specific parts are built new.
A legal opinion on the EU AI Act. The AIMS carries your duties operationally. Certification does not by itself discharge the Act, and we say so.
The certificate itself. An independent, accredited body certifies. Anyone selling the certificate directly is selling something weaker.
Where to start
Typical starting positions
Four situations we are usually called into. If none of them fit, book the scoping call and we will point you at the right first step.
Why Intelance
The standards we hold ourselves to
Built to run first and certify second
Certification bodies audit what happens, and what happens is the evidence. The AIMS operates for real before the first audit, which is what makes Stage 2 a formality.
One management system family
ISO/IEC 42001 shares its structure with ISO 27001, and we run both practices in house, so shared machinery is built once and reused.
Mapped to the Act as amended
The AIMS carries your EU AI Act duties on the post-Omnibus dates, with Annex III obligations at 2 December 2027: one certification cycle away.
Fixed by scope and put in writing
Priced after a scoping call from your real AI estate rather than a guess, with the drivers of the fee stated plainly.
Certification kept independent
An independent, accredited body certifies, with its fees stated up front. We prepare you and audit internally, and we never mark our own homework.
Who delivers this
Every build is led by a senior AI governance lead with ISO 27001 lead auditors beside them. Nothing is offshored and nothing is templated.
AI governance guides
All insights
Ready to talk?
Tell us who is asking for the standard
Thirty minutes with the person who would build your AIMS: who is asking, what AI you run and what management machinery already exists. If ISO 27001 is in place, say so. It usually shortens everything.
FAQs
ISO 42001 questions answered
What is ISO/IEC 42001?
The certifiable international standard for AI management systems, published by ISO and IEC: the AI equivalent of ISO 27001. It defines how an organisation governs AI across its lifecycle, from risk assessment and controls to monitoring and improvement, and it can be certified by an independent, accredited certification body.
What is an AIMS?
An AI management system: the scope, risk process, controls, documentation and management routine through which an organisation governs its AI. The documents describe the system. They are not the system. Certification bodies audit the running, which is why a folder of AI policies fails.
How much does ISO/IEC 42001 implementation cost?
It is fixed by scope after a scoping call and agreed in writing before work starts. The fee is driven by the size of your AI estate, the sectors you operate in and how much management machinery already exists. Organisations holding ISO 27001 reuse the shared clauses and pay for less. The AI Governance QuickScan from £15,000 + VAT sizes the build precisely, and certification body fees are separate and stated before you commit.
How long does implementation take?
It depends on the estate and what already exists, and we give the realistic timeline at the scoping call rather than a number that sells. Two things are fixed: organisations with ISO 27001 in place move materially faster, and the system must genuinely operate before the audits, because that operating period generates the evidence.
Do we need ISO 27001 first?
No, but it helps considerably. The two standards share the harmonised management system structure, so scope machinery, risk method, internal audit and management review carry across. Where both are needed, the shared parts are built once, and where neither exists, the scoping call maps the most economical order.
How does ISO 42001 relate to the EU AI Act?
The Act is law. The standard is a management system. A working AIMS is the natural vehicle for carrying the Act’s obligations operationally, on the dates as amended by the June 2026 Omnibus: transparency duties from 2 August 2026 and Annex III high-risk obligations from 2 December 2027. Certification does not by itself discharge the Act, and anyone claiming it does is overselling.
Who certifies ISO/IEC 42001?
An independent, accredited certification body, never the consultant. We select the body with you, state their fees up front, prepare you for both audit stages and deliver the internal audit separately from the people who built the system.
What is in the evidence pack?
The records the running system generates: impact assessments, risk register entries, control evidence, model and data documentation, review minutes and audit trails, accumulated as the AIMS operates rather than assembled the month before certification. That distinction is exactly what auditors test.
What happens after certification?
Surveillance audits, the annual internal audit cycle and the management rhythm carrying on. Your team runs it by design. Where diary space does not exist, the AI Governance Office or AI Risk-as-a-Service operates it, from £8,000 + VAT per month, with the exit designed in.