AI governance
ISO 42001 — an AI management system that passes the audit
ISO 42001 is the international standard for managing artificial intelligence. It is not about algorithms. It answers a management question: does the organization know where it uses AI, who owns each use, and what happens when something goes wrong.
I implemented the standard at an Israeli technology company, including a full mapping of AI use across the organization. The company passed its certification audit.
The part that actually stalls projects
Most organizations expect the technical controls to be the hard part. In practice, the stage that stalls them is the mapping.
Management almost always discovers more AI in use than it expected — not because anyone hid it, but because AI arrives through plug-ins, through vendors, and through employees who solved a problem for themselves. An honest map is the foundation for everything else, and it is the part an auditor examines most closely. Write the policy before the map and you have written a policy for an imaginary organization.
What the standard requires
- Context and AI policy — what the organization does with AI and where its limits are.
- A map of AI use, including tools introduced through vendors and plug-ins.
- Impact and risk assessment for each use, scaled to its effect on people.
- Controls across the lifecycle: data, training, testing, deployment and monitoring.
- Roles and authority — who approves a new use, and who can stop one.
- Monitoring, internal audit and management review.
Related standards and regulation
| Standard / regulation | What it adds |
|---|---|
| ISO 42001 | The management system itself — the framework you certify against |
| ISO 23894 | Guidance on AI risk management, complementing the management system |
| ISO 42005 | AI system impact assessment — the methodology behind the assessments the standard requires |
| ISO 27001 | The information security baseline the controls sit on |
| EU AI Act | A legal obligation for organizations selling into the European market |
| CSA AICM | The Cloud Security Alliance AI Controls Matrix — 247 controls across 18 domains, mapped to ISO 42001, the EU AI Act and the NIST AI RMF |
| Amendment 13 | Israeli privacy obligations covering the personal data that feeds the models |
What the engagement covers
- Current-state review and a full map of AI use, including tools that did not come through IT
- An AI policy and defined boundaries for approved use
- Impact and risk assessments scaled to the effect of each use
- Building the controls and the documentation the standard requires
- Training the role holders, and an approval mechanism for new uses
- Internal audit and preparation for the certification audit
- Support during the audit and in closing non-conformities
Frequently asked
How long does implementation take?
For a mid-sized organization, four to eight months to the audit. The main variable is how many AI uses exist and how many of them need controls.
We are already certified to ISO 27001. Does that help?
Considerably. Much of the management infrastructure and many of the controls are already in place, and the work concentrates on the AI layer itself.
We only use commercial AI tools. Is this relevant?
Yes. The standard applies to users, not only to developers. Some of the largest risks come precisely from using someone else's tools.
How does this relate to the EU AI Act?
The standard is a management framework you can certify against; the European regulation is a legal obligation. A management system built to the standard makes the regulatory work substantially easier.
Our parent company is abroad. Why a local consultant?
Because the Israeli layer is not automatic: Amendment 13 governs the personal data feeding your models, and local sector regulators have their own expectations. Mapping an international framework onto that layer is most of the work.
Start with a short mapping review
The first step is usually a brief mapping exercise. It establishes how much work is genuinely required before anyone commits to a timeline.