Put Effective Governance Around the AI Your Organisation Uses

AI Adoption Often Moves Faster Than Governance

Most organisations we speak to are not short of controls. They have information security policies, a procurement process, a data protection function and some form of supplier management. What they usually lack is a consistent way of applying those arrangements to AI.

The pattern is familiar. Copilot is switched on for a pilot group, a CRM supplier enables an AI summarisation feature by default, a product team integrates a language model API, and a department starts using a browser-based tool to draft client material. Each decision may be reasonable on its own. Nobody, however, can produce a single list of what is in use, who approved it, what it is used for and what the organisation's position would be if it produced a harmful or wrong result.

That gap tends to surface when a customer due-diligence questionnaire asks how AI is governed, or when a board member asks the same question after reading about an incident elsewhere. The honest answer is often that it depends who you ask.

Not every use of AI carries the same level of risk, and an AIMS should not treat it as though it does. An internal tool that helps staff summarise meeting notes needs lighter treatment than a system that influences decisions about customers, patients or employees. The point of ISO 42001 is to make those judgements deliberately, record them and revisit them, so they become repeatable and accountable rather than dependent on individuals.

• Identifying which AI systems are actually in use, including features embedded in existing platforms
• Determining the organisation's role in relation to each system
• Assigning an accountable owner
• Evaluating intended use and assessing possible impacts on people
• Approving new use cases against agreed criteria
• Managing third-party AI services through supplier oversight
• Recording risk decisions and the reasons for them
• Monitoring whether systems continue to perform as expected
• Giving interested parties meaningful information about how AI is used

A Managed Route from Initial Scope to Certification Readiness

We run ISO 42001 implementation as a consultancy engagement with defined phases, but the content of each phase is adjusted to the organisation. A twenty-person professional services firm using third-party tools does not need the same documentation set as a software provider shipping AI features to customers, and we do not push both through an identical package.

Phase 1, discovery and scoping. We establish the organisational boundaries of the AIMS, the AI systems that are relevant, internal and external issues, interested parties and their requirements, legal and contractual considerations, and the organisation's role in relation to each system. The scope statement that comes out of this is the decision everything else depends on, so we spend time on it.

Phase 2, readiness and gap assessment. We review existing governance, information security, privacy, procurement, risk management, development and supplier-management practice against the applicable requirements of the standard and Annex A. The output is a gap report that separates what can be extended from what has to be built.

Phase 3, AIMS design. We define governance responsibilities, policy direction, AI objectives, assessment methods, the criteria used to approve or reject AI uses, documentation requirements and the control framework, including the justification for including or excluding each Annex A control.

Phase 4, risk and impact work. We establish practical methods for AI risk assessment, risk treatment and AI system impact assessment, then apply them with the system owners to the systems within scope. This is where the method gets tested; if owners cannot complete an assessment without us in the room, the method is too complicated and we simplify it.

Phase 5, implementation and evidence. We help process owners put the agreed controls into operation and set up records that show approvals, assessments, decisions, monitoring and review actually happening. Evidence is designed to come out of normal work, not to be assembled the week before an audit.

Phase 6, assurance and readiness. We support the internal audit, corrective actions and management review, then complete a certification-readiness assessment and help you prepare for independent Stage 1 and Stage 2 audits.