You can build the core of an ISO 42001 AI management system in about twelve weeks if the scope is narrow. The sequence is: inventory your AI systems, set scope and policy, assess risk and impact, implement controls, run an internal audit and hold a management review. Certification itself needs an external audit that you do not control.
What is ISO 42001?
ISO/IEC 42001 is the international standard for an AI management system, published in 2023. Like other ISO management system standards, it asks an organisation to define its context, show leadership commitment, plan around risks, support operations with resources, operate controls, evaluate performance and improve. ISO's own page was blocked when we tried to fetch it on 18 October 2026, so the clause detail and control list here are kept general. Buy the standard and check wording and annex structure before you commit to a plan.
The calendar below is our planning suggestion, not an ISO timeline. Scope, existing maturity and the speed of leadership decisions change everything.
The twelve weeks
Week 1, context and scope. List the roles you play: building AI products, deploying third party models inside your own services, or using AI tools internally. Decide which are in scope. Name an owner and a sponsor in leadership.
Week 2, AI inventory. Build a register of every AI system, model, dataset and vendor in scope: purpose, owner, inputs, outputs, users, where it runs and whether people are affected by its decisions. Shadow tools such as unapproved chat assistants belong here too.
Week 3, policy and objectives. Draft a short AI policy covering intended use, prohibited use, accountability, transparency and review. Set a handful of measurable objectives, such as every production AI system having an owner and an impact assessment.
Weeks 3 to 4, risk method. Define how you rate AI risk: likelihood, impact on individuals and on the business, and the criteria for acceptable risk. Use the method consistently.
Weeks 4 to 6, risk and impact assessments. Assess each in scope system for bias and fairness, accuracy, security, privacy, transparency and misuse, and for effects on the people it touches. Record decisions, treatments and residual risk, signed by the owner.
Weeks 5 to 8, controls. Implement what the assessments call for: data quality checks, model evaluation before release, human oversight points, logging, access control, monitoring for drift, incident handling for AI failures and supplier due diligence for model providers. Keep a statement of which controls apply, with reasons for exclusions.
Week 8, competence and awareness. Train the people who build, approve and use AI. Record attendance and what was covered.
Week 9, operational documentation. Write the lifecycle procedure: how an AI system is proposed, assessed, approved, deployed, monitored and retired.
Week 10, internal audit. Have someone independent from the work audit the system against your documents and the standard. Record findings and corrective actions.
Week 11, management review. Leadership reviews audit results, risk changes, objectives and resource needs, and minutes decisions.
Week 12, close gaps and prepare for the external audit. Fix findings, freeze a document set and agree dates with a certification body. Expect a documentation stage and an operational stage in the usual ISO pattern, and confirm with the body you choose.
What evidence should you keep?
The AI register, policy with approvals, risk method and every completed assessment, control records such as evaluation reports and monitoring dashboards, training records, audit reports, management review minutes and a corrective action log. Date and version everything.
How does this relate to other rules?
An AI management system is voluntary. It may help you organise work for legal obligations such as those in the EU AI Act, but it does not by itself prove compliance with any law. Ask counsel how the two relate for your products.
Where do teams slip?
- An inventory that misses employees' own AI tool use.
- Impact assessments done once at launch and never refreshed.
- Scoping the whole company when one product line would do.
- Treating vendor model providers as outside the system.
- Skipping the independent internal audit.
- A policy that forbids things the business already does.
What to do
- Pick scope and owner in week one, and write them down.
- Build the AI register from systems and surveys, not memory.
- Draft the policy and objectives, short and testable.
- Choose a risk method and apply it to each system.
- Implement controls the assessments require and record evidence.
- Run an internal audit with an independent auditor.
- Hold the management review and book the external audit.
Quick check
Is ISO 42001 certification mandatory?
No. It is a voluntary management system standard. Customers may ask for it, and it can support work on legal obligations, but it is not itself a legal requirement.
Who certifies us?
An independent certification body audits against the standard. You can prepare yourself, but you cannot issue your own certificate.
Sources
- ISO, ISO/IEC 42001 artificial intelligence management system: blocked when fetched on 18 October 2026, so details need checking against the standard.
How Safeguard helps automate this
AI governance leans on evidence that is easy to lose: inventories, evaluations, approvals, reviews. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code rather than by screenshot, and monitoring runs between audits. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, which helps show which models, libraries and packages sit inside each AI system. The remediation agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and set the approval level. Safeguard helps you prepare and keep evidence ready; a certification body does the audit. Book a call.
Last reviewed: 18 October 2026.
