02 / Compliance and certification
ISO/IEC 42001, a management system for the machines that decide
We help you put an AI management system around the AI you build, buy or use, with risks, impacts and responsibilities written down and audited.
Overview
What ISO/IEC 42001 asks of you
ISO/IEC 42001 is the international standard for an artificial intelligence management system (AIMS). It applies to organisations that develop, provide or use AI systems, and asks for a defined scope, an AI risk assessment, an assessment of the impact AI systems can have on people and society, and controls to treat what you find.
Its structure will look familiar if you run ISO/IEC 27001: clauses for the management system, an annex of controls, and a Statement of Applicability to record which apply. The content is different. It covers data used by AI systems, the AI system life cycle, transparency towards users and the use of third-party AI.
Certification is issued by an accredited certification body. Black Fox prepares you, tests the security of the systems involved where you want that too, coordinates the audit with our long-standing certification partners or a body of your choice, and supports you through it.
Who it is for
Organisations that build AI into their products, providers whose clients ask how their AI is governed, and companies that use third-party AI in decisions that affect people. It is also a structured base for preparing for obligations under the EU AI Act.
The work, from scoping to evidence.
What we do
Inventory and scope
We list the AI systems you develop, provide or use, your role for each, and decide what the AIMS covers.
Gap assessment
A review against the clauses and Annex A controls, with findings ranked by risk and effort.
AI risk and impact assessment
A method for AI risks and for the impact of AI systems on individuals and groups, applied to your systems and kept up to date.
Controls and Statement of Applicability
Each Annex A control considered, with a justified decision and a pointer to its evidence.
Policies and life cycle
An AI policy, roles and procedures for data, development, deployment, monitoring and third-party AI, integrated with your ISMS where you have one.
Internal audit
An internal audit of the AIMS, independent of the people who built it.
How the engagement runs
Kickoff
We agree the scope, the people involved and the deadline, and sign an NDA first if you need one.
Inventory and gap assessment
Interviews, document review and a walk through your AI systems, ending in a prioritised gap report.
Implementation support
We work with your owners on risk and impact assessments, controls, documents and evidence.
Internal audit
A full internal audit against the standard, run like the real one.
Certification audit
We coordinate the audit with one of our long-standing certification partners or the accredited body of your choice, help you prepare and help with any findings that follow.
What you receive
- Inventory of AI systems and AIMS scope statement
- Gap assessment report with a prioritised action plan
- AI risk assessment and AI system impact assessments
- Statement of Applicability with evidence references
- AI policy and supporting procedures
- Internal audit report
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Does ISO/IEC 42001 certification mean we meet the EU AI Act?
No. They overlap in places, such as risk management, documentation and human oversight, but the regulation has its own obligations depending on your role and the risk class of each system. The standard gives you a management system to carry that work.
We only use AI tools, we do not build them. Is it relevant?
It can be. The standard applies to organisations that use AI systems as well as those that develop or provide them. Your controls then focus on selection, use, oversight and suppliers.
Do you issue the certificate?
No. Certificates come from accredited certification bodies, independent of whoever helped you implement. We prepare you, coordinate the audit with one of our long-standing certification partners or a body of your choice, and support you through it, so you go from preparation to the certificate in one engagement.
Can it share a management system with ISO/IEC 27001?
Yes. Both follow the common structure ISO uses for management system standards, so much of the system can be shared. The AI-specific risks, impacts and controls still need their own work.
Related services
- Compliance and certificationEU AI ActEU AI Act support from Black Fox Security: AI system inventory, risk classification, governance and documentation for high-risk systems, and security testing.
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Advisory and responseDevSecOps and secure developmentDevSecOps from Black Fox Security: secure SDLC, threat modelling, code review, security in CI/CD, dependency and secret scanning, and developer training.
- Governance and riskSecurity risk assessmentInfrastructure, network and application risk assessment by Black Fox Security: probability versus severity, a risk register your owners use and treatment options.
Start with the list of what your AI actually does
Tell us which AI systems you build, sell or use. We will show you what the standard expects of each.