AI governance and ISO/IEC 42001
Implement an AI management system your auditors and your engineers can both work with
We help you build and operate an Artificial Intelligence Management System (AIMS) aligned with ISO/IEC 42001, from scoping and readiness to preparing for an independent certification audit.
Know the difference
Readiness, implementation and certification are different things
| Service | What it is | Who does it |
|---|---|---|
| Readiness assessment | An evidence-based view of how your current practices compare with ISO/IEC 42001, with a prioritised plan. | ArniTech |
| Implementation support | Building and operating the AIMS: policies, inventory, risk method, controls, training and internal audit. | ArniTech with your teams |
| Certification | An independent audit that decides whether your AIMS conforms to the standard. | An independent certification body. Not ArniTech. |
No guarantees. We prepare you well, but we do not award ISO certification, influence auditors or promise audit outcomes. ISO/IEC 42001:2023 is a management-system standard. It supports, but does not by itself prove, compliance with any law or regulation.
Why organisations do this
What a working AIMS gives you
One accountable structure
Named owners, decision rights and escalation for every AI system, instead of scattered approvals.
Evidence on demand
Customers, boards and auditors get consistent answers because records are produced as work happens.
Faster, safer adoption
Clear criteria let teams move quickly on low-risk use cases and slow down where it matters.
Engagement stages
Eleven stages: what we do, what you receive, why it matters
Stages can be combined or sequenced to suit your starting point. The first ten are delivered by ArniTech. The eleventh stage prepares you for the independent audit.
01
Discovery, scope and readiness assessment
- What we do
- Workshops with leadership and delivery teams to confirm why you want an AIMS, which AI systems, business units, sites and roles are in scope, and which interested parties and obligations matter. We then run a readiness assessment against ISO/IEC 42001 clauses.
- What you receive
- A scope statement, a readiness report with prioritised findings, and a proposed roadmap.
- Why it matters
- A badly drawn scope is the most common cause of rework. Scope decides cost, effort and what an auditor will examine.
02
AI system inventory and accountable ownership
- What we do
- We help you find every AI system you build, buy or embed, including AI inside supplier products and informal staff use. Each entry gets a named owner, purpose, data, users and supplier.
- What you receive
- An AI system register, ownership matrix and classification approach.
- Why it matters
- You cannot govern what you cannot see. Named owners turn policy into responsibility.
03
Gap assessment against ISO/IEC 42001
- What we do
- We compare your current practices with the standard's management-system clauses and its Annex A controls (38 controls in nine objectives in the 2023 edition), and decide which are applicable.
- What you receive
- A gap register with severity, effort and owner, plus a draft Statement of Applicability.
- Why it matters
- It separates what you already do well from what must change, so effort goes where it counts.
04
AI risk and impact assessments
- What we do
- We design a practical method for assessing risks to the organisation and impacts on individuals, groups and society, then run it on priority systems with your teams.
- What you receive
- A risk and impact assessment method, completed assessments for pilot systems, and a treatment plan.
- Why it matters
- Decisions to deploy or restrict an AI system need evidence, not instinct.
05
AIMS policies, objectives, roles and governance
- What we do
- We draft the AI policy and supporting policies, set measurable objectives, define roles and decision rights, and design a governance forum that fits your structure.
- What you receive
- AI policy set, objectives, RACI, committee terms of reference and escalation paths.
- Why it matters
- Auditors and regulators look for leadership commitment demonstrated in working structures.
06
Control selection, implementation and documentation
- What we do
- We translate selected controls into procedures, checklists, lifecycle gates and evidence your teams can produce in normal work, avoiding paperwork nobody follows.
- What you receive
- Final Statement of Applicability, procedures, templates and an evidence map.
- Why it matters
- Controls matter only when they change daily work and leave a trace.
07
Data governance, suppliers and third-party AI
- What we do
- We review data quality, provenance and use constraints for AI, and design supplier due diligence, contract expectations and ongoing oversight for third-party models and AI features.
- What you receive
- Data requirements for AI, a supplier assessment questionnaire, and a third-party AI register.
- Why it matters
- Much enterprise AI is bought rather than built; supplier risk is your risk.
08
Human oversight, evaluation, monitoring and incidents
- What we do
- We define where humans review or can override AI, how systems are tested before and after release, what is monitored, and how AI incidents are reported, handled and learned from.
- What you receive
- Oversight design per system, evaluation and release criteria, monitoring plan and incident procedure.
- Why it matters
- AI behaviour drifts. Operating controls protect you after launch, not just before.
09
Staff awareness and role-specific training
- What we do
- We deliver awareness for all staff and targeted sessions for owners, developers, reviewers and leaders, using the same platforms your teams use. See our training programmes.
- What you receive
- Training plan, materials and attendance records you can present as evidence of competence.
- Why it matters
- The standard expects people to be competent and aware. Records prove it.
10
Internal audit, management review and corrective action
- What we do
- We train or support your internal auditors, run a mock audit, prepare management review inputs, and set up corrective-action tracking.
- What you receive
- Internal audit programme and report, management review pack, corrective-action log.
- Why it matters
- Finding weaknesses yourself is cheaper and calmer than learning of them during the certification audit.
11
Certification audit preparation and ongoing improvement
- What we do
- We help you choose and brief an accredited certification body, prepare your people and records for the audit stages, and plan improvement after the audit.
- What you receive
- Audit readiness checklist, briefing pack, and a post-audit improvement plan.
- Why it matters
- Certification is a milestone, not the finish. An AIMS has to keep working.
Typical starting points
- You build or embed AI in products and customers are asking for evidence.
- Staff already use generative AI and nobody owns the risk.
- You hold ISO/IEC 27001 and want to extend your management system.
- You want a readiness view before committing to certification.
What happens after you enquire
- You complete a short form. It prepares an email draft to us, and you press Send in your own email app.
- We reply by email to confirm scope questions and arrange a call. We aim to reply within two business days.
- On the call we discuss your AI footprint and goals. You then receive a written proposal and fixed next step, with no obligation.