Advisory

AI governance & ISO/IEC 42001

Organizations need to know where AI and personal data sit in their operations, who makes decisions, and what evidence supports those decisions. We help turn that understanding into repeatable governance.

The mandate

Give AI decisions a durable management system.

Implement an ISO/IEC 42001 AI management system with clear ownership, risk assessment, lifecycle controls, and evidence.

Discuss this work

How we help

  • AI system and use-case inventory
  • ISO/IEC 42001 scope and management system design
  • AI risk and impact assessment
  • Lifecycle controls, monitoring, and records
  • Privacy and data protection alignment

What the work produces

  • An accountable AI and privacy operating model
  • Documented decisions and control ownership
  • A governance roadmap grounded in risk

Delivery

From the first decision to a working program.

Each stage creates an artifact or operating practice the team can use.

01 / 04

Inventory AI use and accountability

Identify internally built, procured, and embedded AI systems; their purposes, affected users, data, owners, and suppliers. Distinguish experimentation from production use.

Output: AI system inventory and governance scope
02 / 04

Design the AI management system

Set objectives, roles, decision rights, risk criteria, policy, and escalation routes for the ISO/IEC 42001 scope. Connect privacy and information security responsibilities without losing AI-specific accountability.

Output: AIMS charter, policy architecture, and ownership map
03 / 04

Control the lifecycle

Define proportionate assessments and records for acquisition, design, evaluation, deployment, monitoring, material change, and retirement. Document impact and risk decisions rather than only technical tests.

Output: AI risk and impact records with lifecycle control plan
04 / 04

Review and improve

Measure whether controls work, investigate incidents and model changes, conduct internal review, and provide management with decisions and corrective actions.

Output: Management review pack and improvement backlog

Common questions

Clarify the mandate before delivery.

Does ISO/IEC 42001 apply only to AI developers?

No. The standard is intended for organizations providing or using AI systems. The appropriate management-system scope should reflect the organization’s role and the AI systems it controls.

Does ISO/IEC 42001 certification prove EU AI Act compliance?

No. ISO/IEC 42001 concerns an AI management system. EU AI Act duties depend on the organization’s role and individual system; they require a separate legal and product assessment.

How does privacy fit into an AI governance program?

Map personal data, purposes, processing roles, retention, supplier flows, and affected people for each use case. Then connect privacy decisions to AI risk, impact, and lifecycle reviews.

Primary references

Related frameworks

Apply it where it matters.

ISO/IEC 42001ISO/IEC 27701

Work with Normstone

Let’s build what stands up to scrutiny.

Tell us what you need to achieve. We’ll help define the right first step.

Start a conversation