AI governance · ISO/IEC 42001 · EU AI Act
AI governance: ISO 42001 and the EU AI Act
Customers are asking how you use AI, and the EU AI Act is coming into force in stages. I build an inventory of your AI systems, classify them against the Act’s risk levels, draft an AI policy with you and measure the gap with ISO 42001.
Who it is for
- Companies building AI into their products or services
- Companies outside the EU whose AI systems are used by European customers: the AI Act applies to them too
- Organisations already certified to ISO 27001 that want to extend their management system to AI
Typical situation
A customer adds an AI section to their security questionnaire, an investor asks how AI is governed, or your legal team starts asking about the AI Act.
Often nobody knows exactly which tools and features rely on AI, or which obligations apply to them.
What I do
A fixed-fee review that ends with a policy and an action plan.
AI system inventory
Listing every use: features of your products and services, in-house models, AI built into the software you use, and generative AI used by staff.
AI Act classification
For each system: your role under the Act (provider, deployer, etc.), the risk level (prohibited, high-risk, transparency, minimal) and the resulting obligations.
AI policy
Drafting a policy for using and building AI: principles, responsibilities, approval of new uses, rules for generative AI.
ISO 42001 gap assessment
Measuring the gap against the standard and its Annex A, reusing your ISO 27001 management system where one exists.
Deliverables
- A register of your AI systems
- The AI Act classification of each system and the related obligations
- An AI policy ready for adoption
- An ISO 42001 gap assessment report
- A prioritised action plan
Format and duration
- Format
- Fixed-fee engagement, fully remote: interviews and workshops by video call
- Indicative duration
- Depends on the number of AI systems; set at scoping
- Fees
- Fixed fee, quoted on requestEstimate the budget for this service
Frequently asked questions
Does the AI Act apply to a company outside the EU?
It can. The Act covers providers that place AI systems on the EU market and cases where the output of an AI system is used in the EU, wherever the company is based. The classification step settles where you stand.
What is the difference between ISO 42001 and the AI Act?
The AI Act is binding EU law. ISO 42001 is a voluntary, certifiable standard for an AI management system. Implementing ISO 42001 helps organise your response to several AI Act obligations, but does not replace them.
Does this replace legal advice?
No. It gives you a technical and operational reading to act on. On sensitive points of interpretation, legal advice is still worthwhile.
First call
In 30 minutes we can list your main uses of AI and the questions your customers are raising, and agree the scope of the work.