Fee
Register to see indicative feesConfirmed in writing after scoping01 / Readiness · Flagship
ISO 42001 Readiness
A customer, an investor or a regulator has asked whether your AI management system meets ISO/IEC 42001, and the honest answer is that nobody has checked.
GovernReadiness
Typical duration
12 to 20 weeksDepending on how many AI systems are in scope and how much governance already existsPrimary artefact
An audit-ready AI management systemPlus five moreWho leads it
Steve SharmaFounder & Principal04 / What this is
What ISO 42001 Readiness is
ISO/IEC 42001 is the international management-system standard for artificial intelligence. It sets out what an organisation must put in place to govern AI responsibly: the policies, the risk process, the roles, the controls and the evidence that all of it is actually operating.
And what readiness produces
This service prepares your organisation to be certified against it by an accredited certification body. It produces an operating AI management system and the evidence pack a stage-1 and stage-2 audit expects to find.
05 / Who it is for
Built for a real assurance trigger, not a badge project.
01
This fits when
- You have AI in production and a customer or investor asking for assurance.
- You have committed to a certification date.
- You are already certified to ISO 27001 and want to extend the management system.
- You are a vendor whose procurement questionnaires now include AI governance questions.
02
The usual trigger
- A procurement questionnaire asked whether you are ISO 42001 certified.
- A board or investor has set a certification target.
- A customer contract now requires demonstrable AI governance.
- You are ISO 27001 certified and the AI questions have started.
06 / The obligation
What ISO 42001 actually requires, clause by clause
Most organisations do not struggle with the decision to pursue ISO 42001. They struggle with everything before the audit: defining scope, interpreting requirements against systems that change monthly, integrating AI governance into a management system that already exists, and building evidence a third-party auditor will accept.
The standard follows the familiar high-level management-system structure, which means an organisation already certified to ISO 27001 has done perhaps half the work without realising it. What is genuinely new sits in the AI-specific clauses and the Annex A controls.
Context and scope
Which AI systems are in the management system, and which are deliberately out. The single most consequential decision in the programme, and the one most often made too late.
AI risk and impact assessment
AI risk assessment and the AI system impact assessment. Distinct from information security risk and frequently conflated with it.
Operational planning and control
The approval gates AI systems pass through before deployment, and the records that prove they did.
Annex A controls
Controls covering data for AI systems, responsible use, third-party and supplier relationships, and the AI system life cycle.
Internal audit and management review
The two clauses most likely to be found immature at stage 2, because they require the system to have been running.
The standard does not ask you to prove your AI is safe. It asks you to prove you have a system that decides what safe means, applies it, checks it, and records what it found.
07 / What you receive
Six artefacts. Each one yours to keep, handed to a named owner.
- 01
AI management system documentation set
Policies, procedures and the statement of applicability, written for your organisation rather than templated.
Document setAI governance owner - 02
Clause-mapped gap register
Every requirement, its current state, the gap, and what closes it, prioritised and effort-estimated.
Spreadsheet + reportYour team and ours - 03
AI risk and impact assessment method
A repeatable assessment process, applied to your in-scope systems as the worked example.
Method + completed assessmentsRisk owner - 04
Internal audit programme and first audit
An audit schedule, the checklists, and one completed internal audit against the standard.
Audit reportManagement review - 05
Certification-body liaison
We prepare the submission pack, attend the stage-1 audit, and manage findings through to stage 2.
Named activityThrough to certification - 06
Management review pack
The agenda, inputs and minutes an auditor expects to see, for the first cycle.
Pack + minutesExecutive team
08 / Scope
The whole system is visible before work begins.
Scoping and context
- In-scope AI systems defined and documented
- Interested parties and their requirements
- Boundaries and exclusions justified
Risk and impact
- AI risk assessment method
- AI system impact assessments
- Integration with existing risk registers
Documentation
- AI policy and supporting procedures
- Statement of applicability
- Records and retention design
Controls implementation
- Annex A control design and gap closure
- Data governance for AI systems
- Supplier and third-party AI controls
Assurance
- Internal audit programme and first audit
- Management review
- Corrective action process
Certification support
- Stage-1 readiness review
- Submission pack
- Stage-2 finding management
09 / Included / not included
A useful boundary is part of the deliverable.
Included
- Scoping and context
- Risk and impact
- Documentation
- Controls implementation
- Assurance
- Certification support
Not included
- We prepare; we do not certify: Certification is issued by an accredited certification body following their audit. We are not one, and we never sit on both sides of that line.
- Certification-body fees: Their audit fees are billed directly by them and are not included here.
- Model development or retraining: We govern and assess AI systems. We do not build, train or fine-tune them.
- Ongoing management-system operation: We hand over an operating system and a named internal owner. Running it afterwards is yours, or a separate retainer.
- ISO 27001 certification: Where an ISMS gap is found, we scope that separately rather than absorbing it silently.
10 / How we do it
Six phases from scope to a certification-ready submission.
Scoping and gap assessment
We establish which AI systems are in scope, then assess every clause and Annex A control against current reality.
Risk and impact method
We build the AI risk assessment and impact assessment process, then run it on the in-scope systems.
Documentation and control design
Policies, procedures, statement of applicability and the control designs that close the register.
Implementation support
Your team operates the system while we support, correct and evidence. This phase cannot be compressed: the auditor needs to see it running.
Internal audit and management review
We run the first internal audit and facilitate management review, then close findings.
Certification support
Stage-1 readiness, submission, and finding management through stage 2.
Mapped againstISO/IEC 42001ISO/IEC 27001ISO/IEC 23894NIST AI Risk Management Framework
11 / Timeline
12 to 20 weeks of work.6 to 9 months to the certificate.
Elapsed time and customer effort are separated because they are not the same number.
Weeks 1 to 3
Scoping, context and the gap assessment
We establish which AI systems are in scope, then assess every clause and Annex A control against current reality.
Customer effort
Two workshops (half a day each), plus document and system access.
Weeks 4 to 7
Risk method built, impact assessments run
We build the AI risk and impact assessment process, then run it on each in-scope AI system.
Customer effort
One workshop per in-scope AI system, roughly 90 minutes each.
Weeks 8 to 12
Documentation and control design
Policies, procedures, the statement of applicability and the control designs that close the gap register.
Customer effort
Review cycles, roughly 4 to 6 hours per week from the governance owner.
Weeks 13 to 18
Implementation support, internal audit, management review
Your team operates the system while we support and evidence it, then we run the first internal audit and facilitate management review.
Customer effort
Your team operates the system; one management review session.
External
Certification body stage-1 audit
Scheduled by the certification body, typically 2 to 4 weeks after readiness.
Customer effort
Certification-body timing; not controlled by us.
External
Certification body stage-2 audit
Typically 4 to 8 weeks after stage 1. Our work runs 12 to 20 weeks. The full path to a certificate is usually 6 to 9 months, because the certification body's audit windows and scheduling sit outside our control, and because an auditor needs to see the management system operating, not just documented.
Customer effort
Certification-body timing; not controlled by us.
Our work: 12 to 20 weeks Typical full path to a certificate: 6 to 9 months
12 / Scope check
Test whether ISO 42001 Readiness
is the right next move.
We will cover likely scope, cost and fit.
Book a confidential strategy sessionWith Steve Sharma, who would lead.13 / Who leads the engagement
Named lead. Direct assessment.
Your ISO 42001 assessment lead
Steve Sharma
Founder & Principal
Runs the gap assessment personally, chairs the management review, and attends both certification audits.
ISO 42001 Lead ImplementerISO/IEC 27001 Lead AuditorCISSP
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Review leadership record14 / Why Cybersecurity Link
Three decisions.
Accountability.
We publish the clause map before you engage.
The gap register structure, the Annex A control list and the audit sequence are all on this page. You can check whether we understand the standard before you pay us anything.
We prepare, and we say who certifies.
We publish that boundary on every page. We prepare you for certification; an accredited body certifies, and we do not certify our own work.
The management system is built to be run by your team.
Every deliverable names the internal owner it hands over to, and that owner is in place and documented before we leave.
15 / The boundary
What this engagement does not claim.
Certification
We prepare organisations for certification. Accredited certification bodies certify.
We prepare organisations for assessment and certification, but we do not certify our own work. We are not a certification body, and we never sit on both sides of that line.
Operations
We are not a managed security service.
We do not run your SOC or monitor your environment.
Engineering
We do not build, train or fine-tune models.
We govern and assess the systems you or your vendors have built.
Frameworks
One management system, mapped across four references.
The work maps to ISO/IEC 42001, ISO/IEC 27001, ISO/IEC 23894 and the NIST AI Risk Management Framework.
16 / Client evidence
What this work produces
Professional services250 to 500 staffAnonymised, permission on file
The challenge
A tier-one client's procurement team introduced an AI governance requirement mid-contract, with a certification expectation attached to renewal.
The approach
More of the work A scoping workshop established that only two of eleven AI touchpoints were material. The management system was built around those two rather than the whole estate, which cut the programme by roughly a third.
17weeks
From engagement to a certification-ready submission, against an internal estimate of a year. Scope discipline did most of that work.
What moves the fee
Number of in-scope AI systems: each additional system inside the certification scope adds to the fee.
Existing management system maturity: where ISO 27001 is already certified.
Evidence readiness: where records must be reconstructed.
Fixed-fee phasesA stated range for implementation supportCertification-body fees excluded and billed by them directly
18 / How this fits
Certification is the end of a governance arc, not the start of one.
AI Risk Assessment
This work usually follows an AI Risk Assessment, which establishes the systems and risks before a certification decision.
AI Security Readiness Assessment
If you do not yet know where you stand, start here. It is cheaper and it prices this engagement.
AI Governance & Responsible AI
If you need the governance without the certificate, this is the same work without the audit.
ISO 27001 Readiness
If the ISMS is not certified either, these are best run together rather than sequentially.
19 / When this is not right
Sometimes the best recommendation is a smaller service, or a later date.
01
You have no AI systems in production yet.
Governance design is more useful than certification readiness.
02
No customer or regulator is asking for the certificate.
The underlying governance work delivers the value without the audit cost.
03
You need certification in under three months.
We would be setting you up to fail. An auditor needs to see the system operating.
20 / FAQ
Questions about ISO 42001 Readiness.
Our work runs 12 to 20 weeks. The full path is usually 6 to 9 months, because stage-1 and stage-2 audits are scheduled by the certification body and because the management system has to be seen operating, not just documented. Anyone promising a certificate in eight weeks is describing documentation, not certification.
No, but it helps considerably. The two standards share the same high-level structure, so an organisation already certified to 27001 has roughly half the management system in place. Where the ISMS does not exist, we scope that separately rather than absorbing it.
No. Certification is issued by an accredited certification body following their own audit. We prepare you for it, we attend, and we manage findings, but we never assess work we have done.
Findings at stage 2 are normal and most are minor. Managing them through to closure is included in this engagement. It is the last phase, not an extra.
Often not. If nobody is asking for the certificate, the governance work underneath delivers almost all of the value at a fraction of the cost and without the audit overhead. We would rather scope you into AI Governance & Responsible AI and say so.
It is handed to a named internal owner, introduced in the first month and documented throughout. If you want us to keep running it, that is a separate retainer and we will say so plainly rather than building dependency into the design.
21 / Next move
If ISO 42001 Readiness is what you need, the next step is a conversation about scope.
A 45-minute conversation about what your scope actually looks like, what it would cost, and whether this is the right service for you at all. With Steve Sharma, who would lead the engagement.