AI policy
What you will and will not build.
Impact assessment
Each AI system, assessed.
Data and model lifecycle
From training data to retirement.
Human oversight
Who can intervene, and how.
Data and AI ISO 42001
ISO 42001
The management system standard for AI.
- The most practical route to showing responsible AI ahead of the EU AI Act.
- Built on the same structure as ISO 27001.
- Annex A controls
- 38
- Control objectives
- 9
What's in your library.
One system, not two.
Clauses 4 to 10 are shared with ISO 27001. Write them once.
4 to 10shared clauses
38AI controls
93security controls
Monitoring that does not stop at launch.
In October 2026 the UK Government accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare. Regulation is moving from one-off approval towards assurance across a product's whole life.
Performance in use
A monitoring plan for each AI system, with owners and dates.
Managed change
Each model or data change assessed before release.
Clear responsibilities
What the manufacturer holds, and what the deployer holds.
Your path to certification.
1Gap analysisWhere you stand
2ImplementationControls in place
3Internal auditChecked first
4Management reviewSigned off
5Stage 1 auditDocuments
6Stage 2 auditPractice
7SurveillanceEvery year