ISO/IEC 42001 for services companies: what it actually takes

Enterprise customers have started asking a new question in security questionnaires: how do you govern your use of AI? For IT services firms, MSPs and SaaS companies that build AI into their delivery or products, ISO/IEC 42001 is quickly becoming the credible answer.

What ISO/IEC 42001 is

ISO/IEC 42001:2023 is the first international, certifiable standard for an AI management system (AIMS). Like ISO/IEC 27001, it follows the ISO harmonized structure: clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement. An Annex A sets out reference controls, and Annex B gives implementation guidance. Certification is granted by an accredited certification body after a two-stage audit, followed by surveillance audits over a three-year cycle.

Who needs it

• Companies that develop or provide AI-based products or services to other businesses
• Service providers that use AI in client delivery: support triage, code generation, document drafting, analytics
• Companies selling into regulated customers who need evidence of responsible AI, including in the context of the EU AI Act

If you only use a few generic AI tools internally, a lighter AI policy may be enough for now. If customers are asking, or AI touches their data or decisions, 42001 is worth the effort.

What auditors will want to see

Area	Typical evidence
Scope & inventory	An inventory of AI systems you develop, provide or use, and a defined AIMS scope
Leadership	An approved AI policy, AI objectives, assigned roles and responsibilities
Risk	AI risk assessment criteria and results, risk treatment, a Statement of Applicability
Impact	AI system impact assessments covering effects on individuals, groups and society
Lifecycle & data	Documented AI lifecycle, data provenance and quality, supplier responsibilities
Operations	Monitoring, incident handling, information for users, training records
Improvement	Internal audit, management review, corrective actions

How it fits with ISO 27001 and SOC 2

Because 42001 shares the harmonized structure with ISO/IEC 27001, a company that already runs an ISMS can reuse much of its management system: document control, internal audit, management review, risk methodology, supplier management, training. In practice I run SOC 2, ISO 27001 and ISO 42001 as one compliance program with one evidence calendar, owned by the PMO cadence rather than by a once-a-year audit sprint. That approach delivered SOC 2 Type II and ISO/IEC 27001 with zero major nonconformities, and an ISO/IEC 42001 implementation heading into its certification audit.

A realistic timeline

• With ISO 27001 already in place: about 4–6 months to audit readiness
• Starting from scratch: about 6–9 months, longer if AI use is widespread and undocumented

The longest steps are rarely the documents. They are building an honest AI inventory, agreeing on risk criteria, and running impact assessments with the people who own each system.

Five steps to start this month

1. Build an inventory of every AI system you build, provide or use, including SaaS tools with AI features
2. Get an AI policy approved by top management
3. Name an owner for each AI system
4. Run a first AI risk assessment on your two most important systems
5. Decide the scope and target date, and book a gap assessment

Want a quick baseline? Take the free ISO/IEC 42001 Readiness Check. It takes about five minutes and runs entirely in your browser.