https://www.oxfordinfosec.com/assets/Iso42001-t55kPl_t.js

1import{j as e}from"./index-rkFokeON.js";import{r as t}from"./faqs-CsY7qeMb.js";import{S as i}from"./ServiceDetailPage-Chdomjga.js";import"./Seo-Dtc4E3wL.js";import"./FaqsArchive-BYb_57qY.js";import"./faqSchema-BDe6oodK.js";import"./zaptic-DmajjgD_.js";import"./Banner-CNPvf9k0.js";import"./FurtherReading-dW9R0Lfh.js";import"./customerLogos-CVY9hGrf.js";import"./pricing-BHeDRPbx.js";import"./check-Dzpfs9c_.js";import"./external-link-DbJ0Tc1n.js";const a={seoRoute:"/services/compliance/iso-42001-ai-management",docsUrl:"https://docs.oxfordinfosec.com/iso42001-artificial-intelligence",hero:{eyebrow:"ISO 42001 - AI Management",headline:"Is our AI",headlineAccent:"governed?",intro:["When you build with AI, deploy it into products, or embed it into operations, enterprise buyers, regulators, and investors start asking how it's governed as well as how it performs.","ISO 42001 is the world's first AI management system standard. We take companies through scoping, implementation, and certification, then maintain the AI Management System so you stay certified through surveillance and recertification audits."],summary:["A credible ISO 42001 certificate, achieved on the timeline your deal or investor needs.","Evidence ready for AI governance questionnaires, mapped to the EU AI Act and what buyers ask.","The AI management system maintained between audits, so the certificate stays valid."]},problemIntro:"The certificate is audited every year, and an AI risk register goes stale faster than most because the tools keep changing. What usually prompts the call:",problems:[{situation:"Buyers ask how our AI is governed",wrong:"Enterprise procurement and investors now ask for AI governance alongside model performance."},{situation:"We've no AI governance lead",wrong:"Implementation stalls and fragments, and non-conformities surface during the audit."},{situation:"We don't track AI's ethical and legal risks",wrong:"Bias, harm, and regulatory exposure go unmanaged until they become incidents."},{situation:"Our data science pipelines keep shifting",wrong:"Evidence gaps open up and nobody owns the controls."},{situation:"The AI rules keep changing",wrong:"The EU AI Act and UK guidance evolve, and controls drift from how you build."},{situation:"Due diligence keeps stalling deals",wrong:"Buyers and investors want proof you govern AI responsibly, and you can't show it quickly."}],howHeading:"How ISO 42001 certification works",phases:[{n:"01",title:"Implementation",duration:"Fixed fee",durationLabel:"Basis",summary:"We confirm scope and accountability, run the AI risk assessment and Statement of Applicability, write the AIMS policies, and support the controls that close the gaps."},{n:"02",title:"Certification",duration:"Stage 1 and Stage 2",durationLabel:"Milestone",summary:"We run the first internal audit and management review, clear the readiness findings, and take you through the Stage 1 and Stage 2 certification audit."},{n:"03",title:"Maintenance",duration:"12-month minimum",durationLabel:"Minimum term",summary:"We keep evidence, AI risks, and policies current and liaise with the certification body, so you pass surveillance and recertification audits without a last-minute rebuild."}],howClose:"Accredited ISO 42001 certification is still young: budget for the audit in the same territory as an ISO 27001 audit, and get more than one quote.",assessHeading:"What we put in place",assessIntro:"Each requirement is mapped to a real business process and justified in the Statement of Applicability. If a clause doesn't apply, we mark it not applicable in the Statement of Applicability.",assessAreas:["AIMS scope and accountability","AI asset and stakeholder mapping","AI risk assessment and Statement of Applicability","Responsible AI policy and objectives","Data governance and model lifecycle controls","Human oversight and explainability","Bias and robustness testing","Model register and data provenance","Incident handling for AI","Supplier and model marketplace assurance","Staff AI governance awareness and training","Internal audit and certification readiness"],fitFor:[{label:"2 to 250 users",text:"established enough to face AI governance demands, small enough that an enterprise template wouldn't fit"},{label:"Building or deploying AI",text:"developing models, embedding third-party AI 

1into products, or using AI in regulated decisions"},{label:"UK or EU",text:"subject to the EU AI Act, UK AI Code of Practice, or sector-specific AI guidance"},{label:"Under external pressure",text:"AI governance questionnaires, investor due diligence, or contractual AI obligations"},{label:"Baseline security in place",text:"ISO 42001 assumes the security fundamentals already exist"}],notIncluded:["Hands-on engineering (your team enables controls)","Remediation actions you own and deliver","Foundational security hardening (Security Foundations covers this)","Travel and on-site costs unless pre-agreed","Strategic security leadership (that's the vCISO service)"],deliveryParagraph:"You work with a named Lead Consultant whose AI governance credentials are recognised (ISO/IEC 42001 Lead Implementer or Auditor, CIPP/E, CISSP). They are your single point of contact, accountable for delivery. Where it helps, we pair them with a compliance automation platform such as Drata, configured with a custom ISO 42001 control library, so evidence like model cards and bias test reports is collected continuously and your status shows on a live dashboard.",pricingHeading:"Term and pricing",pricingRows:[{phase:"Phase 1: Implementation",term:"One-off",pricing:"Fixed fee"},{phase:"Phase 2: Maintenance",term:"12-month minimum",pricing:"Recurring fee, renewable annually"},{phase:"With ISO 27001, vCISO, or DPO",term:"Optional",pricing:"Can be combined where it makes sense"}],pricingNote:"Exact figures depend on your size, your starting point, and how much needs putting in place.",faqsTitle:"ISO 42001 FAQs",faqs:t,furtherReading:["guide-to-iso-42001","ai-management-system","ai-governance-framework","compliance-platform-vs-consultant","guide-to-iso-27001","cyber-security-risk-assessments","cyber-security-audits-small-businesses"],banner:{title:"See whether ISO 42001 is the right move.",text:e.jsx("p",{children:"If a buyer or investor has asked how your AI is governed, a short call will tell you whether certification is worth pursuing now, or whether an AI policy and a risk assessment would do for the time being."})}};function f(){return e.jsx(i,{content:a})}export{f as default};