How to prepare for ISO 42001 certification

The short answer. To prepare for ISO 42001, start by listing every AI system your business builds, sells or uses, including AI features built into software you already pay for. Then set a tight scope, name an owner and write a short AI policy. Run an AI risk assessment and an impact assessment for each system in scope, and decide which of the 38 Annex A controls apply. After that, run the system for long enough to build up records, do an internal audit and a management review, and only then book the certification audit.

If you're still working out what ISO 42001 is and how it compares to ISO 27001, UK GDPR and Cyber Essentials Plus, start with ISO 42001 vs ISO 27001, GDPR and Cyber Essentials Plus.

First, decide if you need the certificate

There are two ways to use ISO 42001.

Certification. An accredited certification body audits you and issues a certificate. This is worth doing if AI is part of what you sell, if clients or tenders are asking for it, or if you want independent proof that your AI governance holds up.

Alignment. You follow the standard's structure without being audited. For many SMEs that use off-the-shelf AI tools, this gets most of the benefit for much less effort. You can always move on to certification later.

The steps below are the same either way. Certification just means you have to be able to show your work to an outsider.

Step 1: Find every AI system you actually use

This is where most businesses get a surprise. AI usually arrives in three ways:

Tools you chose. ChatGPT, Claude, Copilot, a transcription service.
Features that turned up. AI added to your CRM, accounts package, helpdesk or recruitment platform through an update nobody signed off.
Tools staff chose. Free accounts, browser extensions and note-taking bots joining calls.

For each one, write down what it does, who uses it, what data goes into it, who supplies it and who in your business is responsible for it. This list becomes your AI tools register, which you'll need whatever happens next.

Step 2: Work out your role for each system

ISO 42001 expects controls that fit your role. Roughly, you're either a provider (you build or supply the AI system) or a user (you deploy someone else's system in your business). Many firms are both: a user of Copilot and a provider of the chatbot on their own website.

This matters because a provider has to cover design, training data and testing. A user mostly has to cover selection, configuration, how staff use it and checking the outputs.

Step 3: Set a scope you can defend

The scope says which parts of the business, which AI systems and which locations the management system covers. A tight scope is the most useful decision you'll make. "The AI-assisted client onboarding service" can be audited within months. "All AI use across the group" may never be ready.

Alongside the scope, the standard asks you to record your context: the issues that affect your AI use, such as regulation, client expectations and the suppliers you rely on, and the interested parties whose needs you have to meet. Keep this short and specific.

Step 4: Name an owner and write the AI policy

ISO 42001 asks for visible commitment from the top of the business. In practice that means:

One named senior person who's accountable for the AI management system.
An AI policy, approved by leadership, that sets out how the business uses AI and what it won't do.
Clear roles: who approves new AI tools, who carries out assessments and who staff should go to with concerns.
A few AI objectives you can measure, such as "every AI tool in scope has a completed impact assessment before use".

If you already have an AI usage policy for staff, it's a good starting point. The ISO policy sits above it and sets direction, and the usage policy turns that into day-to-day rules. We cover the wider structure in what is AI governance for UK firms.

Step 5: Run the AI risk assessment

Set out your method first: how you'll judge likelihood and impact, and what level of risk you'll accept. Then apply it to each AI system in scope. Typical AI risks include:

Wrong or invented outputs that someone relies on.
Biased results, for example in shortlisting, pricing or credit decisions.
Client or personal data going into a tool that keeps it or trains on it.
Not being able to explain how a decision was made.
Depending on a supplier who changes the model, the terms or the price.

For each risk, decide how you'll deal with it, then map those decisions to the Annex A controls. The result is your Statement of Applicability: every Annex A control, whether you apply it and why. Auditors read this document closely, so explain any control you leave out.

Step 6: Do an impact assessment for each system

This is the step that sets ISO 42001 apart from other standards. The risk assessment asks what could go wrong for your business. The AI system impact assessment asks what the system could do to the people and groups it affects, such as candidates, customers and the public.

If a system processes personal data, you'll probably need a DPIA under UK GDPR as well. Do the two together, from the same facts, so they don't contradict each other. ISO/IEC 42005 gives detailed guidance on how to structure the impact assessment.

Step 7: Put the data controls in place

For each AI system in scope, you should be able to show:

Where its data comes from and why that source was chosen.
What quality the data has to meet, and how you check it.
How data is prepared, cleaned or labelled before use.
Provenance: a record of where data started and what changed it along the way.

If you only use off-the-shelf tools, most of this applies to what your staff put into them. Your controls are things like which categories of data each tool is approved for, settings that switch off training on your inputs and checks that sensitive data stays out. If you build or fine-tune AI yourself, the full set applies to your training and test data.

Step 8: Bring your AI suppliers into it

Most SME AI risk sits with suppliers. For each AI supplier in scope, check the contract and data processing terms, where data is processed, whether your inputs are used for training, how you'll hear about model changes and what happens to your data when you leave. Ask whether they're certified to ISO 42001 or ISO 27001 and what their certificate actually covers.

Step 9: Train people and keep records

Everyone in scope needs to know the AI policy, what they can and can't do, and how to raise a concern. People who carry out assessments or approve tools need more than that, and you need evidence that they're competent to do it.

Keep documents short. An auditor would rather see a two-page procedure your team follows than a forty-page one nobody has read. What auditors do need is records: completed assessments, approval decisions, training logs, incidents and changes. Records are how you prove the system is running and not just written down.

Step 10: Audit yourself, then review

Before the external audit, you need at least one full internal audit against the standard and a management review where leadership looks at the results, the risks and the objectives. Fix what the internal audit finds and record what you did. A certification body will expect to see this cycle completed at least once.

What the certification audit looks like

Accredited certification happens in two stages:

Stage 1. A review of your documents and readiness: scope, policy, risk method, Statement of Applicability and impact assessments. The auditor tells you about any gaps before Stage 2.
Stage 2. The main audit. The auditor interviews staff, samples records and checks that the controls work in practice.

Certificates normally run for three years, with surveillance audits each year and a full recertification at the end. Check that your certification body is accredited for ISO 42001. In the UK that means UKAS. Bear in mind that an accredited certification body can't also act as your consultant, because that would compromise its impartiality.

Common mistakes

Scoping too wide. Trying to certify everything at once, then stalling.
Treating it as an IT project. Most of the decisions belong to operations and leadership, not the IT team.
Copying the ISO 27001 paperwork. The structure can be reused, but the risks and controls are different. A reworded security risk register won't pass.
Missing embedded AI. AI features inside your CRM, helpdesk or accounts software are AI systems too.
Box-ticking the impact assessment. Auditors can tell when it was written after the decision had already been made.
Booking the audit too early. Without a few months of records, there's nothing to sample.

Where to start this week

Do step 1. Put together the list of every AI tool and feature in use, with what data each one sees. It costs nothing and it's useful whether or not you go for certification. It's often the first time leadership has seen the full picture.

The AI readiness scorecard gives you a quick view of where your governance and security stand. If you'd like the inventory done properly, our AI readiness assessment maps the AI already used in your workflows and what data it touches. That's the same starting point ISO 42001 asks for.

Frequently asked

How long does it take to get ready for ISO 42001?

It depends mostly on scope and on what you already have. A small business with a tight scope, a handful of AI tools and an existing ISO 27001 system is in a very different position from a business starting from nothing. Either way, plan in months, not weeks. The audit needs evidence that the system has been running, and that takes time to build up.

Do we need ISO 27001 first?

No. ISO 42001 stands on its own. Having 27001 does make it much easier, because the risk process, internal audit, management review and document control carry over. Many businesses run both as one combined management system.

Where do we get a copy of the standard?

You buy it. In the UK it's published by BSI as BS ISO/IEC 42001, and it's also sold directly by ISO. Read the standard itself rather than relying on summaries. The auditor will be working from the exact wording.

We only use ChatGPT and Copilot. Is ISO 42001 relevant?

The certificate probably isn't, unless clients are asking for it. The habits are: knowing which tools are in use, what data goes into them, who approved them and how outputs are checked. Following the structure without certifying is a sensible, proportionate step.

Can a consultant guarantee we'll pass?

No, and be wary of anyone who says they can. A consultant can help you scope, build and test the system. Whether it passes depends on whether your business actually runs it, which only you can do.