Practical guide / United Kingdom
ISO 42001 in the UK: implementation, audit and certification
Translate an AI customer requirement into an AI management-system boundary. Keep governance, technical evaluation, privacy obligations and independent certification distinct.
Researched 18 October 2026. Examples are original fictional learning aids, not client results or legal advice.
What does ISO 42001 cover?
ISO/IEC 42001 sets requirements for an AI management system. It concerns how an organisation manages responsibilities, risks, controls and improvement in its AI activities. An AIMS certificate is not a declaration that every model output is accurate or that every AI use is lawful. Ask what organisational activities and AI uses the proposed scope covers.
Where should a UK implementation start?
Inventory the intended uses, organisational roles, suppliers, affected people and business decisions supported by AI. Record the customer or procurement requirement and the relevant legal entity. Do not treat an internal drafting assistant and a tool influencing access to employment as interchangeable just because both use the same model supplier.
An original decision example: when the intended use changes
A fictional business starts with an assistant that drafts internal notes. A product team proposes sending generated advice directly to customers. Before approval, the owner records the changed purpose, affected users, data flows, foreseeable failure effects, oversight, evaluation evidence and rollback conditions. The management system needs to connect these decisions; a previous supplier questionnaire is not sufficient evidence that this new use has been assessed.
How does this relate to UK data protection?
Where personal data is involved, assess the relevant data-protection responsibilities separately. ICO guidance explains accountability and the role of impact assessment for AI. Whether a DPIA is required depends on the processing and risk; ISO certification does not replace that assessment or provide blanket UK GDPR compliance. Obtain qualified advice on the actual circumstances, including any overseas obligations.
What should implementation and internal audit produce?
Implementation should connect the scope, responsibilities, assessments, control decisions and usable operating records. Internal audit then evaluates agreed criteria and evidence with competence and impartiality checks. Technical model testing and legal review may require separately scoped specialists. Agree those boundaries in the proposal so that a governance audit is not mistaken for testing all outputs.
What should a buyer verify before commissioning certification?
Ask the proposed certification body about its current accreditation, the applicable scope, assessment arrangements and the evidence it expects. Check any certificate and accreditation claims with the relevant issuing and accreditation bodies. Do not assume every ISO 42001 offer has the same accreditation status. No consultancy can guarantee certification or the certification body’s timetable.