Govern / United Kingdom
ISO 42001 implementation
Develop an AI management system that connects intended uses, responsibilities, risk decisions, oversight and evidence across the AI systems in scope.
Last reviewed . Fees in pounds sterling plus VAT.
Make AI responsibility visible, from intended use to operating evidence.
Scope and fee
Agree the work.
Know the boundary.
The written proposal defines the scope, responsibilities, price and delivery timetable.
What shapes your quote
- Number and variety of AI uses and organisational roles
- Availability of supplier, assessment and monitoring records
- Existing governance, specialist dependencies and integration needs
The requirement in context
Build the management system around your role in AI.
ISO/IEC 42001:2023 concerns AI management systems. The UK government’s introduction to AI assurance provides a separate reference for understanding assurance techniques. Neither a management-system certificate nor a supplier’s marketing claim proves that every use of an AI system is suitable.
Inside the work
One business. Two AI uses. Different decisions.
Fictional use-case comparison, not a legal assessment. It illustrates why an AI inventory needs more than a tool name and a licence owner.
| Decision | Drafting assistant | Recruitment-screening tool |
|---|---|---|
| Intended use | Prepare a first draft for a professional to review. | Support screening of applications before a recruitment decision. |
| People and effects | Staff and recipients may rely on inaccurate or inappropriate content. | Applicants may be affected by errors or inappropriate decision criteria. |
| Oversight to define | Who verifies the draft, permitted inputs and escalation. | Who reviews recommendations, handles challenge and authorises changes. |
| Evidence to retain | Approved use, review record, incidents and supplier changes. | Assessment decisions, human review, monitoring and change approval. |
Fictional example · Not a client result, legal determination or complete audit checklist.
Download this working example (CSV)What you take away
Evidence.
Ownership.
A practical next step.
Develop an AI management system that connects intended uses, responsibilities, risk decisions, oversight and evidence across the AI systems in scope.
- AI-system inventory and an agreed AIMS boundary
- Roles, responsibilities and governance arrangements
- AI risk and impact-assessment approach
- Control selection, operating records and supplier interfaces
- Management-review and certification-readiness preparation
How the work moves forward
From the requirement to a usable result.
Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced.
Map the use
Identify systems, organisational roles, affected people and supplier responsibilities.
Make the decisions
Agree risk and impact-assessment methods, oversight and control ownership.
Keep the record current
Operate the controls, assess changes and review evidence before assurance activity.
Your delivery team
Team qualifications
and credentials.
Qualifications, professional credentials and formal training held across Aegentra’s delivery team.
Credentials are held across the delivery team and matched to assigned roles. The proposal identifies the consultants, responsibilities and relevant qualification evidence before work begins.
Management systems and audit
- ISO/IEC 27001 Lead Implementer
- ISO/IEC 27701 Lead Implementer
- PECB ISO/IEC 27001 Lead Auditor
- ISO/IEC 42001 Lead Auditor
- CISA — Certified Information Systems Auditor
- ISM Auditor
Cybersecurity and cloud
- CISSP — Certified Information Systems Security Professional
- CISM — Certified Information Security Manager
- Certificate of Cloud Security Knowledge (CCSK)
- OSCP+ — OffSec Certified Professional Plus
Service delivery and specialist training
- ITIL Expert
- PRINCE2
- Mastering Generative AI for Cybersecurity Certificate
- Essential Eight Assessment Course certificate — TAFEcyber
Further training and audit qualifications
Further training and audit qualifications across the team include ISO/IEC 42001 Lead Implementer training, ASD ISM General and Technical audit codes, ISO/IEC 27017 and ISO/IEC 27018 audit codes, and ISO 9001 and ISO 19011 audit qualifications.
Relevant competence. Clear responsibilities.
For internal audit, competence, objectivity, impartiality and prior involvement are checked before the work is accepted. Implementation, internal audit and independent certification have separate roles.
These are individual qualifications held across the wider team, not a claim that every consultant holds every credential or that Aegentra is an accredited certification body.
Read about our team’s capabilityA practical starting point
Do all AI tools belong in the same scope?
Not automatically. Identify how the organisation develops, provides or uses each system, who is affected, the decisions it supports and where responsibility sits. Document the reasons for the scope and assess interfaces with excluded activities.
A fictional professional-services business uses a drafting assistant and a separate recruitment-screening tool. Their intended uses, affected people and oversight needs differ. An inventory and decision record prevent one generic AI policy from obscuring those differences.
Before you commission the work
Your questions.
Clear answers.
What is included in ISO 42001 implementation?
An agreed engagement can cover the AI inventory, AIMS scope, responsibilities, assessment approach, control decisions, records and readiness work. It starts with the AI systems and uses in your organisation—not a generic AI policy pack.
We only use third-party AI. Is the work still relevant?
It can be. Start by documenting how you use each system and what decisions it supports. Responsibilities as a user differ from those of a developer or provider; supplier evidence does not replace your own decisions.
Does ISO 42001 certification prove legal compliance?
No. It does not replace a separate assessment of applicable privacy, employment, sector or other obligations. Obtain appropriately qualified advice for legal questions; this is not a legal-compliance guarantee.
Can an AIMS build on our ISMS?
Existing document control, risk processes, management review and internal audit may provide a useful starting point. AI-specific responsibilities, impacts and controls still need to be evaluated rather than assumed covered by ISO 27001.
Does every AI tool need the same assessment?
No single assessment depth should be assumed for all uses. Define a method that considers the intended use, affected people, organisational role and risks, and document the reason for the chosen treatment.
Can you guarantee ISO 42001 certification?
No. We can provide agreed implementation and readiness support. Independent certification, its fees and its decision remain separate from consultancy.
Can an AIMS cover AI bought from another supplier?
The boundary should reflect how your organisation develops, provides or uses AI and the responsibilities it controls. For a purchased system, examine intended use, supplier evidence, data handling, oversight and change management rather than assuming the supplier has discharged every responsibility.
What should happen when an AI use case changes?
Record the changed purpose, affected people, organisational role and relevant dependencies. Revisit the assessments, approvals, oversight and monitoring before deployment. A use case previously accepted for internal drafting may need different evidence when it influences customer decisions.
What should we prepare for a scoping conversation?
Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately.
Resources for this decision.
ISO 42001 in the UK: implementation, audit and certificationLet’s define the work you actually need.
Tell us what you need to achieve, what is in scope and where you are starting.
Talk about your project