Title: ISO 42001 implementation > Develop an AI management system that connects intended uses, responsibilities, risk decisions, oversight and evidence across the AI systems in scope. Source: https://aegentra.co.uk/services/govern/iso-42001 Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT. Published: 2026-10-21 Updated: 2026-10-21 Licence: public web content; cite the source URL. Govern / United Kingdom # ISO 42001 implementation Develop an AI management system that connects intended uses, responsibilities, risk decisions, oversight and evidence across the AI systems in scope. Last reviewed 21 October 2026. Fees in pounds sterling plus VAT. [Discuss your scope](https://aegentra.co.uk/contact?subject=ISO%2042001%20implementation) [See a working example](https://aegentra.co.uk/services/govern/iso-42001#working-example) Make AI responsibility visible, from intended use to operating evidence. Scope and fee ## Agree the work. Know the boundary. The written proposal defines the scope, responsibilities, price and delivery timetable. ### What shapes your quote - Number and variety of AI uses and organisational roles - Availability of supplier, assessment and monitoring records - Existing governance, specialist dependencies and integration needs [Request a scoped proposal](https://aegentra.co.uk/contact?subject=ISO%2042001%20implementation) The requirement in context ## Build the management system around your role in AI. ISO/IEC 42001:2023 concerns AI management systems. The UK government’s introduction to AI assurance provides a separate reference for understanding assurance techniques. Neither a management-system certificate nor a supplier’s marketing claim proves that every use of an AI system is suitable. Primary references [ISO: AI management systems](https://www.iso.org/standard/42001) [UK government: introduction to AI assurance](https://www.gov.uk/government/publications/introduction-to-ai-assurance) Inside the work ## One business. Two AI uses. Different decisions. Fictional use-case comparison, not a legal assessment. It illustrates why an AI inventory needs more than a tool name and a licence owner. | Decision | Drafting assistant | Recruitment-screening tool | | --- | --- | --- | | Intended use | Prepare a first draft for a professional to review. | Support screening of applications before a recruitment decision. | | People and effects | Staff and recipients may rely on inaccurate or inappropriate content. | Applicants may be affected by errors or inappropriate decision criteria. | | Oversight to define | Who verifies the draft, permitted inputs and escalation. | Who reviews recommendations, handles challenge and authorises changes. | | Evidence to retain | Approved use, review record, incidents and supplier changes. | Assessment decisions, human review, monitoring and change approval. | Fictional example · Not a client result, legal determination or complete audit checklist. [Download this working example (CSV)](https://aegentra.co.uk/downloads/govern-iso-42001-working-example.csv) What you take away ## Evidence. Ownership. A practical next step. Develop an AI management system that connects intended uses, responsibilities, risk decisions, oversight and evidence across the AI systems in scope. - AI-system inventory and an agreed AIMS boundary - Roles, responsibilities and governance arrangements - AI risk and impact-assessment approach - Control selection, operating records and supplier interfaces - Management-review and certification-readiness preparation ### Separate responsibilities ISO 42001 is a management-system standard, not a blanket legal-compliance certificate or a guarantee that every AI output is safe. Independent certification and specialist legal advice are separate. How the work moves forward ## From the requirement to a usable result. Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced. - ### Map the use Identify systems, organisational roles, affected people and supplier responsibilities. - ### Make the decisions Agree risk and impact-assessment methods, oversight and control ownership. - ### Keep the record current Operate the controls, assess changes and review evidence before assurance activity. Your delivery team ## Team qualifications and credentials. Qualifications, professional credentials and formal training held across Aegentra’s delivery team. Credentials are held across the delivery team and matched to assigned roles. The proposal identifies the consultants, responsibilities and relevant qualification evidence before work begins. ### Management systems and audit - ISO/IEC 27001 Lead Implementer - ISO/IEC 27701 Lead Implementer - PECB ISO/IEC 27001 Lead Auditor - ISO/IEC 42001 Lead Auditor - CISA — Certified Information Systems Auditor - ISM Auditor ### Cybersecurity and cloud - CISSP — Certified Information Systems Security Professional - CISM — Certified Information Security Manager - Certificate of Cloud Security Knowledge (CCSK) - OSCP+ — OffSec Certified Professional Plus ### Service delivery and specialist training - ITIL Expert - PRINCE2 - Mastering Generative AI for Cybersecurity Certificate - Essential Eight Assessment Course certificate — TAFEcyber ### Further training and audit qualifications Further training and audit qualifications across the team include ISO/IEC 42001 Lead Implementer training, ASD ISM General and Technical audit codes, ISO/IEC 27017 and ISO/IEC 27018 audit codes, and ISO 9001 and ISO 19011 audit qualifications. ### Relevant competence. Clear responsibilities. For internal audit, competence, objectivity, impartiality and prior involvement are checked before the work is accepted. Implementation, internal audit and independent certification have separate roles. These are individual qualifications held across the wider team, not a claim that every consultant holds every credential or that Aegentra is an accredited certification body. [Read about our team’s capability](https://aegentra.co.uk/about#team) A practical starting point ## Do all AI tools belong in the same scope? Not automatically. Identify how the organisation develops, provides or uses each system, who is affected, the decisions it supports and where responsibility sits. Document the reasons for the scope and assess interfaces with excluded activities. Fictional working exampleA fictional professional-services business uses a drafting assistant and a separate recruitment-screening tool. Their intended uses, affected people and oversight needs differ. An inventory and decision record prevent one generic AI policy from obscuring those differences. Before you commission the work ## Your questions. Clear answers. **What is included in ISO 42001 implementation?** An agreed engagement can cover the AI inventory, AIMS scope, responsibilities, assessment approach, control decisions, records and readiness work. It starts with the AI systems and uses in your organisation—not a generic AI policy pack. **We only use third-party AI. Is the work still relevant?** It can be. Start by documenting how you use each system and what decisions it supports. Responsibilities as a user differ from those of a developer or provider; supplier evidence does not replace your own decisions. **Does ISO 42001 certification prove legal compliance?** No. It does not replace a separate assessment of applicable privacy, employment, sector or other obligations. Obtain appropriately qualified advice for legal questions; this is not a legal-compliance guarantee. **Can an AIMS build on our ISMS?** Existing document control, risk processes, management review and internal audit may provide a useful starting point. AI-specific responsibilities, impacts and controls still need to be evaluated rather than assumed covered by ISO 27001. **Does every AI tool need the same assessment?** No single assessment depth should be assumed for all uses. Define a method that considers the intended use, affected people, organisational role and risks, and document the reason for the chosen treatment. **Can you guarantee ISO 42001 certification?** No. We can provide agreed implementation and readiness support. Independent certification, its fees and its decision remain separate from consultancy. **Can an AIMS cover AI bought from another supplier?** The boundary should reflect how your organisation develops, provides or uses AI and the responsibilities it controls. For a purchased system, examine intended use, supplier evidence, data handling, oversight and change management rather than assuming the supplier has discharged every responsibility. **What should happen when an AI use case changes?** Record the changed purpose, affected people, organisational role and relevant dependencies. Revisit the assessments, approvals, oversight and monitoring before deployment. A use case previously accepted for internal drafting may need different evidence when it influences customer decisions. **What should we prepare for a scoping conversation?** Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately. ## Resources for this decision. [ISO 42001 in the UK: implementation, audit and certification](https://aegentra.co.uk/knowledge/iso-42001-certification-uk) Choose the right route ## Connected work. Distinct responsibilities. Commission organisational support, build your own knowledge or clarify what a customer has requested. ### Related services [ISO 42001 internal audit](https://aegentra.co.uk/services/govern/iso-42001-internal-audit) [ISO 27001 implementation](https://aegentra.co.uk/services/govern/iso-27001) [ISO 27701 privacy management](https://aegentra.co.uk/services/govern/iso-27701) [AIUC-1 readiness for the agents you sell](https://aegentra.co.uk/services/govern/aiuc-1) ### Develop your knowledge [ISO 42001 lead implementer course & exam](https://aegentra.co.uk/academy/iso-42001-lead-implementer) [ISO 42001 foundation course & exam](https://aegentra.co.uk/academy/iso-42001-foundation) [Read the decision guide](https://aegentra.co.uk/knowledge/course-or-consultancy) ## Let’s define the work you actually need. Tell us what you need to achieve, what is in scope and where you are starting. [Talk about your project](https://aegentra.co.uk/contact)