ISO 42001.The AI management system.Built with your owner.

How the programme runs

Audit-ready in 8 to 12 weeks for a single entity with up to 50 people in scope and a named owner giving about four hours a week. Larger or multi-entity scopes typically take 12 to 24 weeks to audit-ready. The certification body then sets its own Stage 1 and Stage 2 dates. Read more on when it takes longer.

1. Phase 01

   Set the foundation

   AI use across the organisation has never been formally inventoried. Risk classification is informal. Without a documented AIMS scope, every subsequent phase is built on unstable ground. Senior practitioner led scope definition and AIMS boundary work. Governance committee established. AI inventory completed with EU AI Act risk classification. Risk assessment methodology agreed at organisational level.

   • Activity 01. Scope definition and AIMS boundary. Establish framework boundaries and context.
   • Activity 02. Stakeholder identification and governance committee. Identify key players and establish governance.
   • Activity 03. Policy framework and management commitment. Develop overarching policies and secure buy-in.
   • Activity 04. AI inventory and EU AI Act risk classification. Catalogue AI systems and categorise risk levels.
   • Activity 05. Risk assessment methodology and treatment planning. Define risk criteria and mitigating actions.

2. Phase 02

   Run the system

   AI lifecycle management gets treated as engineering hygiene rather than a governed control. Model documentation and human oversight are inconsistent across teams. AI lifecycle controls embedded from design through decommissioning. Model documentation standards deployed across in-scope systems. Human oversight and intervention procedures formalised. AI security and robustness controls are assumed to be covered by general infosec. Bias, explainability, and accuracy testing is ad-hoc rather than systematic. AI-specific security and robustness controls deployed. Bias, explainability, and accuracy testing operationalised in the platform. Evidence collection live. Third-party AI vendor risk is invisible until something fails. AI incident response is improvised because the playbook does not exist. AI vendor and supply chain governance operationalised through the platform's third-party risk module. Incident response procedures specific to AI failure modes documented and tested.

   • Activity 06. AI lifecycle controls. Manage risk from design to decommissioning.
   • Activity 07. Model documentation and transparency. Ensure models are clear and documented.
   • Activity 08. Human oversight and intervention. Maintain proper human control and intervention.
   • Activity 09. Security and robustness controls. Protect systems from attack and failure.
   • Activity 10. Bias, explainability, and accuracy testing. Evaluate models for bias, clarity, and precision.
   • Activity 11. AI vendor and supply chain governance. Manage risks from third-party AI systems.
   • Activity 12. Incident response and breach management. Prepare to detect, report, and manage.

3. Phase 03

   Measure and audit

   Internal audit and management review are under-resourced. Evidence preparation gets rushed in the final days before certification body submission. Internal AIMS audit arranged with an auditor independent of the build. Management review structured to ISO 42001 requirements. Evidence pack audit-ready ahead of Stage 1.

   • Activity 13. Performance monitoring and control effectiveness. Track system performance and control validity.
   • Activity 14. Internal audit programme execution. Conduct comprehensive and objective internal audits.
   • Activity 15. Management review and AIMS performance evaluation. Assess management review and system maturity.
   • Activity 16. Incident handling and corrective action tracking. Investigate issues, find root causes, and correct.

4. Phase 04

   Refine and certify

   Stage 1 corrective actions surface late. Stage 2 timing slips. AIMS handover is documented but not operationalised. Continual improvement programme established. Regulatory horizon scanning operational. Surveillance audit cadence and certificate maintenance schedule confirmed.

   • Activity 17. Continual improvement programme. Systematically identify and act on improvements.
   • Activity 18. Regulatory horizon scanning. Monitor the legal and regulatory landscape for changes.
   • Activity 19. Surveillance audit and certificate maintenance. Undergo surveillance audits to retain certification.

The platform layer

Goldline delivers on your GRC platform of choice, or ours. Platform selection is confirmed at scoping. Goldline remains the senior practitioner delivery layer throughout.

• Native ISO 42001 framework module with structured AIMS controls
• AI-specific risk automation: model drift, bias monitoring, explainability records
• Buyer-facing governance page for AI governance signalling
• Third-party risk module for AI vendor risk management
• Cross-mapped controls between ISO 27001 and ISO 42001 where ISO 27001 is in place

EU AI Act enforcement deadlines

Choose your route

All plus VAT. Half at the start, half on delivery, or spread across the programme in instalments agreed on the diagnostic. Every readiness service, including the First Security Questionnaire, credits in full against a Sprint started within six months.