Risk assessment of AI systems
We map where and how AI is used and assess the risks – including data leakage, model misuse and vendor dependency.
ISO/IEC 42001 · AI
ISO 42001 and AI security – adopting artificial intelligence responsibly
An AI management system per ISO/IEC 42001: risk assessment of AI systems, defining roles and accountability, managing data quality, and impact assessment. Suitable for both AI users and AI developers.
Who it is for
Who this service is for
- Companies adopting artificial intelligence that want to do it in a controlled way
- Developers of AI solutions whose clients ask for evidence of responsible development
- Organisations that already have ISO 27001 and want to add AI governance
- Managers who need clarity on which AI risks their company actually carries
What is included
What the service includes
Defining accountability and roles
Who decides on adoption, who is accountable for the output, who steps in when something goes wrong. Without this there is no management system.
Managing data quality and provenance
Which data the model runs on, where it comes from, and whether it may be used for that purpose.
Impact assessment
Impact on people and the organisation, including ethical and societal risks – the backbone of ISO 42001.
AI use policy and guidelines
Practical rules for staff: what may be entered into AI tools, what may not, and how to check the output.
Preparation for the ISO 42001 audit
Documentation, internal audit and management review for the certification audit.
Process
How we work
Mapping AI use
Before a policy, you need to know what is actually in use – including tools nobody formally approved.
Risk and impact assessment
For each AI system we assess risks and impacts – not only technical, but ethical and legal as well.
Building the management system
Roles, decision points, controls and documentation in the ISO/IEC 42001 structure.
Implementation and training
Rules only reach people if they are explained. We train the team.
Internal audit and audit
We verify that it works and prepare for the certification audit.
Outcome
What you end up with
- A register of AI systems with risk assessments
- AI management system (AIMS) documentation
- Roles and accountability set out in writing
- An AI use policy and staff guidance
- An impact assessment methodology and completed assessments
FAQ
Frequently asked questions
What is ISO 42001?
ISO/IEC 42001 is the management system standard for artificial intelligence. Structurally it resembles ISO 27001, but focuses on AI-specific topics: accountability, data provenance, model impact and transparency.
We don't build AI, we only use existing tools. Does this concern us?
Yes. Most risk arises in use – what data goes into the tool, who checks the output, and who is accountable when a decision turns out to be wrong. For a user the management system is simpler, but still necessary.
Is ISO 42001 related to the EU AI Act?
They are separate: the regulation is law, the standard is a voluntary management framework. In practice, a system built to ISO 42001 covers a significant part of what the regulation expects in terms of risk management, documentation and oversight.
Can we combine ISO 42001 with our existing ISO 27001?
Yes, and that is usually the most sensible route. A shared management system structure, risk methodology, internal audit and management review – with the AI-specific part added on top.
Adopting AI? Let's start with the mapping
Before policies and certificates, it is worth knowing what is already in use in your organisation and what risks come with it.
See also
Related services
ISO 27001 consulting
Preparing your company for the ISO 27001 audit.
Read more →Information security manager (CISO) as a service
Professional information-security leadership as a service – for companies that don't need a full-time security manager.
Read more →Information security audit and assessment
Independent assessment and an audit-readiness check.
Read more →