Mi Zhao - Certified ISO 42001 Lead Auditor & Senior Manager
Jack Holmes - Certified ISO 42001 Lead Auditor & Senior Consultant 

We’ve recently seen an increase in interest in ISO 42001 and thought it’s time we share some insights with you! Let's take a closer look at these most asked questions, and how you can get started with ISO 42001.

Where do I start with ISO 42001?
A question we hear from nearly every client before they begin their ISO 42001 implementation journey is: “Where should we start?” While it can be tempting to jump straight into policy drafting or tool selection, our consistent recommendation is to begin by identifying and risk-assessing your key AI use cases.

Why this starting point? Because each compliance activity—from data governance measures to internal controls—will hinge on the assessed risk level of your AI use cases. High-risk applications (e.g., those impacting human safety or personal data privacy) may require more stringent safeguards, while low-risk use cases (e.g., AI tools used internally for non-critical tasks) could be managed with a lighter touch. By mapping out your AI initiatives and understanding their risk profiles early on, you establish a well-informed foundation for all subsequent compliance decisions (e.g., determining the scope of the AIMS, how robust your policies need to be, which controls from Annex A you select, and what training staff require).
In practice, this means:

• Step 1: Linking AI use cases to risks and opportunities (Clause 4.1 and 6.1):
  Your AI use cases should be understood in relation to your external and internal issues. Once you have that context, Clause 6.1 guides you to identify and address risks and opportunities. 
  
• Step 2: Conducting AI System Impact Assessments (Clause 6.1.4):
  As part of risk assessment, the standard encourages impact assessments focused on individuals, groups and societies. For example, if your AI chatbot could influence vulnerable populations, or your facial recognition model might pose bias risks, these impacts must be formally assessed and documented.
  
• Step 3: Determining Scope, Documentation, and Prepare (Clause 4.3 and 7.5):
  Ensure your AIMS scope (Clause 4.3) and all required documentation (Clause 7.5) are well-structured, accessible and consistent with your risk assessments and policies.
  

How do I get ready for the Stage 1 audit? 
The Stage 1 audit is primarily a documentation review, where auditors verify that your organization has the foundational policies, procedures and frameworks in place to support ISO 42001’s requirements.

To help our clients prepare, we provide a detailed list of required documentation well in advance. Some example documents may include:

• AI policy and supporting policies/procedures: Formal statements of intent, outlining how AI systems are selected, developed, deployed, and monitored.
  
• Risk assessment frameworks and completed risk assessments: Templates, methodologies, and documented results of your AI risk assessments.
  
• AIMS scope: Clearly documented scope, indicating the boundaries of the AIMS.
  Statement of Applicability: The list of Annex A controls and their applicability.

Having these documents organized and readily available will make your Stage 1 audit smoother, more efficient and less stressful.

Beyond documentation: operationalizing your policies
One thing to note is that simply having documentation isn’t enough. ISO 42001 audits look for evidence that your organization isn’t just talking the talk—but also walking the walk. In other words, the auditors will want to see that you are operationalizing the policies, procedures and controls you’ve put on paper.

Looking ahead
ISO 42001 can help you work towards a robust and meaningful compliance posture. Remember, the journey doesn’t end at the Stage 1 audit. Stage 2 focuses on how well these controls are implemented in practice, and beyond certification, continual improvement and adaptation to new AI technologies and regulations are paramount.

If you have any questions or need additional support on your ISO 42001 journey, we’re here to help. By starting with a thorough risk assessment, preparing comprehensive documentation and ensuring that your policies truly come to life in day-to-day operations, you’ll be well on your way to achieving ISO 42001 certification and fostering a responsible AI ecosystem in your organization.