ISO/IEC 42001 is the international standard for managing AI responsibly. It shows customers, insurers and regulators that you know which AI you use, what could go wrong and who is accountable, and that the controls behind it actually work.
Every client we have taken through an accreditation has achieved it - and kept it at every renewal.
We submit ourselves to independent third-party testing. Certification is always issued by an independent body, never by us.
We prove each control works on your real devices and services. Questionnaire answers can be inaccurate or optimistic; tests cannot.
We will look at your current position for free and tell you exactly which controls you need - with no obligation.
ISO/IEC 42001:2023 sets the requirements for an AI management system (AIMS). Like ISO 27001 it follows clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation and improvement), supported by 38 Annex A controls covering AI policy, roles, resources, impact assessment, the AI system life cycle, data, information for users, responsible use and suppliers.
It applies whether you build AI or simply use it: Microsoft Copilot, ChatGPT, AI features inside your software, or private AI running on your own hardware. Certification is by an independent, accredited certification body through a two-stage audit, with annual surveillance audits.
Most businesses are not ready yet, and very few have even started. Getting your AI governance in order now puts you ahead of your competitors, your customers' supplier questionnaires and the regulation that is coming.
A board-approved AI policy, named owners for each AI tool and a simple way for staff to raise concerns.
A register of every AI tool, model, data source and integration in use, approved before it goes live.
A repeatable assessment of what each AI use could mean for your customers, staff and business.
Knowing which data each AI tool can reach, where it is processed, and keeping sensitive data out of public models.
MFA, conditional access and device health checks so only the right people, on trusted devices, use AI with company data.
AI systems logged and monitored, with incidents detected, handled and reported.
Every AI vendor assessed: where the data goes, whether it trains their models, and who is responsible for what.
Staff trained on safe AI use, with self-connected AI apps blocked until they are approved.
ISO 42001 is delivered in partnership. Each part is done by the people best placed to do it, and nobody audits their own work.
Builds the AI management system with you: the AI policy, scope, risk and impact assessments, internal audit and management review. A specialist in the standard.
Provides and runs the AI controls every day: the AI register, access and device controls, data protection, monitoring, supplier checks and staff training. The evidence the auditor asks for.
Approve the policy, own each AI tool and make the decisions on how AI is used in your business, using our templates.
An independent, accredited body audits you and issues the certificate. Never us and never our partner.
Every Annex A control area, and the Total Group service that provides it. You can start with the controls today and certify when you are ready.
| ISO 42001 control area | What we provide |
|---|---|
| AI policy and roles | AI usage policy, named owners and a route to raise concerns |
| Resources and inventory | The AI register: every tool, model, data source and integration |
| Impact assessment | Assessments stored against each AI tool in the register |
| AI system life cycle | Sign-off before deployment, documentation, testing and monitoring |
| Data for AI | Data mapping, private on-premise AI, email security and backup |
| Access to AI | Total MFA, conditional access and Microsoft Entra management |
| Monitoring and incidents | 24/7 SIEM with a human-staffed security operations centre |
| Responsible use | Staff training and self-connected AI apps blocked until approved |
| AI suppliers | Vendor review of Copilot, ChatGPT and AI features in your software |
Related: Total MFA · managed cyber security · private AI hardware · ISO 27001
We review your devices, cloud services and processes against ISO 42001 and show you where you stand.
We fix or guide you through every control that would fail, in priority order.
We prove each control works - scans, patch checks, malware tests, restores and MFA checks - before anyone else looks.
An independent assessor, auditor or certification body confirms it. We never certify our own work.
We monitor your controls in real time and fix drift as it happens, so renewal is a normal day, not a cliff edge.
Our own intellectual property is how we run compliance: we monitor the major ISO 42001 controls in real time using the leading enterprise SaaS tools. That lets us map gaps and bridge controls quickly and accurately while you work towards accreditation - and then keep standards up, and risk down, every day after it.
We watch the major controls continuously using leading enterprise SaaS security and compliance tools - not once a year with a questionnaire.
Live data shows exactly which controls are missing or drifting, so we can map the gaps and bridge them quickly and accurately.
Every change to your systems follows a compliant change process, so an upgrade or a new starter never quietly breaks a control.
Issues are picked up and fixed as they happen. Your risk goes down over the year instead of creeping up until the next audit.
Annual review is not viable in the current threat landscape. Attackers do not wait twelve months - so neither do we.
Certification is a snapshot. Our compliance plans keep the controls tested, the evidence current and renewals handled - Level 1 demonstrates, Level 2 practises and Level 3 proves compliance continuously.
Online ordering is temporarily unavailable - please call 01727 881 224.
No, and nobody who helps you prepare should. We provide and run the AI controls, our specialist ISO 42001 partner builds the management system with you, and an independent accredited certification body carries out the audit. We never mark our own homework.
Yes. The standard covers organisations that use AI as well as those that build it. Using AI tools with company or customer data is exactly where governance matters most.
They share the same management system structure, so if you hold ISO 27001 much of the framework is already in place. ISO 42001 adds AI-specific controls such as impact assessments, the AI life cycle and data used by AI.
For a small or medium business, typically four to nine months from the first assessment to certification, depending on how much AI you use and how mature your security already is. Many start with the controls and certify later.
No. Many businesses adopt ISO 42001 as their framework and run the controls first, then certify when a customer or tender asks for it. Our controls are designed to be audit-ready from day one.
Running AI on your own hardware means your data never leaves your building and is never used to train someone else's model, which takes a whole set of data and supplier risks off the table.
We monitor the major controls in real time using leading enterprise SaaS tools, with compliant change management behind every change. Gaps are found and bridged quickly, standards are maintained every day, and accreditation stops being a fraught cliff edge - you can say you were compliant yesterday, not a year ago.
Controls drift: devices miss patches, accounts change, new services appear. With an annual review that drift goes unnoticed for months while risk rises. Real-time monitoring catches it as it happens, so issues are fixed quickly and your compliance improves rather than decays.
Book a free, no-obligation ISO 42001 assessment. We will show you which controls you already meet, which you need, and the quickest route to getting certified.
Loading secure payment form...
🔒 Secure payment by Stripe. Change your details
