Systems & standards
ISO/IEC 42001 AI Management Systems Review
Independent review of AI governance, management-system controls, documentation, risk and supporting evidence.
ISO/IEC 42001:2023 · Artificial Intelligence Management System (AIMS)
What it is
AI is moving faster than governance
Artificial intelligence is becoming embedded in products, services, decision-making, operations and internal processes. The governance challenge is no longer simply whether an organisation uses AI. It is whether the organisation can demonstrate that AI-related risks, responsibilities, controls and decisions are being managed systematically.
ISO/IEC 42001:2023 is the world's first international standard specifically for Artificial Intelligence Management Systems. ISO describes it as a management-system standard for establishing, implementing, maintaining and continually improving an AIMS, applicable to organisations developing, providing or using AI systems.
The approach
This is not an AI policy check
A collection of AI policies does not by itself demonstrate an effective AI management system. An AIMS connects leadership, context, risk, objectives, controls, operational processes, monitoring, audit and continual improvement.
DAN AUDITS reviews those connections. The focus is on whether the documented management arrangements are coherent, whether responsibilities and controls are clear, and whether objective evidence supports what the organisation says it does.
The standard
What makes ISO/IEC 42001 different?
- AI-specific governance within a recognised management-system framework
- Risk and opportunity management across the AI lifecycle
- Defined responsibilities for AI-related activities and decisions
- Controls addressing AI-specific considerations such as transparency, accountability and responsible use
- Operational evidence showing how the AIMS works in practice
- Monitoring, measurement, internal audit, management review and continual improvement
Technical capability
Third-party certification-audit experience, with formal ISO/IEC 42001 Lead Auditor training
DAN AUDITS' ISO/IEC 42001 review capability is supported by formal AIMS ISO 42001:2023 Lead Auditor Conversion training, including assessment and examination, together with third-party certification-audit experience.
The review is therefore approached as an independent management-system assessment: examining documented arrangements, controls and objective evidence from the standpoint of a third-party certification audit.
What it is not
Independent review, not certification
- DAN AUDITS does not certify AI systems, issue ISO/IEC 42001 certificates or act as a certification body.
- DAN AUDITS does not make certification decisions or guarantee a certification outcome.
- DAN AUDITS does not build AI models or perform AI safety testing.
- The service is an independent management-systems review.
What we review
- Context and scope. The organisation's AI-related context, interested parties, AIMS scope and boundaries.
- Leadership and governance. Leadership responsibilities, AI policy, accountability, objectives and governance arrangements.
- AI risk management. Identification, assessment, treatment and monitoring of AI-related risks and opportunities.
- AI system lifecycle. How AI-related activities are controlled across relevant stages of development, provision, deployment, use and change.
- AI controls and documented information. Relevant controls, policies, procedures, records and supporting evidence.
- Impact and responsible-use considerations. Where applicable, how the organisation identifies and addresses impacts, transparency, accountability and related AI governance considerations.
- Performance evaluation. Monitoring, measurement, internal audit and management review.
- Improvement. Nonconformity, corrective action, lessons learned and continual improvement of the AIMS.
Typical evidence and documentation
- AIMS scope and organisational context
- AI policy, objectives and governance arrangements
- AI-related roles, responsibilities and accountability
- AI risk assessment and risk-treatment information
- AI system inventories or relevant system information
- AI lifecycle, operational and change-management controls
- Applicable AI impact / responsible-use assessments and records
- Supplier and externally provided AI-related arrangements
- Monitoring and measurement information
- Internal audit and management review records
- Nonconformity, corrective-action and improvement records
What you receive
Clear, practical outputs
- A written independent AIMS review
- Clearly identified findings and points requiring attention
- A structured view of gaps or inconsistencies against applicable ISO/IEC 42001 requirements
- Identification of weaknesses in the connection between AI risks, controls, responsibilities and evidence
- A concise set of areas for your organisation to consider before formal assessment or further system development
Who it is for
Who this review is for
ISO/IEC 42001 can apply to organisations of any size and across sectors where AI systems are developed, provided or used. Typical organisations may include:
- Organisations developing or providing AI-enabled products or services
- Technology businesses incorporating AI into existing products or platforms
- Organisations using AI materially within operational or decision-making processes
- Businesses building an AI governance framework ahead of formal certification
- Organisations seeking independent evidence of the maturity and coherence of their AIMS
- Organisations integrating AI governance with existing ISO 9001, ISO/IEC 27001 or other management systems
Related frameworks
ISO/IEC 42001 alongside ISO/IEC 27001
AI governance and information security are related but distinct management-system disciplines. ISO/IEC 42001 addresses the governance and management of AI, while ISO/IEC 27001 addresses information security. For organisations operating both systems, the two can be considered together without treating one as a substitute for the other.
DAN AUDITS can review the management-system interfaces between AI governance and information security where these fall within the agreed scope.
Why it matters
Why an independent third-party perspective matters
AI governance is developing rapidly, and organisations can accumulate policies and frameworks without a clear management-system structure behind them. A third-party audit perspective asks a different question: can the organisation demonstrate, through documented arrangements and objective evidence, how its AI governance system operates?
FAQs
ISO 42001 review: common questions
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is an international standard specifying requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS).
Who does ISO/IEC 42001 apply to?
ISO states that it is designed for organisations of any size involved in developing, providing or using AI-based products or services, across sectors.
Do we need to develop AI models to use ISO/IEC 42001?
No. The standard is applicable to organisations that develop, provide or use AI systems; it is not limited to organisations building foundation models.
Is ISO/IEC 42001 just an AI policy framework?
No. It is a management-system standard. The review therefore considers the broader system of context, leadership, planning, risk, operation, performance evaluation and improvement.
Can you review an AIMS before certification?
Yes. The review can identify gaps, inconsistencies and evidence issues before a formal third-party assessment. Certification decisions remain with the organisation's certification body.
Do you issue ISO/IEC 42001 certificates?
No. DAN AUDITS is not a certification body and does not issue certificates or make certification decisions.
Do you implement the AIMS for us?
No. The service is an independent review of the management system, documentation, controls and evidence.
Can ISO/IEC 42001 be considered with ISO/IEC 27001?
Yes. They are distinct standards with different purposes, but organisations can integrate or coordinate their management systems where appropriate.
Start with a short intro call
If your organisation is developing, providing or materially using AI, we can first establish whether an ISO/IEC 42001 review is appropriate and define the review scope. Independent, fixed-fee, and commission-free.