AI Readiness Academy
How to prepare for ISO 42001
ISO/IEC 42001 is the international standard for AI management systems — a certifiable way to show clients, boards and regulators that AI is governed, not just adopted. This guide explains what it asks for and how readiness work gets you most of the way there.
What ISO 42001 actually is
Like ISO 27001 for information security, ISO/IEC 42001 defines a management system: the policies, roles, controls and review loops an organisation runs so AI is used responsibly. It was published at the end of 2023 and is quickly becoming the reference clients and buyers expect when they ask "how do you govern your AI use?"
It does not tell you which tools to buy. It asks whether you know where AI is used, who is accountable, what the risks are, and whether someone reviews that on a regular loop.
Why readiness comes first
Certification requires evidence that your organisation already runs AI governance as a normal part of operations. Jumping straight to a standards project without the underlying readiness usually fails in the same way: policies nobody follows, an inventory nobody maintains, controls nobody can evidence.
Readiness work builds the substrate the standard sits on — the policy, the named owners, the review loops, the monitoring and incident handling. By the time you engage an auditor, most of the management system already exists.
Five steps to get ready
- 1. Inventory AI use. List every AI tool and use case in the business, including shadow AI. You cannot govern what you have not found.
- 2. Set the policy. A written AI use policy covering approved tools, permitted data and off-limits uses.
- 3. Name the owners. Accountability for AI governance, for each system, and for the review loop itself.
- 4. Build the review loop. Regular checks on vendors, outputs and risks, with incidents logged and escalated.
- 5. Score and plan. Measure your governance readiness formally, then close the gaps in priority order before certification.
Start with the governance gap
Governance is the dimension most SMEs score lowest on, which is why it is where readiness work pays back fastest. Our AI Governance Starter Pack (£195, delivered within five working days) gives you the AI use policy, data-sharing rules, review loops, staff guidance and vendor risk checklist — the practical foundation ISO 42001 expects to see.
Know where you stand first
The free AI Readiness Assessment scores your Governance & Risk dimension and shows how it compares with the other five readiness areas.
Start the free assessment