ISO/IEC 42001 Readiness: From AI Policy to Evidence of Practice

Published by Horus Consultancy · About us

Preparing for ISO/IEC 42001 means establishing an AI management system that works in practice and gathering evidence of how it operates. Buying a policy template or assembling a document folder is only a small part of that work.

ISO/IEC 42001:2023 sets requirements for establishing, operating, maintaining and improving an AI management system. It applies to organizations that develop, provide or use AI. This article offers preparation questions; use the actual standard and the agreed audit criteria for a complete assessment.

Start with a scope you can explain

Identify the organizational units, activities and AI uses you intend to include. Explain the boundaries and interfaces, including third-party services. A scope that says only “all AI” may be difficult to interpret if the organization has not yet identified its systems and responsibilities.

For a company using a purchased assistant, useful questions include who controls configuration, what information is supplied and which decisions depend on its output. Outsourcing the technology does not remove the need to understand the organization’s own responsibilities.

Turn commitments into working arrangements

For each important commitment, ask who carries it out, when it happens and how it is recorded. If a policy says that new AI uses require approval, follow one recent request and inspect the decision. If it promises oversight, identify the actual review activity and what happens when reviewers disagree with the system.

Organize an evidence trail

The following are practical examples to discuss during readiness work, not a substitute for the standard’s requirements:

• A current inventory tied to named owners and the management-system scope.
• Records of risk and impact considerations for relevant use cases.
• Supplier assessments and decisions about acceptable use.
• Testing, operational monitoring and escalation records.
• Training or awareness activities appropriate to people’s responsibilities.
• Management decisions, audit findings and follow-up on improvements.

Prefer a traceable story from decision to operation over disconnected screenshots. State the period covered, the source of the evidence and any known limitations.

Use internal review to expose gaps

A useful readiness discussion asks whether the documented process matches daily work. If exceptions are common, examine why. If actions are overdue, agree realistic ownership and priorities. Do not rewrite historical records to create the appearance that a process existed earlier.

Keep certification arrangements independent

Horus Consultancy can discuss readiness and internal audit support. Any external certification route must be agreed separately with the certification body, including competence, scope and impartiality checks. Certification decisions belong to that body. A readiness review does not guarantee certification.

Does certification prove that every AI output is safe?

Do not interpret management-system certification as a guarantee about every output, every use case or compliance with every applicable law. Evaluate the certificate’s scope and continue to manage operational risks.

Can existing governance help?

Yes. Existing risk, document-control, audit and management-review practices can provide a starting point. Check whether they address the characteristics of your AI uses instead of simply relabelling existing documents.

Related guidance

• AI Governance: A Practical Starting Plan for Your Organization
• AI Risk Management: Build a Risk Register Around Real Use Cases
• ISO/IEC 27001 Internal Audit: Preparing Evidence and Closing Gaps
• ISO/IEC 20000-1 Readiness: Connect Service Management to Evidence

Discuss your next step

Horus Consultancy provides IT GRC consulting and internal audit support for organizations in North America and the Gulf, with a physical base in Canada. Explore our services, read our FAQ, or book a call with Islam Elzayat. For professional education, visit Horus Academy.