AI governance for ISO/IEC 42001 and the EU AI Act.
From simple workflow tools to novel uses of AI: an AI management system you can certify, readiness for the EU AI Act, and scholarship-led risk assessment.
Led by an IRCA-qualified ISO 27001 Lead Auditor and Accredited Legal Technologist, so the management system and the legal reading come from one place.
How we help
Tailored to your organisation, whether you are starting to use AI or refining the governance you already have.
ISO/IEC 42001 implementation
An AI management system made to measure, from gap analysis through Stage 1 and Stage 2 certification audits.
EU AI Act readiness
Benchmarking your AI and products against the Act: classifying each system, confirming your role and closing the gaps before the deadlines.
AI and algorithmic risk assessment
Scholarship-led, research-enhanced impact assessments that identify risks and give actionable recommendations to mitigate them.
AI policies
An internal AI policy that supports your teams, set to your risk appetite, existing workflows and the security and data protection standards of your current tools.
Dark pattern assessments
Reviews of user interfaces and system behaviour to find and fix dark patterns and deceptive outcomes.
Regulatory change and reporting
Analysis and practical guidance on how UK and EU regulatory change affects your AI projects, with reporting tailored to you.
The EU AI Act: what applies when
The Act reaches UK businesses that place AI on the EU market, or whose AI output is used in the EU.
- 2 Feb 2025
Prohibited practices are banned, and AI literacy duties apply to every provider and deployer.
- 2 Aug 2026
Transparency duties apply: disclose chatbots and emotion recognition, and mark or label AI-generated content.
- Now
Meet the duties that already apply, and use the time before the high-risk deadlines to classify your systems and build the evidence.
- 2 Dec 2027
High-risk obligations apply to Annex III systems, such as those used in employment, credit, education and essential services.
- 2 Aug 2028
High-risk obligations apply to AI in regulated products, such as medical devices and toys (Annex I).
Dates follow the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026 and moved the high-risk deadlines. The prohibitions, AI literacy, the obligations for general-purpose AI models (from 2 August 2025) and the transparency duties were not delayed. Providers of generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to mark the content those systems generate.
Getting ready for the EU AI Act
Your obligations depend on two things: the risk tier of each AI system, and your role in its supply chain.
Prohibited
Practices such as social scoring, harmful manipulation and exploiting vulnerabilities. Banned since 2 February 2025.
High-risk
Systems used in areas such as recruitment, credit and education, or as safety components of regulated products. Strict obligations from 2 December 2027.
Transparency
Chatbots, emotion recognition, deepfakes and other generated content must be disclosed or marked. From 2 August 2026.
Minimal risk
Most AI systems. No new obligations beyond AI literacy, though voluntary codes of conduct are encouraged.
How we get you ready
Inventory
We list the AI systems and models you build, buy and use, including AI inside third-party tools.
Classify
We place each system in its risk tier and record the reasoning, including any high-risk exemptions you rely on.
Assign roles
We confirm whether you are the provider, deployer, importer or distributor for each system, since that decides your obligations.
Close the gaps
We plan and support the work: documentation, transparency notices, human oversight, AI literacy and supplier terms.
ISO/IEC 42001 AI management systems
ISO/IEC 42001:2023 is the international standard for an AI management system (AIMS): how you govern, risk-assess and monitor the AI you build or use.
It shares its structure with ISO/IEC 27001 and ISO/IEC 27701, so it extends an existing information security or privacy management system as an integrated management system. ISO/IEC 27001 →
What an AIMS gives you
- An inventory of the AI systems you build and use
- Repeatable, documented AI risk and impact assessments
- Controls across the AI life cycle, data, third parties and use
- Evidence for customers, procurement teams and the EU AI Act
- Independent certification by an accredited certification body
Your route to ISO/IEC 42001 certification
Gap analysis
We assess your current AI governance against ISO/IEC 42001:2023 and agree the scope of your AIMS.
Inventory and impact
We map your AI systems and run risk and impact assessments for each.
Implementation
We co-create the policies, Annex A controls and documentation, and train your staff.
Internal audit
An internal audit and management review confirm the AIMS works before the certification audits.
Stage 1 audit
Your certification body reviews your documentation and your readiness.
Stage 2 audit
Your certification body verifies the AIMS is operational and recommends certification.
Questions we hear most
Something else? It is usually quicker to ask on a discovery call.
Does the EU AI Act apply to UK businesses?
It can. The Act applies to providers that place AI systems or general-purpose AI models on the EU market, wherever they are established, and to providers and deployers outside the EU where the output of an AI system is used in the EU. The UK has no AI-specific legislation of its own, but UK GDPR still applies wherever an AI system processes personal data.
Did the high-risk deadlines move?
Yes. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved the high-risk obligations for Annex III systems, such as those used in employment, credit and education, from 2 August 2026 to 2 December 2027, and for AI in regulated products (Annex I) from 2 August 2027 to 2 August 2028. The prohibitions, AI literacy, general-purpose AI obligations and the Article 50 transparency duties were not delayed.
Does ISO/IEC 42001 certification mean we comply with the EU AI Act?
No. ISO/IEC 42001 is not a harmonised standard under the Act, so certification does not give a presumption of conformity. It does give you the management system the Act expects to see: AI risk and impact assessment, documented controls, human oversight, monitoring and continual improvement. We map it to your AI Act obligations so the same evidence serves both.
We already hold ISO/IEC 27001. How much more is ISO/IEC 42001?
ISO/IEC 42001 uses the same high-level structure as ISO/IEC 27001, so your context, leadership, risk process, internal audit and management review can extend to cover AI as an integrated management system. Most of the new work is the inventory of AI systems, the AI risk and impact assessments, and the Annex A controls for AI.
The standards and laws we work to
Links open the official pages.
Start with a free discovery call.
Talk through your AI systems, your EU exposure and where ISO/IEC 42001 fits, in a free 30-minute discovery call.