Build Responsible AI
with ISO 42001

ISO/IEC 42001:2023 is the world's first international standard for Artificial Intelligence Management Systems (AIMS). Published by ISO in December 2023, it provides a certifiable framework for the responsible development, deployment and use of AI. It specifies 38 controls organised into 9 control objectives in Annex A (A.2–A.10), covering AI policy, internal organisation, resources, impact assessment, the AI system life cycle, data for AI, third-party use and information for interested parties.

The EU AI Act is law; ISO 42001 is the management system that operationalises it. The standard's requirements — AI risk and impact assessment, transparency, human oversight, accuracy, robustness, data governance and lifecycle controls — map onto the AI Act's obligations for high-risk systems. Certification does not by itself prove AI Act conformity, but it gives auditors and regulators documented, systematic evidence and closes most governance gaps ahead of harmonised standards.

Organisations that build AI products (LLM apps, ML platforms, AI SaaS, AI agents), companies embedding AI in business-critical or customer-facing operations (fintech, healthtech, SaaS, logistics and cargo, staffing, GTM), EU market entrants, and AI service providers. If you develop, deploy or materially rely on AI systems that affect customers or business decisions, ISO 42001 applies to you.

Auditors verify a complete AI system inventory with documented intended purpose and risk classification for each system, AI impact assessments (Annex A.5) covering affected individuals and society, and evidence of human oversight and accountability. They review the AI policy, data-governance controls for training and operational data, lifecycle controls from design through monitoring and model-drift detection, and your management of third-party and foundation-model dependencies. The AIMS Statement of Applicability and an AI-focused management review are mandatory at Stage 1.

A typical timeline is 8–12 weeks for organisations with basic AI governance already in place: AI system inventory (≈2 weeks), risk and impact assessment (2–3 weeks), controls implementation (≈4 weeks), internal audit (1–2 weeks) and the certification audit (≈1 week). Timeline varies with the number and risk level of AI systems and overall readiness.

ISO 27001 manages information security. ISO 42001 manages AI specifically — AI governance, ethical and responsible AI, bias mitigation, explainability, impact assessment and AI lifecycle risks. They share the same Annex SL management-system backbone, so they integrate cleanly. Many organisations run ISO 27001 as the security baseline and add ISO 42001 for AI-specific governance.

At Tranquility, ISO 42001 engagements are typically ₹1.5–5 lakhs depending on the number and risk level of AI systems and the maturity of your existing governance. This covers consulting (gap analysis, AIMS documentation, AI risk and impact assessments, internal audit) and certification-body coordination; accredited certification-body Stage 1/Stage 2 and surveillance fees are billed separately by the registrar.