Blackbox

AI governance, explained simply

What is ISO 42001?

Before you readSee where your business stands now with the free AI risk self-check10 questions, about 2 minutes. You get a score and your gaps by email.

ISO/IEC 42001 is the international standard for managing artificial intelligence responsibly. It was published in December 2023 and is the first standard of its kind. It applies to any organisation that builds, provides or simply uses AI, whatever its size or sector.

It is a management system standard, like ISO 9001 for quality or ISO 27001 for information security. It does not tell you which AI tools to use. It asks you to set a policy, understand your risks, decide who is responsible, and keep improving through a plan, do, check, act cycle. Its annex lists 38 controls under nine headings, from AI policies and impact assessments to data, suppliers and how AI systems are used.

Certification is voluntary and involves an audit by an independent certification body. Most small businesses do not need it. The ideas behind it are useful to everyone, though, and they are what customers, insurers and tender questionnaires are starting to ask about.

A light-touch version for your business

You can put the basics in place in an afternoon, then build on them. These six steps follow the spirit of the standard without the paperwork of a full management system.

  1. 1

    List the AI tools you use

    Include the obvious ones (ChatGPT, Claude, Copilot) and the hidden ones: AI features switched on inside your CRM, accounts software or email. Note who uses each one and what information goes into it.

  2. 2

    Write a one-page AI policy

    Say which tools are approved, what must never be put into them (customer personal data, passwords, confidential contracts) and that a person checks anything AI produces before it goes to a customer.

  3. 3

    Name an owner

    One person is accountable for how the business uses AI. In a small business that is usually a director. They approve new tools and keep the list up to date.

  4. 4

    Check the impact of each tool

    For each one, ask: what data does it see, who could be affected if it gets something wrong, and what would we do then? A few lines per tool is enough to start.

  5. 5

    Check your suppliers

    Read what each AI provider does with your data: where it is stored, whether it is used to train their models, and how to switch that off.

  6. 6

    Review it every quarter

    Put a 30-minute review in the diary. Add new tools, remove ones you have stopped using, and note anything that went wrong and what you changed.

If a customer or tender asks for ISO 42001 certification, you will need the full standard and an accredited certification body. Until then, these steps put you ahead of most businesses your size, and they give you clear answers when someone asks how you use AI.

Next steps: take the AI risk self-check, see what your business could automate safely, or book a call to talk it through.

Source: ISO/IEC 42001:2023, International Organization for Standardization. This page is general guidance, not certification advice.