Element · 01
Gap Analysis
Assess your current AI governance and evidence against ISO/IEC 42001 requirements. Define system boundaries and prioritize gaps with accountable owners and a practical readiness roadmap.
ISO/IEC 42001AI Management SystemUS & Canada
ISO 42001 Consulting
ISO 42001 Consulting: AI Management System Readiness
Gap analysis, AI management system implementation and internal audit for ISO/IEC 42001 — US & Canada.
US & Canada
Overview
Why ISO 42001 now
Enterprise and regulated buyers are adding AI governance expectations to procurement reviews and vendor contracts.
Organizations developing, providing or using AI may need to demonstrate how they identify AI systems, assign accountability, assess risks and impacts, and monitor controls. ISO/IEC 42001 provides a framework for an AI management system (AIMS) that makes these activities repeatable and auditable. We help you translate applicable customer expectations into a defined scope, working processes and evidence. Requirements vary by buyer, sector and jurisdiction; certification is not a substitute for legal compliance.
What’s included
Our services
Element · 02
AI Inventory & Risk Assessment
Identify AI systems, intended uses, lifecycle stages, suppliers and responsible teams. Assess AI risks in context and document treatment decisions, ownership and review triggers.
Element · 03
AIMS Implementation
Establish policies, roles, AI impact assessments and applicable controls. Integrate lifecycle oversight, data governance, supplier management, monitoring and records into everyday work.
Element · 04
Internal Audit
Conduct an evidence-based internal audit with appropriate independence. Test AIMS implementation, document findings and support corrective action and management review.
Element · 05
Certification Readiness
Review documentation before Stage 1 and operating evidence before Stage 2. Support responses to findings while your accredited certification body independently conducts the audits and decides certification.
Building on ISO 27001
An established ISMS can provide a faster starting point: reuse suitable management-system processes rather than rebuilding them. The effort saved depends on your scope and maturity; AI-specific requirements still need their own assessment and evidence.
Reuse the management-system foundation
Build on document control, assigned responsibilities, internal audit, corrective action and management review where these processes fit your AIMS scope.
Add AI-specific risks and impacts
Extend governance to AI inventory, intended use, affected stakeholders, AI impact assessment and lifecycle controls. Information security controls alone do not cover every AI risk.
Map evidence without assuming equivalence
Map shared controls and records, then identify requirements unique to each standard. ISO 27001 certification does not automatically establish ISO 42001 conformity.
Readiness roadmap
How it works
Four steps to a working AI management system and evidence for an independent certification audit.
- STEP 01Scope & assess
Confirm your AI activities, buyer requirements and current governance. Complete a gap analysis and agree the readiness plan.
- STEP 02Build & implement
Create the AI inventory, assess risks and impacts, assign roles and implement policies and controls with evidence.
- STEP 03Audit & improve
Test implementation through internal audit and management review. Address findings and verify corrective action.
- STEP 04Prepare for Stage 1 & 2
Organize documentation and operating evidence for the certification body. Prepare your team and support finding responses.
Business outcomes
Where the value lands.
- Clear accountability for AI systems and their intended uses.
- Risk and impact decisions supported by documented evidence.
- Repeatable governance for customer and procurement reviews.
- A prepared team and organized evidence for certification audits.
What you receive
Deliverables
- 01AIMS scope, gap analysis and prioritized implementation roadmap
- 02AI system inventory and assigned responsibilities
- 03AI risk assessment, treatment plan and AI impact assessment records
- 04AIMS policies, applicable-control decisions and evidence register
- 05Internal audit report and corrective-action tracker
- 06Management review records and Stage 1 / Stage 2 readiness checklist
Aligned to
ISO/IEC 42001:2023ISO/IEC 27001:2022
FAQ
Frequently Asked Questions
AI management system consulting and certification readiness across the US and Canada.
How long does ISO 42001 readiness take?
The timeline depends on your AI scope, existing governance, available staff and how quickly controls can be implemented and evidenced. A mature ISMS can reduce duplicated work, but AI-specific risk and impact assessments still take effort. We agree a realistic roadmap after gap analysis; certification-body scheduling and corrective action also affect the audit date.
What drives ISO 42001 consulting costs?
The number and complexity of AI systems, your role as developer, provider or user, sites, suppliers, existing governance and remediation needs drive consulting effort. Certification-body audit fees are separate. We review your scope and current maturity before providing a written quote.
Is ISO 42001 the same as EU AI Act compliance?
No — it supports it but is not legal compliance. An AIMS can support governance, risk assessment and evidence relevant to applicable obligations, but ISO 42001 certification does not establish compliance with the EU AI Act or other laws. Legal obligations depend on your AI systems, role and jurisdiction and require a separate legal assessment.
Do you certify?
No — certificates are issued by accredited certification bodies; we prepare you. Jags Assurance supports gap analysis, AIMS implementation, internal audit and certification readiness. The certification body independently conducts the certification audits and makes the certification decision.
Can we build ISO 42001 on an existing ISO 27001 ISMS?
Yes. You can reuse suitable management-system processes and map shared evidence, which may reduce implementation effort. You still need to address AI-specific scope, risks, impacts and lifecycle controls. ISO 27001 and ISO 42001 have distinct requirements and certification decisions.
Request a Quote
Written quote within two business days
Tell us about your AI systems, existing management systems and target audit date. We will provide a written quote within two business days.
Get in touch
Request a QuoteWritten quote within two business days
Tell us about your AI systems, existing management systems and target audit date. We will provide a written quote within two business days.