AI Governance
ISO 42001
-
Gap assessment Gap assessment
-
Regulatory implementation Gap closure and evidence
-
Gap assessment + implementation Both services, together−15%
ISO/IEC 42001:2023 · AI management system
Artificial Intelligence
Governance
An AI management system built on ISO/IEC 42001:2023, the first certifiable standard in the world on this subject.
Why this programme
The obligation already exists, even if it does not look like it
There is no need to wait for an AI law: the Law 21,719 already regulates automated decisions on personal data and it is enforceable today. If your organisation uses models that influence decisions about people —selection, scoring, prioritisation, customer service— that obligation applies to you now.
And there is a problem that comes before compliance: almost no organisation knows how many AI systems it has in use. Tools contracted by one area, AI features switched on inside software that was already in use, models connected to production data. The first phase of this programme is usually the most revealing.
ISO/IEC 42001 also allows demonstrate it to a client or a tender, which is where the requirement is appearing before it appears in the law.
Standards and frameworks that integrate
ISO/IEC 42001:2023 — AI management system
ISO/IEC 23894 — AI risk management
ISO/IEC 22989 — concepts and terminology
ISO/IEC 42005 — AI system impact assessment
ISO/IEC 5338 — AI system life cycle
NIST AI RMF 1.0 — risk management framework
EU AI Act — for anyone who exports
How we work
Seven Phases, Concrete Deliverables
Estimated duration of 4 to 6 months depending on the number of AI systems in use.
-
Fase 1 of 7 Diagnosis and scope
An inventory of the AI systems in use, including the ones that came in without approval. A gap assessment against ISO 42001 and a defined management system scope.
-
Fase 2 of 7 AI governance
AI policy, roles and responsibilities, governance committee, objectives and acceptable use policy.
-
Fase 3 of 7 Risk classification
A register of systems classified by risk level according to ISO 23894 and the levels of the EU AI Act, with approval criteria for new systems.
-
Fase 4 of 7 Impact assessment
Assessments under ISO 42005 of the high-risk systems, covering bias, explainability and impact on people.
-
Fase 5 of 7 Annex A controls
Life cycle controls, governance of the training data, management of model suppliers, transparency and human oversight.
-
Fase 6 of 7 Implementation
Support during rollout, training and an evidence file.
-
Fase 7 of 7 Verification
Internal audit, management review and preparation for certification.
What you can engage
Scopes of the Programme
The gap assessment can be engaged on its own. Below, the option of integrating it with Privacy Governance into a single management system, which costs less than running them apart.
ISO 27701 + ISO 42001, integrated
One single project, not 2 por separado
-
Gap assessment Gap assessment−20%
-
Regulatory implementation Gap closure and evidence−20%
-
Gap assessment + implementation Both services, together−15%
How the value is determined
Proposals are quoted in UF, plus VAT. The value of each project comes from four factors:
- Scope: which standards are included, and how many processes, systems and suppliers fall inside the management system.
- Size and sites: people to interview, number of locations, and whether the scope spans more than one country.
- Maturity: how much already exists —policies, records, controls in operation— and how much has to be built from scratch.
- Timeline: the certification or compliance date you need, and the effort it takes to sustain it.
Find out what yours costs, today
Build my quote
Build your scope in the quote builder and get the proposal with figures in UF within 24 business hours. No meeting first, and no details needed until the end.
Next step
Start by Knowing What You Have
A 30-minute call, at no cost. In most cases the first finding is that there are more AI systems in use than the organisation believed.