Governing AI with ISO 42001: Where to Start

Generative AI has moved from experiment to everyday tool in a very short time. Staff use public assistants to draft documents, analyse data and write code. Business units buy software with AI features built in. Meanwhile regulators, customers and boards are asking a simple question: who is in control?

ISO 42001, the international standard for AI management systems, provides a structure for answering it.

Start with an Inventory

You cannot govern what you cannot see. Begin by listing the AI systems you build, buy and use, including AI features inside existing software and public tools used by staff. For each, record the owner, the purpose and the data involved.

Set Clear Rules for Use

An acceptable use policy for AI is often the fastest win. It should say which tools are approved, what data may never be entered into them and when human review is required. Keep it short and practical.

Assess Risk and Impact

ISO 42001 asks organisations to assess the risks AI systems create and their impact on individuals and society. Consider accuracy, bias, privacy, security, transparency and the consequences of errors. Higher-impact uses, such as decisions about people, deserve deeper assessment.

Connect to What You Already Have

AI governance works best when it builds on existing management systems. Information security, privacy and risk processes can be extended to cover AI rather than duplicated. Organisations already certified to ISO 27001 will recognise much of the structure.

Use Complementary Frameworks

The NIST AI Risk Management Framework, organised around govern, map, measure and manage, is a useful companion to ISO 42001, particularly for risk assessment. Data protection laws such as UAE PDPL also apply wherever AI processes personal data.

Certification Is a Choice, Not a Requirement

Many organisations use ISO 42001 as a governance guide before deciding whether to certify. Certification can be valuable where customers or regulators expect independent assurance. Either way, the discipline it brings is worth having.