ISO/IEC 42001 is the international standard that defines an AI management system (AIMS): auditable AI policy, risk management, lifecycle governance and accountability. Berghem prepares your organization for certification — from gap analysis to internal audit — integrating the standard into your security and compliance program.
ISO/IEC 42001 is the first international standard for an AI Management System (AIMS). It defines requirements to govern the AI lifecycle responsibly — policy, impact assessment, Annex A controls and continual improvement — letting organizations demonstrate trustworthy, auditable use of AI and pursue accredited certification.
Unlike a one-off technical checklist, an AIMS is a management system: it defines how the organization governs AI end to end, produces auditable evidence and sustains certification by an accredited body. Berghem builds that system and connects it to your AI offensive-security work, ensuring governance on paper matches how models and agents actually behave in production.
The path to ISO/IEC 42001 is a management-system project, not an isolated test: gap analysis › AIMS implementation › internal audit › Stage 1 › Stage 2 › maintenance. We run the phases that take you from the current state to certification-audit readiness.
We assess your current AI governance maturity against ISO/IEC 42001, mapping gaps in policy, risk, documentation and operational controls. The output is a gap report prioritized by effort and risk, with an adequacy roadmap.
We define scope, AI policy, roles and responsibilities, objectives and the AIMS documentation structure — tailored to your context as an AI provider, integrator or user, and aligned to business goals rather than a generic model.
We stand up the AI risk-assessment process and the AI system impact assessment required by the standard. Every model, agent or use case gets documented, treated and re-evaluated risk across its lifecycle.
We operationalize the Annex A controls, produce auditable evidence and run the internal audit that precedes the certification body. We close nonconformities before the Stage 1 and Stage 2 audits, reducing the risk of failure.
ISO/IEC 42001 follows the high-level structure (HLS) shared by ISO management-system standards. The auditable requirements sit in clauses 4 to 10 — context of the organization, leadership, planning, support, operation, performance evaluation and improvement — the same backbone as ISO/IEC 27001.
Annex A of ISO/IEC 42001:2023 lists 38 controls, grouped into control objectives, which the organization selects and justifies in a statement of applicability based on the AI risks identified. Berghem maps every clause and Annex A control to your context, producing the evidence the certification body requires.
ISO/IEC 42001 organizes AI governance around a set of domains reflected in the Annex A controls. We build each one with policy, process and evidence.
A leadership-approved AI policy with objectives, responsible-use principles and a commitment to continual improvement — the foundation of the management system.
A formal process to identify, analyze, treat and monitor AI risk over time, integrated with existing enterprise risk management.
Analysis of AI systems' impact on individuals and groups — bias, transparency, contestability and consequences — documented and re-assessed.
Governance of data, development, validation, deployment and monitoring of models and agents, with controls at every lifecycle stage.
Technical documentation, information to interested parties and records that sustain traceability of automated decisions and accountability.
Defined responsibilities, required competencies and awareness for the teams that design, operate and oversee AI systems.
The three standards share the same management-system structure and can be integrated. Each governs a different object.
| Aspect | ISO/IEC 42001 | ISO/IEC 27001 | ISO/IEC 27701 |
|---|---|---|---|
| Object | AI management (AIMS) | Information security (ISMS) | Information privacy (PIMS) |
| Focus | Responsible governance of the AI lifecycle | Confidentiality, integrity and availability | Personal-data processing and privacy |
| Control annex | Annex A — 38 controls | Annex A — 93 controls | Privacy extension of ISO 27001 |
| Certifiable | Yes, by an accredited body | Yes, by an accredited body | Yes, as an ISO 27001 extension |
| Relationship | Reuses the existing ISMS | Information-security baseline | Extends ISO 27001/27002 |
Certification does not replace the law, but it builds the governance, risk and evidence base that AI regulation increasingly requires — in Brazil and abroad.
The Brazilian bill proposing the country's AI legal framework, with governance, risk-assessment and transparency duties. The AIMS anticipates much of what it will require.
Central Bank of Brazil rules on risk management and technology use apply to AI models and agents in financial institutions. The AIMS organizes the governance supervisors expect.
The European AI regulation classifies systems by risk and imposes management obligations. ISO/IEC 42001 is the leading organizational compliance route recognized by the market.
The NIST AI Risk Management Framework (US) is voluntary and complements ISO/IEC 42001: the AIMS operationalizes the governance functions the RMF describes.
The AIMS impact varies with the sector and the risk profile of the AI systems in use.
Banks, fintechs and insurers use AI in credit, fraud prevention and service. The AIMS structures the model governance that regulators and clients increasingly require, integrating with the existing ISMS and risk management.
AI systems in diagnosis, triage and clinical management handle sensitive data and high-impact decisions. The AIMS documents impact assessment, human oversight and traceability, sustaining LGPD compliance and patient safety.
Use this initial checklist to gauge how close your organization is to the certification audit:
Key terms used across the standard and the certification journey.
AI Management System — the artificial-intelligence management system defined by ISO/IEC 42001, analogous to the ISO 27001 ISMS.
The normative annex of ISO/IEC 42001:2023 with 38 AI controls, from which the organization selects the applicable ones in the statement of applicability.
Analysis of AI systems' impact on individuals, groups and society — bias, transparency and consequences — required by the standard.
An independent, accredited certification body that runs the Stage 1 and Stage 2 audits and issues the ISO/IEC 42001 certificate.
ISO/IEC 42001 does not replace your other controls — it organizes them. We connect the AIMS to the rest of your security and compliance program.
The full governance, risk and compliance pillar for artificial intelligence.
The information-security management system the AIMS builds upon.
IT audit, GRC, gap analysis and regulatory testing for the main frameworks.
Controls and testing for autonomous agents — the operational risk the AIMS must govern.
Adversarial attack on AI models and agents to validate controls in practice.
Penetration testing of AI and LLM applications, mapped to the OWASP LLM Top 10.
In a 30-minute conversation we map your AI-governance maturity and design the path to ISO/IEC 42001 certification — from gap analysis to audit.
Talk to a specialist