August 2026. ISO/IEC 42001 for AI management systems is increasingly requested alongside ISO 27001 — by enterprise customers, supervisors and internal AI initiatives. It is not a parallel universe: AI governance belongs in the same risk and improvement register as security.
Why ISO 42001 now?
The EU AI Act sets duties for high-risk AI; ISO 42001 offers an auditable management system for impact, data, transparency and human oversight. Certification is optional, but the framework helps due diligence and internal governance.
- inventory: which AI systems, models and datasets are in scope;
- risks: bias, privacy, security, chain (APIs, subprocessors);
- controls: human oversight, logging, change management for models;
- evidence: model cards, test results, approvals in management review.
Link to ISO 27001
Use one ISMS structure: scope, SoA, internal audit, CAP. Tag AI-specific controls in Annex A and ISO 42001. Link to ISO 42001 hub, ISMS and GDPR pages.
Roadmap for SMEs
- AI register: name, purpose, data, owner, customer impact.
- Gap vs AI Act + ISO 42001 — prioritise high-risk use cases.
- Policy for generative AI (Copilot, ChatGPT): what may/may not go in prompts.
- Quarterly review in management review — metrics and incidents.
In 2026 procurement explicitly asks for AI governance alongside security questionnaires. One source of truth saves weeks per RFP.
Start small: one product line or internal chatbot as pilot. Document lessons before rolling out the full portfolio — auditors value phased implementation with rationale.
What to do this week
Pick one concrete action from this article, assign an owner and add it to your risk or improvement register with a deadline. Share briefly in team meetings so compliance is something the line recognises. Repeat quarterly in management review so leadership sees progress, not only intent.
Note: this article is educational and does not replace legal, privacy or audit advice for your specific situation.
Evidence and governance
Record who owns the measures in this article and how you prove operation in the sample period — logs, tickets, approved changes or exercise reports. Certification bodies and chain partners do not accept intent without samples. Link evidence locations to your SoA or control plan so internal and external audit use the same sources.
Chain and contracts
Many 2026 requirements come via customers, not only formal law scope. Align contract SLAs with your ISMS: incident notification, audit rights, patch timelines and exit. Document where contract is stricter than internal policy — management review must explicitly accept that gap or plan investment.
Continual improvement
Plan a short quarterly review: what worked, which near-miss stood out, which control needs extra attention? Record three improvement actions with owners — that is what ISO 27001, NIS2 and GDPR supervision want to see: PDCA in practice, not paper only.
Knowledge base and readiness
For deeper guidance see our knowledge base on ISMS, ISO 27001, NIS2 and GDPR. Use the readiness overview to compare priorities with your current maturity. This article is educational; engage specialists for legal or audit decisions.
Evidence and governance
Record who owns the measures in this article and how you prove operation in the sample period — logs, tickets, approved changes or exercise reports. Certification bodies and chain partners do not accept intent without samples. Link evidence locations to your SoA or control plan so internal and external audit use the same sources.
Chain and contracts
Many 2026 requirements come via customers, not only formal law scope. Align contract SLAs with your ISMS: incident notification, audit rights, patch timelines and exit. Document where contract is stricter than internal policy — management review must explicitly accept that gap or plan investment.
Continual improvement
Plan a short quarterly review: what worked, which near-miss stood out, which control needs extra attention? Record three improvement actions with owners — that is what ISO 27001, NIS2 and GDPR supervision want to see: PDCA in practice, not paper only.
Knowledge base and readiness
For deeper guidance see our knowledge base on ISMS, ISO 27001, NIS2 and GDPR. Use the readiness overview to compare priorities with your current maturity. This article is educational; engage specialists for legal or audit decisions.
Evidence and governance
Record who owns the measures in this article and how you prove operation in the sample period — logs, tickets, approved changes or exercise reports. Certification bodies and chain partners do not accept intent without samples. Link evidence locations to your SoA or control plan so internal and external audit use the same sources.