AI landscape
Establish the AI systems, use cases, suppliers and responsibilities within the proposed scope.
ISO 42001 AI Management Systems
ISO 42001, formally ISO/IEC 42001:2023, is the international standard for an artificial intelligence management system (AIMS): the policy, roles, risk and impact assessments and controls an organisation uses to develop, provide or use AI responsibly. Umbrella Tech helps Australian organisations assess their AI use against the standard, build a working AIMS and prepare for ISO 42001 certification where they choose to pursue it.
The problem
The challenge we help you address
Customers, partners and boards are asking how AI is governed, and the honest answer is that tools were adopted one at a time. There is no inventory, no agreed way to assess risk or impact, and no record of who approved what.
The outcome
What the engagement should deliver
A defined AIMS scope, an inventory of AI systems and uses, risk and impact assessment processes people actually follow, and controls chosen from the standard's Annex A. You also receive the records and review routines that show the system working.
How we can help
Gap assessment
Compare current governance with the requirements of ISO/IEC 42001.
AIMS development
Design the policy, roles, risk and impact processes and working documents.
Implementation and readiness
Put the system into operation and prepare evidence for an external audit.
What the standard requires
ISO/IEC 42001 follows the same harmonised structure as other ISO management system standards, so it sets requirements for context, leadership, planning, support, operation, performance evaluation and improvement. The AI-specific parts include an AI policy, AI risk assessment and treatment, an AI system impact assessment that considers effects on people and groups, and a set of reference controls in Annex A. Standards Australia has adopted it locally as AS ISO/IEC 42001:2023.
Preparing for certification
Certification is voluntary. We support readiness and implementation; certification is assessed separately by an independent certification body. Scope, operating evidence and unresolved gaps affect the path to that audit.
Gap assessmentUmbrella Tech
Remediation and implementationUmbrella Tech with your team
Operate and build evidenceYour organisation
External certification or assessmentIndependent body
Assessment and implementation options
AssessmentISO 42001 Gap Assessment
Get a structured ISO 42001 gap analysis from Umbrella Tech, with clear findings, risk priorities and an…
Explore → AssessmentISO 42001 ReadinessGet a structured ISO 42001 readiness from Umbrella Tech, with clear findings, risk priorities and an…
Explore → ServiceISO 42001 ImplementationISO 42001 implementation: turn gap findings into a working AI management system with approvals, supplier…
Explore → ServiceAI Management System (AIMS) DevelopmentBuild an AI management system (AIMS) aligned to ISO/IEC 42001: roles, AI inventory, risk and impact records…
Explore →Frequently asked questions
Can't see your question? Ask us directly →
What is ISO 42001?
ISO/IEC 42001 is a management system standard for AI. It does not tell you how to build a model; it asks you to govern AI with a policy, clear responsibilities, assessed risks and impacts, chosen controls and regular review.
Who needs it?
It applies to organisations of any size that develop, provide or use AI-based products or services. It suits businesses building AI into products, organisations whose customers or tenders ask about AI governance, and those already running ISO/IEC 27001. A small business using a few off-the-shelf tools may be better served by AI Governance & Acceptable Use for now.
What are the main requirements?
An AIMS scope, an AI policy, defined roles, AI risk assessment and treatment, AI system impact assessment, selected Annex A controls, measurable objectives, internal audit, management review and improvement, each supported by records.
How long does implementation take?
It depends on how many AI systems are in scope, whether you build or only use AI, and whether an existing management system can be extended. We confirm scope and timing in discovery.
How does it relate to other frameworks?
ISO/IEC 42001 shares its structure with ISO/IEC 27001, so scope, document control, audit and review can run as one integrated system. ISO/IEC 27001 protects information; ISO/IEC 42001 governs how AI is developed, provided and used.
Plan the next improvement
Tell us how your organisation uses or builds AI and who is asking about governance. We will help define a practical starting point.