AI Management Systems

ISO/IEC 42001 Consulting: From Gap Analysis to Certified AI Governance

The world's first certifiable AI Management System standard, delivered by PECB Senior Lead Auditors who build documentation to the evidence threshold certification bodies actually demand — not the volume that impresses an internal reviewer.

The Standard

What ISO/IEC 42001 requires, and where organisations actually fail

Clauses 4 through 10 are the mandatory management system requirements — context, leadership, planning, support, operation, evaluation, improvement. Annex A adds 38 controls across nine domains, selected via a Statement of Applicability that scales to your actual risk profile, not a checklist applied uniformly. The single most common failure we see: a well-drafted AI policy sitting above an organisation that cannot say how many AI systems it operates. Certification bodies audit evidence, not intentions — so the work starts with an inventory, not a policy document. See our plain-language explanation of ISO/IEC 42001, the first 90 days of a certification journey, and the evidence auditors expect to see. For the full audit route and preparation details, see our ISO 42001 certification guide.

Our Methodology

An evidence-first engagement, built around what auditors ask for

Phase 1–2 · Weeks 1–5
Initiation, Scoping & Discovery
AI inventory formulation (in-house, third-party, shadow AI). Clause-by-clause gap assessment. Output: prioritised remediation register.
Phase 3 · Weeks 6–8
Gap Analysis & Maturity Rating
Scored 0–5 maturity scale across all Annex A controls. Identifies critical nonconformities before documentation begins.
Phase 4–5 · Weeks 9–20
Implementation Planning & Documentation
28+ auditor-ready templates across AIMS Scope, AI Policy, RACI Matrix, AIRA, AIIA, SoA, Incident Response, and Internal Audit Programme.
Phase 6–8 · Weeks 21–36
Implementation, Internal Audit & Certification
Staff training, MLSecOps configuration, pre-deployment red-teaming, mock Stage 1 review, and hands-on auditor interfacing through Stage 1 & 2 certification.

The Difference

Why organisations choose gnaan.ai for ISO 42001

01
Senior Lead Auditor Expertise
Every engagement is led by PECB-certified ISO/IEC 42001 Senior Lead Auditors. We know the questions auditors ask because we ask them ourselves — in a different context.
02
Evidence-First Documentation
Documentation built to the threshold of sufficient and appropriate evidence certification bodies demand. Generic templates produce Major Nonconformities. Ours don't.
03
Risk-Based Efficiency
Documentation effort focused strictly on material risks, sparing low-risk systems from over-engineering. We build systems people actually use.
04
21+ Years of Delivery Leadership
Real-world transformation experience from global organisations across the US, Asia-Pacific, Europe and beyond, translated into governance that survives contact with reality.

Field Notes

More on ISO/IEC 42001

ISO/IEC 42001

The ISO/IEC 42001 Certification Journey: What the First 90 Days Actually Look Like

Most organisations treat 42001 as a documentation exercise. The ones that certify on the first attempt start with the inventory, not the policy.

22 Jul 2026 · 8 min read
ISO/IEC 42001

ISO/IEC 42001, Explained Properly

Everyone is talking about AI regulation. Fewer can answer how you actually prove you are governing AI responsibly.

10 Jul 2026 · 5 min read
Audit Readiness

Auditors Don't Read Your PDFs. They Audit Your Evidence.

A folder of downloaded compliance templates is not an AI Management System — it's a costume, and auditors spot the difference fast.

04 Jul 2026 · 4 min read

Questions & Answers

ISO 42001 FAQs

What is ISO/IEC 42001?

ISO/IEC 42001:2023 is the first international management system standard for artificial intelligence. It sets requirements for establishing, implementing, maintaining and improving an AI management system (AIMS), including AI risk and impact assessment and Annex A controls.

Is ISO 42001 certification mandatory?

No. It is a voluntary, certifiable standard rather than a legal requirement. Many organisations adopt it because customers, procurement teams or regulators ask for evidence of AI governance.

Who issues the ISO 42001 certificate?

An accredited certification body, after a two-stage audit. A consultant prepares your organisation but does not issue the certificate. Gnaan AI keeps consulting separate from certification.

How long does ISO 42001 take?

[TODO: I will supply. Explain why our roadmap is 36 weeks, what it includes, and whether a shorter track exists for smaller scopes.]

How much does ISO 42001 certification cost in India?

Cost depends on the number of AI systems in scope, organisation size, and whether you already run ISO 27001. It combines consulting fees with the certification body's audit fees, which that body quotes separately. [TODO: add our pricing approach or ranges if I approve.]

Can we reuse our ISO 27001 work?

Yes. ISO 42001 shares the harmonised structure of other ISO management system standards, so much of the documentation and audit rhythm can be reused.

Ready to build an AI Management System the world can trust?

Book a complimentary 45-minute AI Governance Readiness Assessment

contact@gnaan.ai +91 6282 552 995

Or write to contact@gnaan.ai