AI policy & governance
Purpose, scope, principles, roles, responsibilities, alignment with strategy and code of ethics.
ISO/IEC 42001:2023 · AI governance
Responsible AI, on the system you already have.
ISO 42001 does not require a separate ISMS. It requires extending the existing one with AI impact assessment, model lifecycle, data quality and human oversight. In 10 weeks you have an AI governance system that holds up under audit — and prepares the ground for the EU AI Act.
ISO/IEC 42001:2023 is the international standard for managing AI systems responsibly. KodeX GRC extends your existing ISO 27001 ISMS with AI impact assessment, model lifecycle, data quality and human oversight — covering the 38 Annex A controls — in about 10 weeks, mapped to the EU AI Act.
What it covers
Annex A of ISO 42001 is organised around an AI system's lifecycle — from purpose and governance to retirement. Each area maps to an owner and an artefact.
Impact assessment
Impacts on individuals, groups, society. Mandatory for high-risk systems under the EU AI Act.
AI lifecycle
Design, data, training, validation, deployment, in-production monitoring, retirement.
AI data
Provenance, quality, representativeness, bias, dataset governance.
Transparency & disclosure
Model documentation, model cards, user disclosure, communication of limitations.
Human oversight
Human-in-the-loop checkpoints, intervention rights, kill-switch procedure.
Third-party use
Model suppliers, APIs, third-party integration, AI supply chain risk assessment.
AI incidents
Detection, reporting, correction, learning. Distinguished from conventional security incidents.
Who it's for
The standard adds value when there's real exposure or regulatory interest — not when AI is a pilot activity.
We work with companies that use AI in a product or in a decision that affects people — customers, employees, citizens.
The rule: if the company processes training data, produces predictions that feed into a decision, or exposes AI to clients, the standard has meaning. If AI is only an internal productivity tool, usually not yet.
SaaS with AI features selling to enterprise clients
Financial and insurance with automated decision-making
Healthcare with clinical support, triage or diagnosis
Anyone with ISO 27001 already who wants to extend to AI
Exposed to the EU AI Act as providers or deployers
How we work
Four phases. The work is smaller than ISO 27001 because it doesn't start from zero — it builds on the ISMS already in place.
AI mapping
Which systems, what risk
Inventory of every AI system, classification under the EU AI Act, mapping of training and operational data flows.
2 weeksImpact assessment
Before we write policies
Structured impact assessment on individuals and society. The basis for policies and subsequent decisions.
3 weeksPolicies & procedures
Layered onto the existing ISMS
Extend your policies with the AI chapters. No duplicate documents — one source of truth, multiple mappings.
3 weeksInternal audit
And audit support
Dry run, finding closure, presence at Stage 1 and Stage 2 with the auditor's eyes on what they'll look for.
2 weeksWhat you get
Five artefacts directly linked to the existing management system. None of them are documents you'll have to write yourself afterwards.
AI policyPurpose, scope, principles, roles, alignment with strategy and code of ethics.
AI system registerEvery system with EU AI Act classification, owner and risk level.
Impact assessmentsStructured documentation per high-risk system — and the trigger criteria.
Lifecycle processFrom design to retirement, with checkpoints and owners.
Model cardsDocumentation of purpose, limitations, data, performance, known failure modes.
Human oversight planIntervention points, kill-switch rights, operator training.
Timeline — 10 weeks
Typical project layered onto an existing ISMS. Without ISO 27001, the work combines with the foundational project and extends to 14 weeks.
WK 01–02
AI inventory
System inventory, EU AI Act classification, data flow mapping.
WK 03–05
Impact assessment
Structured assessment per high-risk system, with responsible-body approval.
WK 06–08
Policies & procedures
ISMS extension, model cards, human oversight plan, training.
WK 09–10
Internal audit
Dry run, findings, corrective actions, presence at Stage 1 & 2.
Frequently asked
The questions we hear before taking on an AI governance project.
Do we need ISO 27001 first for ISO 42001?
Not mandatory, but it helps significantly. Around 70% of ISO 42001 controls have counterparts in ISO 27001 — governance, risk management, policies, internal audit, management review. If you have it, the project halves. If not, we combine with the foundational project.
How does ISO 42001 relate to the EU AI Act?
The standard doesn't replace the regulation. It provides the governance framework the AI Act presupposes — especially for impact assessment, model documentation, human oversight and risk management. The classification we do in step i maps to the AI Act's risk categories.
How much does ISO 42001 certification cost?
It depends on the number of AI systems in scope and whether an ISMS already exists. After the free gap analysis you get a costed proposal — not before. We don't quote without seeing what's actually there.
Is ISO 42001 worth it for a small company?
If your product includes AI and sells to regulated or enterprise clients who ask for AI governance evidence, yes. If AI is only an internal productivity tool, usually not yet — unless a specific client asks for it.
Related services
ISO 42001 rarely stands alone. It usually combines with the following, because they share artefacts and maturity level.
01 · ISO 27001
Information security
The foundation that halves the ISO 42001 effort — and the evidence clients ask for.
08 · vCISOAI governance
For continuity — AI committee, board reporting, annual review, impact assessment refresh.
04 · GDPRTraining data
Overlaps in data governance, impact assessments and cross-border transfers.
Get started
Free gap analysis in two weeks.
A prioritised gap register, a costed 10-week roadmap, and an executive summary for the board. No commitment — you can hand it to another consultant if you prefer.
No commitment
Confidential
Greek or English