ISO 42001 from scratch: what it actually takes

Most ISO 42001 guidance assumes you already hold ISO 27001, so you can reuse your document control, internal audit and management review processes. If you’re a mid-market company starting with nothing, that advice skips the hard part. This is the from-scratch version.

We covered what the standard asks for in ISO/IEC 42001 in plain language. Here we’re talking about the practical path: what you build, in what order, and what it costs in time.

Start with the inventory, not the policies

The first thing an auditor will ask is “which AI systems do you have?” and most companies can’t answer it completely. Before you write a single policy, list every AI system you build, sell or use — including the AI features inside tools you already pay for. That list is the scope of everything else.

Assign an owner to each system. An owner is a named person accountable for its risks, not a department. If a system has no owner, it has no governance.

Write one short policy, not a manual

Your AI policy doesn’t need to be thirty pages. It needs to say four things: what the organisation will and won’t use AI for, who approves new uses, what checks happen before launch, and what happens when something goes wrong. Keep it short enough that people actually read it.

The temptation is to copy a template with every control from Annex A. Resist it. A short policy you follow beats a comprehensive one nobody has opened since it was written.

Build the two assessments you’ll reuse

ISO 42001 rests on two documents you’ll run for every AI system: a risk assessment (what could go wrong, how likely, how bad) and an AI impact assessment (how the system could affect people and society, not just the organisation).

Build a template by running both on your highest-risk system first. Once the template works, the rest become routine. Don’t try to assess all systems at once — one done well is worth more than ten done badly.

Keep evidence from day one

Auditors work from evidence: approval records, test results, monitoring, incident reports. It’s much harder to reconstruct afterwards than to capture as you go. This is the part that catches people out, because it feels like bureaucracy until the audit, when it becomes the difference between passing and starting over.

The realistic timeline

For a mid-market company starting from scratch, expect roughly four to six months from kickoff to certification-ready, assuming one person owns the project part-time. That breaks into something like: inventory and owners in the first month, policy and templates in the second, assessments and evidence across the third and fourth, internal audit and certification preparation in the fifth and sixth.

The external certification audit itself is a separate event after that, run by an accredited certification body, with surveillance audits following.

You don’t need certification to benefit

A useful distinction: the management system and the certificate are different things. The system — knowing what AI you run, who owns it, and how you check it before launch — is valuable on its own, and it’s the foundation you’d need for certification anyway. Several of our clients start for the certificate and stay for the working system.

Our Compliance & ISO/IEC 42001 service covers the setup and audit preparation, and the AI Risk & Governance Kit gives you the templates and workflow to run it without reinventing each document.