Putting this into practice
Winners Consulting helps organizations turn this concept into workable policies, processes and audit readiness.
Step 1 of 3
You looked up “ISO/IEC 27090 Guidance on AI Security Controls”. Which situation is closest to yours?
Common situations behind “ISO/IEC 27090 Guidance on AI Security Controls” and the first step
- A customer asks about AI governance or ISO 42001 during procurement or due diligence：Build an AI system inventory and risk and impact assessments, then decide the certification scope
- Products or services will reach the EU and must address the EU AI Act：Classify each AI system’s risk level and your role first; ISO 42001 covers organisational governance
- The board or management wants AI use to be accountable and auditable：Check that the advisor makes human oversight, model changes and incident handling into real records
Winners Consulting provides ISO 42001 consultant for AI management systems. Vice-president and director-level consultants lead the work end to end with no outsourcing, and one set of evidence answers several laws and customer requirements.
Before choosing a consultant or budgeting: decision guides
Use these guides as a checklist when comparing consultants and estimating budget and timeline.
- ISO 42001 and the EU AI Act: how to plan budget and timelineThe AI Act's high-risk obligations are postponed but not cancelled: stand-alone high-risk AI applies from 2 December 2027, AI embedded in products from 2 August 2028. ISO 42001 is a management system you can build now.
- Which ISO 42001 consultant in Taiwan should you choose? Ten criteriaWhen choosing an ISO 42001 consultant, first tell consultants and certification bodies apart (certification bodies may not provide management system consultancy); then check whether the consultant keeps ISO 42001 and the EU AI Act distinct, whether the people running the engagement hold ISO 42001 lead-auditor credentials, and whether any work is subcontracted.
- How the US, the EU and Japan require AI suppliers to prove they are trustworthyThe US uses federal procurement to require things of AI suppliers, the EU regulates through the AI Act and the draft CSA 2.0, and Japan promotes "trustworthy AI" through its AI Act and the AI Guidelines for Business. What the three have in common, and the 2027 timeline.
- How to choose a digital transformation consultant in Taiwan: eight criteriaWhen choosing a digital transformation consultant, first check whether they start from the operating metrics you want to improve before choosing systems; then check whether they design information security, OT security, data governance and business continuity in from the start while you roll out ERP, MES and IoT.
- How to choose an AI transformation consultant in Taiwan: eight criteriaWhen choosing an AI transformation consultant, first check whether they pick the first use case by data availability, business value and the cost of failure; then check whether they set up AI governance (ISO/IEC 42001) before deployment, assess risks and applicable laws, and keep monitoring after go-live.
- Only buying AI and running several legal entities: how do you set the ISO 42001 scope?Companies that do not train their own models can still implement ISO/IEC 42001: start by inventorying who uses which AI, which evidence you control and which you can only request from suppliers; with several entities and a shared platform, the certificate scope must match what you tell customers.
- Purchased models, outsourced development, staff using AI on their own: which evidence is still yours?When you build a third-party model into your own product, outsource AI development, or staff use browser extensions and personal accounts, ISO 42001 responsibility does not disappear with outsourcing; separate the evidence you can request from suppliers, what you must verify yourself, and the limits that remain.
- Recruitment, healthcare and factory AI: why one accuracy figure cannot be the acceptance testThe same accuracy has very different consequences in different uses: CV ranking affects applicants, medical imaging may affect patients, and a missed alert in a factory danger zone can injure people. ISO 42001 requires impact, human oversight and acceptance criteria to be assessed separately for each use.
- The risk register is done but still fails acceptance: how to connect impact, controls and risk acceptanceAI risk registers often fail audit because controls are copied wholesale, applicability is not explained, purchased-model limits are ignored and nobody signs off residual risk. ISO 42001 needs one traceable line from risks and impacts to control choices, owners, evidence and acceptance.
- RAG cites sources but still answers wrong, high accuracy still misses cases: how to build auditable test evidenceA knowledge assistant that cites the wrong version, or a classifier at 96% overall that fails in minority languages, is a test-design problem, not a slide-deck problem. ISO 42001 needs data sources, versions, performance by group and refusal mechanisms written up as test evidence and connected to risk treatment and go-live acceptance.
- AI agents can act on company systems and the model is opaque: how to validate instead of trusting a white paperAn AI agent that queries internal data and calls the purchasing system treated text inside a document as an instruction during testing; the purchased model discloses neither weights nor training data. ISO 42001 needs data trust boundaries, least privilege and human approval, with black-box validation, contractual information duties and residual-risk acceptance covering what is opaque.
- The model updates monthly and AI can refund and change orders: who approves, stops and rolls back?A purchased model updates every month with no old versions kept, so the same tests give different results; customer-service AI is about to issue refunds, promise delivery dates and change orders automatically. ISO 42001 needs the system to stay valid after updates: version identification, change impact assessment, regression tests, approval, a fallback when rollback is impossible, and human intervention that can really stop errors.
- After go-live the AI drifts, teams blame each other or the supplier exits: how does the system keep working?A demand forecast drifts in the promotion season and manual corrections hide it; after a wrong AI recommendation each team blames another; an old system is retired and the supplier changes. ISO 42001 requires monitoring, incident handling and retirement to have procedures and evidence, so management review sees the real risk.
- Already certified to ISO 27001 and 27701: which AI evidence can be shared and which must be added?Organisations with ISO 27001 and ISO 27701 can share document control, internal audit, management review and supplier management when implementing ISO 42001; AI system impact assessment, data quality, model validation and life-cycle evidence must be added and cannot be swapped in directly.
- Changing the purpose, adding your own brand, amended rules: what ISO 42001 and the AI Act each requireRe-purposing or re-branding a third-party AI system may make you a provider under the EU AI Act, and ISO 42001 certification is not AI Act compliance. Checked against official sources as of October 2026: the application dates after the Digital Omnibus and the limited scope of presumption of conformity under EN 18286:2026.
- Two part-time staff and templates without records: how to build an AIMS that actually runsWith only two people sharing governance work, or ISO 42001 document templates bought but no real records of risk acceptance, supplier review, internal audit or management review: narrow the scope, slim the procedures and let the system run to produce records, never back-filling records that do not exist.
- Govern first or certify first? How to buy ISO 42001 consulting that is independent, confidential and handed over in fullWhen the budget covers only one pilot and customers do not yet require a certificate, you can govern first, certify in stages or go straight to a wider scope; when buying implementation and certification together, confirm the consultant and certification body are independent, evidence can stay on premises with graded access, and editable results are handed over at the end.
Need help with compliance implementation?
Request Free Assessment