Customers want proof of how our AI product is governed. What can ISO 42001 prove?
ISO/IEC 42001:2023 is a certifiable AI management system standard, certified by certification bodies accredited under ISO/IEC 42006, on a three-year cycle with annual surveillance audits. The certificate shows the organisation's AI governance is sound; when customers ask about AI governance, you can present the AI system inventory, risk assessments and control records.
What it cannot prove: the certificate is not EU AI Act compliance, and ISO/IEC 42001 is not a harmonised standard under the EU AI Act, so certification creates no presumption of conformity. External statements should describe the certificate scope separately from product compliance, and never say "42001 equals AI Act compliance".
Our AI product uses a bought-in model. Which evidence is still our responsibility?
Buying a model does not outsource the responsibility. When a third-party model becomes your own product:
| What you can ask the supplier for | What you must do yourself |
|---|---|
| Model version, usage limits, overall test results, data processing terms | Testing your own data and prompts, launch approval, user notices, incident handling |
Where the supplier does not disclose training data, only black-box testing and contract terms can fill the gap. The information, notification and assistance duties to write into purchasing or outsourcing contracts are a list the product manager should draw up before choosing a model supplier.
The model updates every month. How do we keep launched AI features valid?
Passing acceptance at first launch does not mean it still works next month. When a bought-in model is updated you need:
- Version identification: record the model version per call or per batch; supplier updates must be notified
- Change impact assessment: before updating, decide which uses are affected and which tests to rerun
- Regression testing and approval: compare before-and-after results on the same test set; approve only when thresholds are met
- No rollback possible: define fallback options and suspension conditions in advance
Where AI can issue refunds, commit delivery dates or change orders automatically, define the scope of authority and risk tiers, and place human intervention points before high-impact operations.
If the AI product drifts after launch, draws complaints or we switch suppliers, which procedures do we need?
ISO/IEC 42001 requires procedures for monitoring, incident handling, corrective action and retirement, with results fed into management review:
| Situation | Mechanism |
|---|---|
| Drift masked by manual corrections | Monitoring records the number of and reasons for manual overrides; complaints and override rates count against thresholds |
| Blame-shifting after wrong advice | AI incident triage rules, evidence preservation, root cause investigation, correction and effectiveness checks |
| Retirement and supplier switch | Data migration, deletion, retention, access revocation and exit acceptance |
Whether an event is legally reportable must be judged under the applicable law.
How long does ISO 42001 take? Will it affect the product schedule?
Timeline as listed on the service page: usually 4–6 months to certification with ISO 27001 in place, about 6–9 months from scratch. Four phases:
- Scope and inventory: 2–4 weeks
- Risk and impact assessment: 3–5 weeks
- System build: 6–10 weeks
- Audit and certification: 4–8 weeks
The 38 Annex A controls are implemented one by one with evidence. If a customer project or procurement requires the certificate, the product manager should plan backwards from the date the customer needs it.
We already have ISO 27001 or 27701. What can be shared, and what must be added?
ISO/IEC 42001 and ISO 27001 share the same high-level structure:
- Shared: document and record control, internal audit, management review, corrective action, training records, part of supplier management
- Strengthened: supplier management adds model versions, data use and change notices; the security incident process adds AI incident triage
- New: AI policy, AI system inventory, AI risk and impact assessment, data quality and model validation, lifecycle procedures
A privacy impact assessment cannot be used directly as an AI system impact assessment; sharing shortens the timeline, but 27001 certification does not extend to 42001, and each is certified separately.
How does Winners Consulting help product managers with ISO 42001?
Winners Consulting first clarifies the goal: which markets, what proof customers want, which risks to control internally, then recommends 42001 alone, a sequence, or together with the AI Act:
- 42001 as the management system base, sharing a backbone with ISO 27001/27701
- We build the system and evidence chain; legal opinions come from partner lawyers
- Certification is carried out by a certification body accredited under ISO/IEC 42006; we accompany, we do not audit on its behalf
Winners Consulting is a consultant and does not issue certificates; VP- and director-level consultants lead the work end to end, never outsourced. Read more: ISO 42001 consulting, Evidence for bought-in models, Model updates and human oversight, Post-launch incidents. Request a free mechanism diagnosis
How other roles see this service
- CEOEU AI Act and ISO 42001 for the CEO: staff AI use, fines and governance ownership
- CISOCISO guide to ISO 42001: what AI governance shares with ISO 27001
- CROAI risk for CROs: what to decide first on ISO 42001 and the EU AI Act?
- CTOISO 42001 and the EU AI Act for CTOs: what does AI product development need?
Other services for this role
- EU CRA for product managers: is my product in scope, and what must be ready before launch?
- EU AI Act for product managers: what must the AI in our product complete before launch?
- ISO/IEC 29147 and 30111 for product managers: what can we promise on vulnerability disclosure and fixes?
- IEC 62443-4-2 for product managers: will industrial product certification delay our launch?
- ISO/SAE 21434 for product managers: how does an automotive product pass carmaker development audits?
- TISAX prototype protection for product managers: will a missing label block a carmaker project?
- ISO 27701 and GDPR for product managers: which privacy work comes first when selling into each market?