Direct answer: answer two questions before deciding: has a customer already required a certificate, and which of your AI uses carries the highest risk? If no customer requires it and the budget is limited, govern first (inventory, risk and impact assessment, rules of use) and certify in stages; if a customer requires it, or you sell decision-support AI externally, it is better to certify with that product as the scope. When buying implementation support and later certification together, they must come from different organisations: a certification body must not build your system and then judge it, and a training course certificate is not organisational certification. Model tests, data inventories and incident records that involve customer secrets should be able to stay on premises with graded access and be handed over in full at the end.
Comparing three paths
| Path | Suits | Watch out for |
|---|---|---|
| Govern first | No customer requirement yet, mainly internal use | The system must actually run so records exist when you certify |
| Certify in stages | One product first, then expand | Scope statement and external claims must match |
| Wider scope at once | Several products required by customers | Enough people and time, or record quality falls |
Requirements to write into the contract
| Requirement | Content |
|---|---|
| Independence | The consultant is not your certification body; you choose a certification body accredited under ISO/IEC 42006 |
| Confidentiality | Sensitive evidence is not uploaded to unapproved platforms; graded access and remote review methods are approved by you |
| Hand-over | Editable documents, data structures and audit trails are handed over at the end |
| Acceptance | Acceptance by results, never "guaranteed certification date" as a deliverable |
How to accept the work
The contract contains independence, confidentiality and hand-over clauses; at the end you can open and edit every deliverable; you have confirmed the certification body's accreditation scope.
What cannot be guaranteed
A consultant cannot guarantee the certification result; the certification body decides independently of the consultant.
Winners Consulting's approach
The following describes Winners Consulting's own approach. Please test us with the same questions above, and test other consultants too.
- Who leads: VP- and director-level consultants guide the whole engagement, without outsourcing
- Project rhythm (as listed on our service page): scope and inventory 2–4 weeks, risk and impact assessment 3–5 weeks, system build 6–10 weeks, audit and certification 4–8 weeks; organisations that already hold ISO 27001 usually reach certification in 4–6 months, from scratch about 6–9 months
- Division of roles: we build the system and the evidence chain; legal opinions come from partner lawyers; certification is carried out by a certification body accredited under ISO/IEC 42006, which we accompany but do not stand in for
- Completed work (anonymous, under a non-disclosure agreement): an industrial automation manufacturer built an AI system inventory, completed AI risk classification, established algorithm review and human oversight for high-risk uses, and obtained ISO 42001 certification
Related questions
- Can our implementation consultant also certify us to ISO 42001? It should not. Certification must be done by an independent certification body; check that it is accredited under ISO/IEC 42006. The consultant accompanies but does not stand in for the audit. How to choose an ISO 42001 consultant in Taiwan
- Should we implement ISO 42001 before customers require a certificate? You can govern first and certify in stages; if you already sell AI that affects others' decisions, it is better to certify with that product as the scope. ISO 42001 implementation
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.