Direct answer: ISO/IEC 42001 is for organisations that provide or use AI-based products and services; it is not limited to companies that train their own models. For a manufacturer that only uses purchased generative AI for summaries and coding help, the scope centres on use: which departments, which AI tools, which data, who approves and who is responsible when something goes wrong. With several legal entities and a shared AI platform, choose one business group or one entity as the first certification scope, write down the responsibilities for the shared platform, and expand later; do not let the certificate scope differ from what sales tells customers.
Five things to establish first
| What to establish | Why it matters |
|---|---|
| Which AI systems exist, who uses them, what data they process | Without an inventory you cannot set the scope or answer customer due diligence |
| Whether you are a provider or a user | Users focus on rules of use, data input and output review; providers add life-cycle and documentation requirements |
| Which evidence you control | Usage records, approvals, training and output review are yours; model training data and tests usually have to be requested from the supplier |
| Boundaries between entities, sites and shared services | When head office runs the platform and subsidiaries use it, the scope statement must say who is responsible for what |
| What you claim externally | A certificate covers only the organisation and activities in the scope statement; it cannot be stretched to "the whole group, all products" |
What a consultant should deliver
- An AIMS scope statement: included and excluded entities, sites and AI systems, with reasons
- An AI system inventory: purpose, user department, data categories, supplier, approver
- A responsibility table for the head-office platform, subsidiary users and suppliers
- A roadmap for expanding the scope: which units join in phase two, and on what conditions
How to accept the work
Every item in the scope statement maps to a system and an owner in the inventory; when a certification body samples any AI tool, it finds the approval, rules of use and training records; the scope sales describes externally matches the certificate.
What cannot be guaranteed
A narrow scope lets you certify sooner, but AI use outside the scope still carries risk; if customers require group-wide evidence, plan the expansion.
Winners Consulting's approach
The following describes Winners Consulting's own approach. Please test us with the same questions above, and test other consultants too.
- Who leads: VP- and director-level consultants guide the whole engagement, without outsourcing
- Project rhythm (as listed on our service page): scope and inventory 2–4 weeks, risk and impact assessment 3–5 weeks, system build 6–10 weeks, audit and certification 4–8 weeks; organisations that already hold ISO 27001 usually reach certification in 4–6 months, from scratch about 6–9 months
- Division of roles: we build the system and the evidence chain; legal opinions come from partner lawyers; certification is carried out by a certification body accredited under ISO/IEC 42006, which we accompany but do not stand in for
- Completed work (anonymous, under a non-disclosure agreement): an industrial automation manufacturer built an AI system inventory, completed AI risk classification, established algorithm review and human oversight for high-risk uses, and obtained ISO 42001 certification
Related questions
- Can we get ISO 42001 certified without developing AI ourselves? Yes. ISO/IEC 42001 applies to organisations that provide or use AI; for companies that only use purchased AI, the scope and controls focus on use, data input, output review and supplier management. ISO 42001 implementation
- Can only one of several entities be certified? Yes. Certify one entity or business group first; the scope statement must give the reasons for inclusion and exclusion, and external claims follow the certificate scope. How to choose an ISO 42001 consultant in Taiwan
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.