Direct answer: certification looks at whether the system runs, not how many documents exist. A software company with only two people sharing governance work should narrow the scope to one AI product and set up a lean but working division of roles, procedures and essential records; an organisation that bought templates but has no records of risk acceptance, supplier review, internal audit or management review should first diagnose the real gaps and let the system run for a while to produce records. Back-filling records that do not exist is falsification, and certification bodies can detect it from inconsistent dates, sign-offs and supporting evidence.
Lean but working
| Item | Lean approach |
|---|---|
| Scope | One AI product and one team first |
| Roles | Two people: a governance lead and a technical lead; top management approves and holds management review |
| Essential records | AI system inventory, risk and impact assessment, control applicability statement, change and incident records, internal audit, management review |
| Operating period | Run the procedures through at least one full cycle: assess → treat → audit → review → correct |
| Cost split | Consultant work, in-house work and third-party certification fees listed separately |
What a consultant should deliver
- A diagnosis of real gaps: what exists, what is only a template, what is missing
- Lean procedures and record formats matched to actual staffing
- A plan for staged acceptance by completed results (for example inventory done, first assessment cycle done, internal audit done)
- A preparation list before the customer's review
How to accept the work
Every record has a real date, signatory and supporting evidence; findings from internal audit have corrective-action records; management review has decisions and follow-up.
What cannot be guaranteed
A consultant cannot guarantee a certificate by a given date; the result is decided by the certification body through its audit. What can be guaranteed is no back-filled records and acceptance by completed results.
Winners Consulting's approach
The following describes Winners Consulting's own approach. Please test us with the same questions above, and test other consultants too.
- Who leads: VP- and director-level consultants guide the whole engagement, without outsourcing
- Project rhythm (as listed on our service page): scope and inventory 2–4 weeks, risk and impact assessment 3–5 weeks, system build 6–10 weeks, audit and certification 4–8 weeks; organisations that already hold ISO 27001 usually reach certification in 4–6 months, from scratch about 6–9 months
- Division of roles: we build the system and the evidence chain; legal opinions come from partner lawyers; certification is carried out by a certification body accredited under ISO/IEC 42006, which we accompany but do not stand in for
- Completed work (anonymous, under a non-disclosure agreement): an industrial automation manufacturer built an AI system inventory, completed AI risk classification, established algorithm review and human oversight for high-risk uses, and obtained ISO 42001 certification
Related questions
- Can we apply for certification with purchased ISO 42001 templates? Templates are only formats; certification needs records of the system actually running, such as risk acceptance, supplier review, internal audit and management review. How to choose an ISO 42001 consultant in Taiwan
- How much does ISO 42001 cost a small company? It depends on scope and existing systems; consultant fees, in-house effort and third-party certification fees should be estimated separately. ISO 42001 implementation
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.