We use AI tools but don't build models. Is ISO 42001 relevant?

Yes. ISO/IEC 42001 applies to organisations that develop, provide or use AI systems. You do not need to build a model for AI governance to matter.

The question is how AI is used in your work, what risks it creates and who is responsible for managing them. Using a third-party AI tool changes your role, but it does not answer those questions for you.

Start with the use, not the model

A useful starting point is an inventory of AI tools and activities. Record who uses each tool, its purpose, the information it receives and what happens to its outputs.

An internal writing assistant and a tool used in customer decisions can have different consequences. Consider where people review outputs, what information can be entered, how suppliers are assessed and how problems are reported.

ISO 42001 provides a framework for managing AI-related risks and opportunities through an AI management system. Certification concerns that management system within its defined scope; it is not a promise that every AI output is correct.

What should we prepare for a scope discussion?

Bring:

• The AI tools used and the business activities they support.
• Your role: user, developer, provider, or a combination.
• The teams, locations, suppliers and information involved.
• Existing policies, responsibilities and review processes.
• Any customer or contractual certification requirements.

Using AI does not, by itself, make certification compulsory. Relevance depends on your activities, risks and requirements. ACS can discuss the proposed certification scope and the information needed for a quote.