ISO/IEC 42001:2023 · AI Management Systems
Your business already uses AI. ISO/IEC 42001 is how you prove you are managing it responsibly: to your board, your customers, your insurers and, before long, your regulator. I take UK organisations from ungoverned AI to certification-ready, so you can scale AI models with confidence, without the jargon and without stopping the day job.
AI adoption has run ahead of AI governance almost everywhere. The rules are arriving unevenly, and faster in some places than others. Organisations that put a management system in place now will meet those rules from a position of readiness rather than a scramble.
In force in the EU
If you place AI systems on the EU market, or your AI output is used in the EU, the Act reaches you regardless of where you are based. Its obligations are risk-tiered, and the highest tiers demand documented governance, risk management and human oversight; that is the same evidence an ISO/IEC 42001 management system produces.
Developing in the UK
Rather than one cross-cutting AI act, the UK has so far worked through the regulators you already answer to (the ICO, FCA, MHRA, HSE and others), applying existing powers to AI. That means the obligations arrive through your sector, not through a single commencement date, and they arrive sooner than most boards expect.
Commercial pressure
The practical deadline is rarely legislative. It is the AI questionnaire in a tender pack, the insurer's renewal form, or the enterprise customer's supplier assurance review. Certification answers all three at once, with a certificate rather than a promise.
The short version: get ahead of the law rather than behind it. A management system takes months to build and days to evidence. That is the wrong way round if you start when the request arrives.
AI governance is simply the set of decisions, checks and records that make sure the AI your organisation uses does what you intend, keeps doing it, and can be explained when someone asks. It is not an ethics committee and it is not a document library. It is how the work actually gets controlled.
THE SCALE PROBLEM
A biased human decision affects one applicant. A biased algorithm affects every applicant, simultaneously, at machine speed, and keeps doing it silently until somebody measures it.
THE BLACK BOX PROBLEM
When a decision cannot be explained to the person it affects, accountability collapses. Regulators, tribunals and customers all ask the same question, and "the model decided" is not an answer.
THE EXPOSURE PROBLEM
Adversarial inputs, model drift, inference attacks that re-identify anonymised data, safety failures in physical systems. Your ISO 27001 controls were not designed to catch any of these.
01
Without defined processes, AI governance depends on one motivated individual rather than organisational capability. When that person leaves, the governance leaves with them.
02
Without documented evidence you cannot demonstrate anything to a regulator, a certification body or a customer. A policy nobody follows is worse than no policy; it is a written admission.
03
Two AI tools can be managed on goodwill. Twenty cannot. Informal checklists and occasional meetings become unmanageable exactly when the exposure becomes material.
Four reasons boards sign this off. They are not abstract; each one turns into evidence you can hand to somebody who is asking.
Benefit 01
Proportionate controls for the risks AI actually creates (bias, privacy, security, safety), so failures become less frequent, less severe and far less expensive when they do happen.
Benefit 02
A certificate from an accredited body is a statement your board, investors and insurers can rely on. Governed AI reads as a lower risk profile, because it is one.
Benefit 03
In markets where trust in AI is fragile, certification differentiates. Customers, partners and procurement teams choose the governed option, and increasingly they are told to.
Benefit 04
Already law in the EU under the AI Act, and developing in the UK through existing regulators. A management system aligns you now, so the rules land on a structure that is ready for them.
A risk-based approach to AI governance and, importantly, not a separate world. It follows the same High-Level Structure as the management systems you may already run, so it builds on what you have rather than starting again.
If you hold ISO 9001 or ISO/IEC 27001, you already have a risk register, a document control system, an internal audit programme and a management review. ISO/IEC 42001 extends them to AI rather than duplicating them: one policy tree, one management review, one combined audit cycle.
It adds what no other standard covers: the AI System Impact Assessment, data quality and bias management, controls across the full model lifecycle, and explainability requirements. Current risks are structured; future ones are scanned for deliberately.
One structure, shared across the family
What could go wrong for the organisation (regulatory, reputational, operational, security, financial), and how likely and severe would it be?
What is the real-world footprint on the people it affects: human rights, fairness, safety, privacy, environmental and societal effects? Both are required. Risk is the forecast; impact is the footprint.
Engage us for the whole journey or for the one part you are stuck on. Everything is delivered as documentation you own, in language your team can actually use.
01
A short, structured diagnostic that answers the question before any other work starts: should you adopt or scale AI at all, and on what conditions? Evidence-based scoring across the dimensions that actually predict success, not a self-assessment questionnaire.
You receive a clear recommendation (proceed, proceed with conditions, pilot only, remediate and re-assess, or do not scale yet) and, where relevant, a costed plan for closing any gaps.
Discuss this02
A facilitated session, or short series, with your leadership team, turning “we should probably do something with AI” into a prioritised, realistic plan.
Which use cases are worth pursuing, which aren't yet, and what sequence makes sense given your data, your people and your risk appetite.
Discuss this03
Ongoing hands-on support as AI use cases move from pilot to business-as-usual. Advisory input, not systems integration.
Available as a day-rate retainer once you are past the initial assessment or strategy stage and need a steady hand through delivery.
Discuss this04
Flagship programmeA structured 12- to 16-week programme that takes a process manufacturing client from wherever they currently stand to a working, audit-ready AI management system conformant with ISO/IEC 42001.
Two tracks, scoped by site count and the number of AI use cases in scope, not by company size alone.
See the two tracks05
For clients already running several disconnected AI or analytics systems, built independently, with no shared standards and no single view of what is in production.
The engagement reframes the ask from “merge everything into one system” to one platform, one management system, many governed use cases. It starts with its own short readiness assessment, then runs a phased programme, typically around 64 weeks across five phases, that delivers value early through a time-boxed, governed pilot, rather than making you wait months for governance to finish before anything visible happens.
Discuss thisThe flagship programme
Scoped by how many sites and how many AI use cases are in scope, rather than by headcount. Both end in the same place: a working AIMS you own, ready for an independent audit.
Foundational AIMS
A single site with a small number of AI use cases in scope.
Full Scope AIMS
Multi-site clients, or a broader AI system inventory.
Certification Support
Prepares you for the independent certification body audit. The audit fees themselves are a direct cost of yours, paid to the certification body, and sit outside anything quoted for either track.
Both tracks are quoted individually once the scope is clear. Ask for a figure at the introductory briefing and you will get one in writing.
A note on certification. Certification is awarded by an independent third-party certification body. It cannot be issued by the person who helped you implement, and you should be wary of anyone who offers both. My job is to get you to the point where that audit is a formality, and to be in the room while it happens.
Seven steps, from measuring the distance to holding a certificate and keeping it. The first three are delivered with me as part of the flagship AIMS programme. The last four belong to an independent certification body; I prepare you for them and sit in the room. Scroll through to see what happens at each step and what you end up holding.
My background sits inside one industry family, process manufacturing, but from two different vantage points. Chemical engineering gives me a general, systems-level understanding of the whole family; two industries within it, petrochemicals and brewing, are where my delivery experience actually runs deep. The labels below tell you which is which.
A chemical engineering foundation underpins this, not one single sector. Process manufacturing runs on the same underlying logic wherever the product changes: engineered systems, safety cases, quality control, continuous improvement. That grounding means I can follow an AI governance conversation in most process manufacturing environments without needing the fundamentals explained first.
Fourteen years inside petrochemical operations, where process safety management is already how the plant runs, not a document on a shelf. ISO/IEC 42001 slots into that same discipline: same audit programme, same evidence, extending what you already run rather than duplicating it.
Twelve years in brewing and FMCG, including managing a $20m capacity upgrade, in an environment where quality and food-safety systems are already mature and well understood. Forecasting, yield optimisation and automated inspection are usually where AI appears first on the production side, and governance needs to sit alongside those existing checks, not be added as an afterthought.
Most AI governance advice comes from people who have never had to make a management system survive contact with a real operation. I have spent twenty-six years inside heavy industry, where a control that only works when someone is watching is not a control; it is a hazard.
I bring the discipline of process and project engineering to AI governance: define the system, evidence it, audit it, improve it. No theatre, no 200-page policy nobody reads.
A process manufacturing industry where AI governance is as fundamental as process safety; plants can scale their AI as confidently as they scale any other management system, without increasing the risk.
We guide process manufacturing plants on the journey to AI governance readiness and ISO/IEC 42001 certification, combining AI standards mastery with 26 years' hands-on engineering experience across the manufacturing value chain and structured change management.
Background & credentials
Global AI Certification Council (GAICC), accredited in the UK through the CPD Standards Office. Verify this accreditation
Executive certification in leading AI adoption and its organisational implications. Verify this certificate
Brewing and petrochemicals: operations that run continuously, where management systems are load-bearing rather than decorative.
A risk-based, systems-first way of thinking that maps directly onto how ISO/IEC 42001 asks you to govern AI.
Formal project discipline: scope, stages, evidence and closure, applied to implementation programmes.
PMP certification held from 2010 to 2013.
Process engineering, project engineering, operations management, and maintenance and reliability technical advisory.
Wayne Wright
Founder, Wright Frameworks Ltd · London, United Kingdom
Start with a free 30-minute introductory briefing. No slides and no pitch. We walk through where AI already sits in your operation, what ISO/IEC 42001 would actually require of you, and whether it is worth your time. You will get a straight answer either way.
It is switched off in this browser, so the form cannot send. Nothing is lost — email enquiries@wrightframeworks.co.uk with your name, organisation and a sentence about your AI systems, and you will have a reply within one working day.
The same address works if the form fails for any other reason.