Question 1

What is ISO/IEC 42001?

Accepted Answer

ISO/IEC 42001:2023 is the world's first certifiable AI Management System standard, published in December 2023. It provides a risk-based approach to AI Governance and follows the same High-Level Structure as ISO 9001, ISO/IEC 27001 and ISO/IEC 27701, so it extends the management systems an organisation already runs rather than replacing them. It adds requirements no other standard covers: the AI System Impact Assessment, data quality and bias management, AI lifecycle governance, explainability, and AI-specific Annex A controls.

Question 2

What is AI Governance and why does it matter to my business?

Accepted Answer

AI Governance is the set of decisions, checks and records that ensure the AI an organisation uses does what was intended, keeps doing it, and can be explained when someone asks. It matters because AI failures scale: a biased human decision affects one person, while a biased model affects everyone it processes, silently, until somebody measures it. Informal governance fails for three structural reasons: it is not systematised, it is not auditable, and it does not scale.

Question 3

Why should my business certify to ISO 42001?

Accepted Answer

Four reasons: risk reduction through proportionate controls for bias, privacy, security and safety; shareholder and investor trust backed by an accredited certificate rather than a promise; competitive advantage in markets where AI trust is fragile and procurement teams increasingly require assurance; and legal compliance readiness, since the EU AI Act already applies and UK obligations are arriving through existing sector regulators.

Question 4

How long does ISO 42001 certification take?

Accepted Answer

Wright Frameworks' flagship programme takes an organisation to an audit-ready AI Management System in 12 weeks (Foundational AIMS, a single site with a small number of AI use cases) or 16 weeks (Full Scope AIMS, multi-site clients or a broader AI system inventory). The Stage 1 and Stage 2 certification audits that follow are scheduled with the independent certification body.

Question 5

How long does ISO 42001 certification last?

Accepted Answer

A certificate is valid for three years. It is maintained through surveillance audits, which spot-check high-risk areas and confirm the management system is alive and improving, and then renewed through a full re-certification cycle at year three, where auditors look for evidence of maturity and improvement rather than mere consistency.

Question 6

Does Wright Frameworks issue the ISO 42001 certificate?

Accepted Answer

No. Certification is awarded by an independent, accredited third-party certification body following a successful Stage 1 and Stage 2 audit. It cannot be issued by the person who helped implement the system, and any provider offering both should be treated with caution. Wright Frameworks prepares the organisation so that the audit is a formality, and supports it through the process.

Question 7

Does ISO 42001 work alongside ISO 9001 and ISO 27001?

Accepted Answer

Yes. ISO/IEC 42001 shares the High-Level Structure, clauses 4 to 10, with ISO 9001, ISO/IEC 27001 and ISO/IEC 27701. An organisation that already holds one of them has a risk register, document control, an internal audit programme and a management review, and ISO/IEC 42001 extends those to AI rather than duplicating them: one policy tree, one management review, one combined audit cycle.

Question 8

Does the EU AI Act apply to UK businesses?

Accepted Answer

It can. If a UK organisation places AI systems on the EU market, or the output of its AI is used in the EU, the Act reaches it regardless of where the business is based. Its obligations are risk-tiered, and the higher tiers require documented governance, risk management and human oversight, the same evidence an ISO/IEC 42001 management system produces.

AI Governance, run the way you run safety.

Every AI tool you use needs an owner, a control and evidence.

Our services. From a Readiness Assessment to an audit-ready AI Management System.

ISO/IEC 42001. What the standard asks, and what it builds on.