ISO/IEC 42001 implementation, from scope to audit
Scope definition, gap assessment against the standard, AIMS design, documentation, controls, statement of applicability, internal audit, and readiness ahead of the certification audit. Wired into the management systems you already run.
→ What the standard asks of you
AI Governance Officer, fractional
The role held part time on a fixed monthly commitment. New AI initiatives reviewed as they arrive, the register kept current, regulatory change monitored, advice to management, a monthly report. Rolling engagement, including as a bridge until you hire.
Rolling, monthly.
ISO/IEC 42001 readiness diagnostic
How far you are from the standard and in what order to close the gaps. You receive a gap assessment, a review of the evidence you already hold, a prioritised risk list, a ninety day plan and a summary for management.
One to two weeks from the point I have your documentation and access to your people.
EU AI Act for organisations deploying GenAI and agents
Role determination, use case classification against the Regulation, and obligations mapped onto how your systems are actually built.
Two to four weeks, scaling with the number of use cases.
From requirement to control
Requirements translated into controls that live in delivery. Criteria in release gates, agent lifecycle from intake through monitoring to retirement, ownership of each step, and evidence that accumulates while the work runs.
→ Governance for AI agents and agentic systems
Internal audit of your AIMS
The standard requires internal audit conducted with objectivity and impartiality. Organisations run it themselves where they have the competence and the independence to do so. Where they do not, or where they want a rehearsal before the real thing, I run it. I do not audit a system I built myself: impartiality applies to me as well.
One to two weeks, depending on the scope of the management system.
Board and leadership workshop
What the AI Act and ISO/IEC 42001 mean for your organisation specifically, what you are exposed to, and who should be accountable. Materials and a list of first steps.
Half a day, or a full day where the group works through its own use cases.
Also available
A second opinion on documentation you already hold. A review of your AI and ICT third-party risk process. Support with customer compliance questionnaires. Preparation for surveillance audits after certification.
Timelines above are approximate. How long the work takes depends on how quickly people and documents are made available, how much governance already exists, and how many systems are in scope.