ISO/IEC 42001:2023 is the first international certifiable standard for AI Management Systems (AIMS). Published December 2023, it covers the full AI lifecycle in the organization: policies, roles, risk management, impact assessment, vendor control, continuous improvement.
If your company is adopting generative or classical AI, ISO 42001 is the roadmap that prevents improvisation. Here's a 5-step guide to start without getting stuck in theory.
1. Discovery: what AI do you already have (whether you know it or not)?
Before "adopting responsible AI" you need to know what AI the organization uses today. This includes: Microsoft 365 / Google Workspace copilots, individual ChatGPT/Claude/Perplexity use (shadow AI), AI embedded in ERP/CRM, custom-trained models, AI APIs in your software products.
Typical inventory takes 2-3 weeks and produces the #1 AIMS asset: the AI systems register.
2. Define the AI policy (shorter than you think)
The standard requires a top-management-approved AI policy. It doesn't need to be a 40-page document. Effective policy fits in 3-5 pages: purpose/scope, principles (transparency, non-discrimination, human oversight, data protection), roles, prohibited cases, review cycle.
3. AI Impact Assessment (AIA)
The core of ISO 42001. For each system in the inventory, assess risks to: people (bias, discrimination), data (leakage via prompts), operations (hallucinations, vendor lock-in), legal (data protection compliance, IP).
4. Annex A controls: the 10 clusters
ISO 42001 has 39 controls in 10 clusters. Most commonly failed in first audit: A.6.2.4 (fair data use), A.7.2 (roles), A.8.3 (model cards), A.9.3 (monitoring), A.10.4 (vendor management).
5. Internal audit + roadmap to certification
Before hiring a certification body, do an internal audit. Typical timeline for Colombian orgs of 50-200 people with AI in production: 7-10 months total from discovery to certification.
Recommendation: start with the inventory. That single asset reduces shadow AI risk and prepares the org for any next step, whether formal ISO 42001 or internal adoption.
How we can help
Expansión TI accompanies organizations in AIMS diagnosis, design, and implementation. We've worked with LATAM technical and compliance teams since 2010 and consult on the three core standards: ISO 42001, ISO 27001, and ISO 20000.