I am asked more and more often how to implement ISO 42001. My answer does not change: it is not an audit you endure once a year. It is a management system your company must own and keep alive. I can audit or support. The real work stays with you.

As a reminder, ISO/IEC 42001 has existed since December 2023. It is the first international standard that frames the management of artificial intelligence in an organization. It applies to any company that develops, provides, or uses AI systems, regardless of size or sector.

You probably already have AI, even if you do not know it

The first reflex of an SMB president is to tell me there is no AI in the company. They do not build models. They have no data science team.

The standard does not only target companies that build AI. It also targets those that use it. Copilot in Microsoft 365, a chatbot on your website, a hiring screening tool in HR, a browser extension wired to ChatGPT, an automated pricing system at your insurer: that is already AI in your operations.

In my first meetings, I almost always find that three or four departments already use AI tools with no approval process, no policy, and nobody keeping the list. That is the real starting point of the standard, not the theory.

If nobody in your company keeps the list of AI tools already in use, you are not “AI-free.” You are governance-free.

ISO 27001 is not ISO 42001

Many people tell me: “We already have ISO 27001, we must be covered.” No.

ISO 27001 protects the confidentiality, integrity, and availability of information. ISO 42001 asks different questions. Does your AI system treat people fairly? Can its decisions be explained? Does someone actually monitor how it is used day to day, not only how it is configured?

An AI system can meet all your information security rules and still be biased, opaque, or poorly governed. The two standards complement each other. One does not replace the other.

What is a high-risk AI system?

This is the question that determines how much rigor to put on each tool. Five simple criteria are enough to situate yourself.

Influence over a person

The system influences or makes a decision about a person: hiring, credit, pricing, access to a service.

Personal information

It processes personal information.

Decision without human review

A decision takes effect without human review beforehand.

Confidential or strategic data

It touches confidential or strategic data for your company.

Operational dependence

Your company would become vulnerable if it went down or gave a bad answer: in other words, you depend on it operationally.

The more criteria a tool matches, the tighter the governance it needs. A tool that summarizes internal emails does not need the same treatment as a tool that filters job applications.

The nine Annex A control families

ISO 42001 works like ISO 27001: management requirements in the body of the standard (context, leadership, planning, support, operation, evaluation, improvement) and an Annex A with 38 controls grouped into nine themes. You justify which ones apply to you in a statement of applicability, exactly as in ISO 27001.

If you only use SaaS tools without developing models, some controls may not apply. I covered that case in ISO 42001: Your SMB Only Uses ChatGPT?.

Here are the nine themes and what a well-organized SMB looks like for each.

A written policy that states what your company allows, forbids, and governs. An organized SMB wrote it from its real tools, not copied from a generic template.

Internal organization

Clear roles and responsibilities. At minimum: an owner for the AI file, an approval mechanism for new tools, and an escalation path when a risk is identified.

Resources for AI systems

Evidence that you allocated the skills, data, and infrastructure required, not just plugged in a tool and hoped it would work.

Impact assessment

A structured analysis of what could go wrong with a given system, done before deployment. An organized SMB documents this analysis for every high-risk tool, not only for ones it develops itself.

AI system lifecycle

From acquisition to retirement, every system is documented, tested, and tracked. A retired tool leaves the inventory; it does not linger half-forgotten.

Data for AI systems

The quality, provenance, and legality of the data that feeds your systems. This is where Quebec’s Law 25 and ISO 42001 meet directly whenever that data includes personal information.

Information for interested parties

Your clients and employees know when they interact with an AI system and understand its limits. Transparency is not optional.

Responsible use of AI systems

Concrete rules for employees on what they may submit to an AI tool, especially confidential or personal information.

Third-party relationships

Your AI vendors meet the same expectations you do. A contract silent on your vendor’s AI risk management is an incomplete contract.

Full certification or progressive alignment?

For most Quebec SMBs, aiming for full certification from day one is not the right goal.

Certification makes sense if a client contract requires it, if you sell into regulated sectors such as health or finance, or if direct competitors already use it as a sales argument. Without one of those precise business reasons, certification is an investment that often exceeds what your company can justify this year.

The realistic goal for most: align progressively on the same nine themes, without chasing a certification audit right away. Adopt a shared vocabulary for AI in your company (ISO 22989 provides one), structure impact assessments for your most sensitive projects (the spirit of ISO 42005), and manage known risks systematically (ISO 23894). I listed the other related standards in Around ISO 42001: which standards to govern AI. Certification can follow later, when the business case justifies it.

I do not decide whether you should certify. Your board, your market, or your clients must decide that. My role is to help you see clearly where you stand, not to sell you a goal you do not need.

Prepare your teams before I arrive

Here is what separates a productive first meeting from one where everyone improvises. It is also, in practice, a maturity test: if you have no inventory, no owner, no use rules, and no approval mechanism, you are essentially at level zero, whatever your website says about responsible AI.

Inventory the tools already in use

Including spontaneous initiatives. For each tool, note: name, internal owner, vendor, real use, users or departments involved, data processed, whether personal information is present, potential impact on a person, and a criticality level (low, medium, high based on the five criteria above). An employee’s personal ChatGPT or a browser extension counts as much as an official system.

Classify each tool by risk level

That classification, not the raw inventory, tells you where to focus first.

Name an internal owner for the file

Not necessarily an IT specialist. Someone with the authority to convene the right people and drive decisions forward.

Write use rules, even short ones

What employees may submit to an AI tool, what is forbidden, and whom to ask when in doubt.

Put an approval mechanism in place for new tools

Without it, every department keeps adopting tools on its own and your inventory is already obsolete the following month.

Gather what already exists

Your security policy, your personal information protection policy required by Law 25, your contracts with cloud providers and AI vendors. Half of the governance work is often already written elsewhere, scattered across documents that do not talk to each other.

Tell your teams: this is not a witch hunt

The goal is not to find who used a tool without permission. It is to understand how AI is actually used so you can govern it properly.

When I arrive at an SMB for a first meeting, I never ask to be shown an AI system. I ask to be shown the list of tools your teams use every day. I have already seen that list scribbled on a sticky note stuck to a monitor. That is not the format an auditor will look for in the end, but it is an honest starting point, and it is already more than most companies have in hand.

If you only do five things this week

1. Inventory

List the AI tools used in your company.

2. Classification

Classify each tool by risk level.

3. Owner

Name an AI owner.

4. Use rules

Write rules, even brief ones.

5. Approval

Put an approval mechanism in place for every new tool.

None of these five actions requires a consultant or a certification budget. They require one hour of meeting time and management’s willingness to decide.

In short

ISO 42001 will not manage your artificial intelligence for you. It gives you a framework to do it yourself, with or without certification at the end. I am curious how many of you already have an up-to-date list of AI tools in your company.

Does this hit home? Let’s talk.