ISO/IEC 42001

An AI management system people can actually use.

Readiness, implementation and internal assurance for accountable AI governance.

Discuss ISO support

Who this helps

Built around a buying situation.

Organisations developing, providing or using AI
AI, risk and compliance leaders
Teams preparing for independent certification

Useful when

The trigger is already visible.

Customers are asking how AI is governed
AI use has outgrown informal approval
An ISO/IEC 42001 readiness or certification programme is planned

The position

An AI management system people can operate.

ISO/IEC 42001 is a management-system framework for establishing, implementing, maintaining and continually improving responsible AI governance. Pegasus translates that framework into an inventory, roles, lifecycle controls, risk decisions and evidence matched to how the organisation develops, provides or uses AI.

A defined scope and accountable decision owners

Controls matched to the real operating context

Evidence that can be reviewed, tested and improved

Scope

What the work includes.

Every engagement is scoped around authority, operating context, available evidence and the decision that must be made.

AI context and inventory

Define organisational context, interested parties, AI-system inventory, scope, roles and governance objectives.

Policy, risk and lifecycle controls

Build proportionate policy, risk, impact, lifecycle, supplier, data, competence and monitoring controls.

Readiness and internal audit

Test implementation through internal audit, management review and a prioritised readiness plan before independent assessment.

Method

A controlled route from exposure to evidence.

Decision points, responsibilities and verification stay visible from the start.

Discover

Define the exposure, context, evidence, owners and decision that matters.

Design

Select proportionate controls and make responsibilities and hold points visible.

Implement

Embed the agreed system into the real operating workflow.

Verify

Test whether controls work and whether the evidence supports the conclusion.

Improve

Close actions, learn from exceptions and strengthen the system over time.

Outputs

Evidence designed for use.

Scope and evidence map

Prioritised findings and action ownership

Practical control or implementation pack

Verification record and next-step roadmap

Professional boundaries

Precision includes saying what the work does not claim.

Pegasus does not issue accredited certification.
Certification remains the decision of an independent certification body.

Questions answered

Before you scope the work.

Can Pegasus certify an organisation to ISO/IEC 42001?

No. Pegasus provides consultancy, implementation and internal-assurance support. Accredited certification is a separate decision made by an independent certification body.

Does ISO/IEC 42001 apply only to AI developers?

No. It can apply to organisations that develop, provide or use AI systems. The management-system scope and controls must reflect the organisation's actual role.

Can ISO/IEC 42001 integrate with ISO 27001 or ISO 9001?

Yes. Their management-system structures can be aligned, while retaining the distinct risks, controls and evidence each discipline requires.

Authoritative references

BSI: ISO/IEC 42001 AI management systems

External references support context; they do not imply endorsement of Pegasus.

Start the conversation

Bring the exposure. Leave with a controlled route forward.

A first conversation is used to understand context, authority and the decision required—not to force a predetermined package.