Inventory
AI systems in use and under development. Own and third-party.
CA-07 · AI governance · cluster
ISO 42001 AI management
ISO 42001 structures how an organisation governs its AI systems: roles, risks, lifecycle, controls. Cluster Calidad + Consultoría + IA for AI Act.
ISO 42001 is the first international standard dedicated to the management of artificial intelligence systems. Published in 2023 and still without implementers with traction among Spanish SMEs, it opens a clear window of opportunity for those who want to get ahead of regulation.
The standard covers five areas: AI-specific policy and roles within the organisation, risk analysis for each AI system in use, model lifecycle (from training data to decommissioning), data and decision traceability, and internal audit of system performance.
In practice, ISO 42001 is the natural backbone for supporting compliance with the European AI Act, which comes into full effect on 2 August 2026 for high-risk systems. That is why we implement in a cluster with Summum Consultoría (technical AI Act) and Summum IA (modelling and evaluation layer): three disciplines, a single implementation.
The ISO 42001 AI management process.
The process · four stagesManagement system
Policy, roles, procedures.
Lifecycle
From data to model decommissioning, documented controls.
Certification
Internal and external with ENAC. Maintenance.
What is included
What ISO 42001 AI management includes.
The operational detail: what we deliver as part of the engagement and what we keep active afterwards.
-
AI-specific policy and roles
Committee, responsibilities, resources.
-
Risk analysis per system
AI-specific matrix.
-
Model lifecycle
From training data to decommissioning. Traceable.
-
Data and decision traceability
End-to-end auditable.
-
Internal AI audit
3 months before the external one.
-
Technical AI Act cluster
42001 + AI Act + technical AI. Three disciplines.
Regulatory framework
The regulatory framework.
42001 is ISO. AI Act is regulation. They work together.
ISO/IEC
42001
Applicable to this service
EU
AI Act
Applicable to this service
AESIA
guidelines
Applicable to this service
ENS
IA
Applicable to this service
Summum cluster
How it intersects with related services.
42001 alone does not cover the AI Act. AI Act without a management system is not sustainable. Pure Summum cluster.
Frequently asked questions about ISO 42001 AI management.
Is it mandatory?
Not legally. Strongly recommended as an AI Act pillar.
Certification bodies?
AENOR, BV, BSI, SGS. We coordinate the selection.
How long does it take?
2–4 months if you already have 27001/9001. 4–6 months from scratch.
Shall we build it with you?
AI Act cluster
Completes the ecosystem.
ISO 42001 is the technical implementation. Legal compliance and governance are handled by our sister divisions.
AI Act cluster
Completes the ecosystem.
ISO 42001 is the technical implementation. Legal compliance and governance are handled by our sister divisions.
AI Act cluster
Completes the ecosystem.
ISO 42001 is the technical implementation. Legal compliance and governance are handled by our sister divisions.
AI Act cluster
Completes the ecosystem.
ISO 42001 is the technical implementation. Legal compliance and governance are handled by our sister divisions.