ISO/IEC 42001 READINESS

Build a structured AI management system. Prepare with purpose and evidence.

GLIE Legal helps organisations assess their readiness for ISO/IEC 42001 and develop an AI management system tailored to their activities, risks and organisational context.

We connect governance responsibilities, risk and impact assessment, documented processes and implementation evidence. The aim is a system your teams can operate and maintain, not simply a collection of documents.

Discuss your ISO/IEC 42001 readiness

Who this service is for

For organisations seeking a structured approach to AI management, whether they are exploring certification or preparing an existing system for external review.

Organisations developing or using AI that want to formalise their management arrangements.
Businesses responding to customer or procurement expectations for structured AI governance.
Organisations seeking to integrate AI management with existing information security, quality or risk processes.
Teams that have already started building an AI management system and need a structured readiness review.

From initial gaps to an operational system

The engagement can begin with a readiness diagnostic and extend into implementation support, according to the agreed scope.

Scope and readiness assessment

Define the proposed AI management system boundaries, relevant activities and organisational context. Review existing arrangements and identify gaps against the standard’s requirements.

Policy, objectives and responsibilities

Develop or refine the AI policy, management objectives and assigned roles. Connect leadership oversight with operational responsibilities and measurable implementation priorities.

Risk and impact assessment

Design practical methods for assessing AI risks and impacts, agree evaluation criteria and support their application to the use cases within scope.

Controls and documented processes

Support the selection and justification of relevant controls. Develop the agreed documentation for lifecycle oversight, suppliers, competence, changes, incidents and supporting records.

Implementation and system integration

Help process owners translate documented arrangements into working practices. Where appropriate, connect the AI management system with existing processes to reduce unnecessary duplication.

Review and certification preparation

Support management review preparation, organise evidence and conduct an agreed pre-certification readiness review. Identify outstanding actions and support responses to external audit findings.

Practical outputs, not document volume

Depending on the agreed scope, deliverables may include:

A readiness assessment and prioritised implementation roadmap.
An AI management system scope statement.
An AI policy, objectives and responsibilities matrix.
Risk and impact assessment methods and populated registers for agreed use cases.
A Statement of Applicability with documented control-selection rationale.
An agreed set of procedures, templates and implementation records.
An internal audit programme design and management review pack.
A pre-certification findings report and action tracker.

The scope and effort depend on the complexity of the AI activities, the number of use cases, existing management arrangements and the depth of implementation support required. Deliverables are defined in the engagement proposal.

How the engagement works

Assess and define

Agree the system boundaries, review existing practices and establish a prioritised picture of readiness gaps.
Design and document

Develop the agreed management arrangements, assessment methods, controls and supporting documentation.
Implement and gather evidence

Work with process owners to apply the arrangements, maintain records and identify practical implementation issues.
Review and prepare

Review readiness, support management review and prioritise remaining actions before any planned certification assessment.

Readiness support. Independent certification.

GLIE Legal provides advisory and implementation support. It does not issue ISO/IEC 42001 certificates. Any certification assessment and decision are undertaken by a separate certification body, and certification is not guaranteed.

A pre-certification readiness review is not presented as an independent internal audit. Internal audit delivery, where required, is separately scoped with appropriate arrangements for objectivity and impartiality.

ISO/IEC 42001 certification does not, on its own, establish compliance with the EU AI Act. System-specific legal obligations and any required conformity assessment are addressed through a separately defined regulatory workstream.

Certification body fees, specialist technical testing and services outside the agreed scope are not included unless expressly stated.