Three converging pressures have moved AI governance from a policy exercise into an operational discipline. Enterprise procurement now asks about it as part of standard supplier due diligence. UK and EU regulators have started applying much more specific supervisory attention to it. And board audit committees treat AI risk management as routine oversight now, not an exceptional agenda item. Any organisation deploying AI at material scale, whether internally or as a supplier, needs a governance framework that satisfies all three audiences with defensible evidence rather than intent statements. ISO 42001 is the framework that has emerged as the operative response.
The purpose of this piece is to explain what ISO 42001 actually is, why it sits at the centre of the current AI governance frontier, how it fits alongside the EU AI Act and consumer regulatory frameworks, and what the certification path looks like operationally for organisations that decide to pursue it.
Why AI governance became an operational discipline
The shift from policy exercise to operational discipline has been driven by three specific pressures, each of which materially changes what organisations have to demonstrate rather than merely publish.
Enterprise procurement now audits AI governance
AI governance has moved quickly from an occasional question in enterprise supplier due diligence to a routine one, with increasingly specific evidence requirements attached. Financial services procurement teams ask about AI risk assessment methodology, model governance, and third-party AI dependencies, while public sector tenders now routinely carry AI-related questions of their own. Across regulated sectors generally, enterprise buyers are asking for evidence that AI systems are managed under a recognised framework. The specific evidence they want is increasingly ISO-42001-shaped, because ISO 42001 provides the independently-certified frame procurement teams can rely on without conducting their own audit of each supplier.
The commercial risk is real, even if hard to see directly: a supplier without a defensible AI governance framework can be quietly dropped from a shortlist during prequalification, with no reason given and no way to know that AI governance was the deciding factor. Over quarters, missed opportunities like this accumulate. Over years, the gap between organisations with recognised AI governance and those without becomes commercially material.
Regulators are applying AI-specific supervisory attention
The Financial Conduct Authority now considers AI risk management as part of ongoing supervision, particularly under the Consumer Duty where AI-driven consumer decisions must produce evidenced good outcomes. The Information Commissioner's Office publishes AI-specific guidance and applies UK GDPR to AI systems making automated decisions about individuals. Sector-specific regulators (energy, healthcare, telecoms) are applying AI attention within their remits. The UK Cyber Security and Resilience Bill, currently progressing through the House of Lords with Royal Assent anticipated but not yet confirmed, will formalise cyber-adjacent AI supervisory expectations for critical infrastructure operators.
The EU regime is more advanced. The EU AI Act (Regulation 2024/1689) entered into force on 1 August 2024. Transparency and deployer obligations apply from 2 August 2026; watermarking obligations from 2 December 2026. High-risk system requirements were originally scheduled for 2 August 2026, but the Digital Omnibus on AI, adopted in July 2026, delayed them to 2 December 2027 for standalone high-risk systems and 2 August 2028 for embedded high-risk systems. Organisations providing or deploying AI in the EU, or supplying customers who do, need to be positioned against these dates specifically.
Audit committees now ask about AI risk management
Board audit committees increasingly include AI risk management in their standard oversight remit, with practical questions: what AI systems are we operating, what are their risk classifications, who is accountable for their management, what evidence do we produce that the management is working, and how are we positioned for the regulatory changes ahead. Broad policy commitments and references to internal working groups no longer answer those questions. Committees are asking for evidence.
What ISO 42001 actually is
ISO 42001 is the international standard for AI management systems, published in December 2023. It provides the management framework organisations use to identify, assess, and control the risks associated with AI systems throughout their lifecycle. The standard is structurally similar to ISO 27001 (information security management) and ISO 9001 (quality management), so organisations already certified to those standards have a real head start extending into ISO 42001.
What the standard actually covers, in practical terms, breaks into five areas.
Governance and accountability. Named executive accountability for AI systems. Documented decision-making authority. Clear roles for AI system development, deployment, and ongoing management. Board-level oversight arrangements.
Risk assessment methodology. A structured methodology for identifying and classifying AI risks. Risk registers that reflect actual AI systems and their specific risk profiles. Ongoing risk assessment tied to AI system lifecycle events (development, deployment, material change, retirement).
Lifecycle management. Documented management of AI systems from design through retirement. Change control. Testing and validation. Documentation standards.
Third-party AI dependencies. Explicit management of AI supplied by third parties (foundation models, AI-embedded software, AI services). Assessment of third-party AI risks against the organisation's risk methodology.
Continuous improvement. Feedback loops that identify governance gaps and drive systematic improvement. Internal audit. Management review.
None of this is technically novel. Organisations with mature ISO 27001 implementations recognise the structural pattern immediately. What ISO 42001 does is codify the pattern specifically for AI risks, in a way that produces certification evidence procurement teams and regulators recognise.
How it fits alongside the EU AI Act
A common source of confusion is whether ISO 42001 and the EU AI Act are alternatives, substitutes, or complementary. They are complementary. ISO 42001 provides the management framework, the EU AI Act imposes specific legal obligations, and the two work together in practice.
An organisation certified to ISO 42001 already has the management framework that supports AI Act compliance: the governance, risk assessment, lifecycle management, and third-party dependency management that compliance requires, the evidence trail supervisory authorities expect, and the internal audit and management review that surface compliance issues before they become regulatory findings.
An organisation subject to the AI Act still has to comply with the Act's specific obligations regardless of ISO 42001 certification: transparency obligations from 2 August 2026, watermarking obligations from 2 December 2026, and high-risk system requirements from 2 December 2027 or 2 August 2028 depending on classification, now confirmed following the Digital Omnibus on AI's formal adoption. Certification supports compliance; it is not a substitute for it.
The practical implication for organisations planning both is that ISO 42001 certification is best pursued in advance of the AI Act obligations that would depend on the same underlying management framework. Certification takes typically nine to twelve months of preparation followed by a two-stage audit. Organisations that want the framework in place ahead of the 2 August 2026 transparency obligations should be well into preparation now. Organisations targeting the December 2027 or August 2028 high-risk system dates have more time, but pulling certification forward reduces the risk of trying to build framework and demonstrate compliance simultaneously.
How it fits alongside Consumer Duty and sector regulation
For FCA-regulated firms, ISO 42001 also supports Consumer Duty compliance. The AI management framework produces the evidenced good outcomes documentation that Consumer Duty supervisors expect for AI-driven consumer decisions. Governance and risk assessment satisfy the consumer support outcome expectations. Third-party AI management addresses the increasingly common situation where AI-driven consumer decisions rely on third-party foundation models or AI services.
For firms in sector-specific regulatory contexts (healthcare AI, energy sector AI, telecoms AI, education AI), ISO 42001 provides the underlying framework that sector-specific compliance requirements build on. It does not replace sector-specific compliance work, but it provides the foundation that makes sector-specific work more efficient and more defensible.
What the certification path looks like operationally
A typical ISO 42001 certification engagement covers three phases.
Preparation and gap assessment
The first phase, typically three to four months, covers gap assessment against the standard, framework design, and initial implementation. This is where the AI risk register gets built, the governance arrangements get formalised, the lifecycle management processes get documented, and the third-party AI dependency management gets structured. Organisations with mature ISO 27001 implementations move through this phase materially faster than organisations without.
Implementation and evidence-building
The second phase, typically four to six months, covers embedded operational implementation. The framework has to operate in practice. Evidence of operation accumulates through routine business activity: risk assessments performed, changes managed, audits conducted, management reviews held. This phase is where organisations that treated ISO 42001 as a documentation exercise are found out, because certification requires evidenced operation, and documentation alone will not pass it.
Certification audit
The third phase is the two-stage certification audit by an accredited certification body. Stage one reviews documentation and framework design. Stage two verifies operational evidence. Certification, once achieved, requires annual surveillance audits and full recertification every three years. The framework has to operate whether the organisation is certified or not. What ongoing certification adds is independent verification, which is what procurement teams and regulators actually recognise.
At Contact Labs Group, ISO 42001 certification is delivered through StandardsLabs in partnership with a UKAS-linked certification body platform that handles the audit and formal certification. The framework design, gap assessment, implementation support, and ongoing operational support are delivered by the CLG StandardsLabs team in coordination with AILabs Governance and Ethics for the AI-specific technical depth.
Where to start
Organisations considering ISO 42001 certification typically fit three profiles: already ISO 27001 certified and looking at 42001 as the natural extension into AI governance, where the existing implementation gives a material head start; facing specific procurement gate pressure where AI governance evidence is being asked for and cannot yet be provided, where certification is the fastest defensible response; or preparing for the EU AI Act obligations that begin in August 2026 and wanting the framework in place ahead of compliance timelines, where certification pulls the framework forward.
The discovery call is the fastest route into a scoped conversation. The StandardsLabs ISO Certifications sub-service covers the certification path in more detail. AILabs Governance and Ethics covers the applied AI technical depth that certification requires.
This piece is the first in a series on the standards and regulatory frontier. Future instalments cover EU AI Act operational implementation, Consumer Duty for AI-driven consumer decisions, and DORA operational fallout for financial services technology suppliers.