packets.build
AI governance is the operating system for how your company invents, buys, and uses AI systems: inventory, roles, impact, data, monitoring, and suppliers. ISO 42001 is the certifiable management-system shape of that work. The EU AI Act is regulation. NIST AI RMF is guidance without a certificate. This hub is the umbrella. The ISO 42001 certification guide is the primary standard track. Do not collapse them into one blog tag.
Packets works with AI-native teams who get model and data questionnaires from US and EU buyers. Software can store policies. The program still needs a person who will change production when the inventory says an agent should not act unattended. That person is the difference between a policy pack and an operating AIMS.
What the program includes
List every model, vendor API, agent, and evaluation stack. Name who may approve a new use case. Record what data goes in and out. Decide human oversight for high-impact actions. Watch drift and incidents. Retire systems on purpose. ISO/IEC 42001 turns that into an AIMS you can audit. NIST AI RMF maps similar themes without Stage 1 and Stage 2. The EU AI Act adds legal roles and prohibitions when you are in scope.
ISO 27001 remains the ISMS for the information those systems touch. Privacy law remains privacy law. This umbrella does not eat them. See ISO 27001 and data privacy and operations.
ISO 42001 vs NIST AI RMF vs the EU AI Act
ISO 42001: certifiable AIMS. Official page ISO/IEC 42001. NIST AI RMF: voluntary risk framework, useful mapping, no certification scheme. EU AI Act: law. Cluster posts will compare NIST and 42001 in Week 2. This hub only needs the split so you do not buy "AI Act certified" software.
Major GRC vendors now ship ISO 42001 modules. That closed the empty-SERP window, not the need for implementation. Packets vs a tool: Packets vs Scrut.
How Packets runs this work
A named lead plus agents: inventory workshops, impact assessments, vendor records, evidence tied to production. Pages: AI governance, platform AI governance, implementation. We do not certify the AIMS. We do not replace counsel on the Act.
A 30-day start
- Inventory including shadow tools.
- One impact assessment on the system in enterprise deals.
- Link access and logging to the ISMS so the AIMS is not a second wiki.
- Write which legal track you are on (Act in, Act out, unknown) and who will decide.
Baseline: free audit score.
Frequently asked questions
Is this the same as iso 42001 certification?
The operating work is the program. Certification is one way to attest the AIMS. You can govern without a certificate. You should not claim a certificate you do not have.
Do we need this program if we only use ChatGPT internally?
You still have vendors, data leakage, and acceptable-use. Scope may be smaller. Write it down. "Internal only" is not a policy.
Where does SOC 2 fit?
US attestation, secondary in this plan. See SOC 2 and what comes after SOC 2.
How do we start?
Contact Packets if you need the specialist. Related reading: AI companies and tool vs consultant vs hire.