packets.build00 ISO 42001
ISO 42001 for the AI you build and use
An AI management system run with you: an AI system register, risk and impact assessments, approvals and Annex A controls, with a Forward Employee, an AI governance expert and AI agents on one platform.
For AI-native companies and teams shipping AI features to enterprise buyers.
ISO 42001 readiness
- AI system register3 systems
- AI impact assessmentIn review
- A.6 AI system life cycle4 tasks open
ISO 42001 at a glance
What to expect before you start.
- 3–4 months
Typical time from kickoff to certificate, the same shape as ISO 27001.
Typical packets plan - 38
Annex A controls in ISO/IEC 42001:2023.
The standard - 55+
AI controls in the packets catalogue, each citing the ISO 42001 clauses it supports.
packets product - 3 years
Certificate validity, with a surveillance audit in years one and two.
The standard
01 Typical certification schedule
Your path to ISO 42001
Five stages from your first AI inventory to certificate.
AI inventory and scope
Weeks 1–2Know which AI systems are in scope.
Platform
- AI system register with owner, purpose and lifecycle stage
- Seven lifecycle stages from ideation to closed
Agents
- Find AI resources in connected Azure, AWS and Google Cloud accounts, read-only
Your packets team
- Agree the AI management system scope
- Decide which systems go on the register
You
- Confirm the AI systems in scope
- Name a business owner for each
Output AIMS scope and AI system register
02 Who works on it
Three kinds of help, one programme
AI governance needs people who understand both the standard and how AI systems are built. The strip under each card shows when they are working on your certification.
- Within 5 working days
Forward Employee
Embedded in your team
Joins your team and drives the ISO 42001 work end to end: the register, assessments, evidence and audit preparation. Full support until the certificate is issued.
- Keeps the AI register current
- Chases assessments and evidence
- Prepares you for every audit
- Every milestone
AI governance expert
At every milestone
Leads scoping, the AI risk and impact assessments and the internal audit, and introduces you to certification bodies. No separate consulting fee.
- Scope and AI policy
- Impact assessments
- Internal audit and management review
- From day one
AI agents
Working from day one
Read-only cloud connectors find AI resources in the accounts you connect, and agents draft your AI policy and record configuration evidence. Your team decides what is registered and approved.
- Find AI resources
- Draft the AI policy
- Record configuration evidence
03 Trust portal
Make AI governance part of your sales story
Publish a Trust Center with your security posture, live controls and published policies, so buyers reviewing your AI product can see how it is governed while the audit runs.
- AI system registerImplemented
- Human oversightImplemented
- AI impact assessmentIn progress
Synced from your packets workspace · just now
04 How ISO 42001 gets done
Platform, agents and people, for ISO 42001
The platform holds the register and controls. Agents find and record. People make the AI governance decisions.
Platform
What it holds
- AI system registerOwner, purpose, scope and lifecycle stage for each system.
- AI control catalogueOver 55 AI controls; the ones that apply are derived from your answers.
- Approval groupsAI Governance, Privacy, Security, Legal and Third Party, each decision recorded.
- Audit workspaceReadiness, findings and remediation for each audit.
Autonomous agents
What they do
- Cloud discoveryRead-only Azure, AWS and Google Cloud connectors that never call your models.
- AI policy draftsTailored to your company and waiting for approval.
- Connector evidenceConfiguration evidence with its source and collection date.
Humans →
What they implement
- Scope and AI policyClauses 4 and 5, agreed with leadership.
- AI risk and impact assessmentsClauses 6.1 and 8.2–8.4, run with system owners.
- Internal auditClause 9.2, run by an AI governance expert.
- Management reviewClause 9.3, prepared and recorded with you.
On file
- AI policy draftApproved
- Google Cloud · audit-log configApproved
Agents collect it
Your team approves it
Agents save evidence and drafts into the platform. A person on your team approves them there.
05 Compare
Four ways to get ISO 42001. One comes with someone accountable.
| Question | A compliance tool | A consultant | A hire | packets |
|---|---|---|---|---|
| Who is accountable | Your engineer | Nobody, after the engagement | Whoever you hired, once ramped | Your packets team, from week one |
| Who does the work | You | Advises; you implement | One person, part-time | Agents at volume, plus specialists |
| AI system inventory | A spreadsheet | A one-off list | Kept by hand | A register with owners and stages |
| AI impact assessments | A template | A workshop, then a report | If they know AI governance | Assessments with approval groups |
| Policies and evidence | Templates to fill in | Document set, handed over | Written from scratch | Drafted and mapped; you approve |
| Adding a framework | Start the checklist again | A new engagement | More work, same person | Reuses controls in place |
| Surveillance audits | Your team prepares | A new engagement | Depends on them staying | Same system, nothing restarts |
| What it costs | Licence, plus the work | Project fee, no system | ₹30–35L a year, plus time to hire | One fixed price |
Hire cost from the packets comparison on packets.build. Your quote depends on scope and frameworks.
06 Features
What runs your ISO 42001 programme
Specific to ISO 42001
AI system register
Every AI system with a business owner, purpose, scope and lifecycle stage.
Assessments and approvals
Stage-based assessments routed to named approval groups, each decision recorded.
Read-only cloud connectors
Find AI resources in Azure, AWS and Google Cloud. Your team decides what is registered.
In every packets programme
Controls
Each control maps to the requirements it satisfies, so work counts once.
Policies
A full policy set, including your AI policy, with approvals recorded.
Evidence collection
Evidence on each control task, with owners, versions and expiry.
AI Incident Register
A ready-made register for AI incidents, alongside your other trackers.
Risk register
Risks drafted from your context, approved by you, linked to controls.
Vendor management
Your model providers and other suppliers, with their risks.
Trust portal
Your status, controls and policies on one public page.
Employee portal
Staff read and accept policies, including your AI policy.
07 Framework overlap
Doing ISO 42001? Much of the next one is done.
One control can satisfy requirements in several frameworks, so ISO 42001 gives you a head start on the next one. Each card shows how much of the main work is already done, and what is left.
StartingISO 27001after ISO 42001
3 of 6already done
- Management system clauses: context, leadership, internal audit, management review
- Risk process and document control
- Policy management and approvals
- Annex A information security controls
- Information security risk treatment
- A Statement of Applicability
StartingEU AI Actafter ISO 42001
3 of 5already done
- An inventory of your AI systems
- Roles, high-risk and general-purpose flags recorded per system
- Human oversight and approval records
- Conformity assessment for high-risk systems
- Legal analysis of your obligations: packets does not give legal advice
StartingGDPRafter ISO 42001
2 of 5already done
- Data and privacy questions in each AI assessment
- Impact assessment habits
- Records of processing activities
- A lawful basis for each activity
- Data subject request handling
Counts are of the main pieces of work, not a measured percentage of controls. Your scope decides the rest.
08 Which one first
Your buyers decide which framework you need
Many AI companies need ISO 27001 too. We plan both on one set of controls.
- Buyers reviewing an AI productISO 42001 This page
- Enterprise buyers in India, Europe and the Middle EastISO 27001 →
- US and Canadian enterprise buyersSOC 2 Type II →
- Anyone whose users are in EuropeGDPR readiness →
09 After the certificate
Certification is a milestone. Governance is continuous.
AI systems change faster than most. The same system and team keep the register and assessments current.
- When a system changes
Reopen its assessment when an answer changes, and route it for approval again.
- On schedule
Reassessment cycles set from each system's monitoring frequency.
- Years 1 and 2
Surveillance audits, prepared from the evidence already in place.
- Year 3
Recertification, on the same system. Nothing restarts.
Already working on AI governance elsewhere?
Bring your AI inventory, policies and risk register. We build on what you have rather than starting over.
10 Questions
Questions about ISO 42001
01What is ISO 42001?
ISO/IEC 42001:2023 is the international standard for an AI management system: how you govern, assess and control the AI you build, buy and use. Buyers reviewing AI products increasingly ask for it.
02How long does ISO 42001 take with packets?
Typically three to four months from kickoff to certificate. The number of AI systems in scope and your certification body's calendar change this.
03Do we need ISO 27001 first?
No, but it helps. The two share the same management system structure, so we can run them together on one set of controls.
04Which AI systems are in scope?
The ones you agree at kickoff: AI you build into your product, AI you buy from providers, and AI your teams use. Each goes on the register with an owner.
05Do the cloud connectors call our models?
No. They are read-only and read configuration only. A connection that could invoke models is refused when it is set up.
06What is an AI impact assessment?
An assessment of how an AI system could affect people and groups, required by ISO 42001. Your AI governance expert runs it with each system's owner, and approvers sign it off in packets.
07Does this cover the EU AI Act?
packets records roles and high-risk and general-purpose flags for each system, which helps. It does not give legal advice or provide conformity assessment.
08Who issues the certificate?
An accredited certification body. packets prepares you, coordinates the audits and supports you until the certificate is issued. We do not guarantee the outcome.
11 Keep exploring
Before you book a call
- PlatformAI GovernanceThe register, assessments, approvals and controls behind ISO 42001.→
- ToolAudit readiness scoreFind out where you stand in two minutes, no call.→
- GuideDigital Resilience HandbookA practical guide to building resilience in.→
- PlatformRisk assessmentsHow risks are drafted, reviewed and linked to controls.→
Govern your AI. Prove it with ISO 42001.
Talk to us about your AI systems, your buyers and your timeline.
- A Forward Employee in your team within five working days
- An AI governance expert at every milestone
- Read-only connectors that find your AI resources