Artificial_Intelligence_depositphotos_dqs_edited

ISO/IEC 42001 in Practice: An AI Governance Scenario

Dipan Sengupta

Lead Assessor - Information Data Security / TISAX®
Oct 07 , 2026

A note before you read on: We keep client information confidential, so what follows is a composite scenario built from patterns we see across the industry.

AI is quietly taking on decisions that used to belong to a person: approving a loan, flagging a fraud case, deciding which patient file gets looked at first. The technology got there fast. Governance, in a lot of organizations, is still catching up. ISO/IEC 42001, the first international standard for AI Management Systems (AIMS), exists to close that gap.

After the scenario, we've answered the common questions organisations ask us most often when they're weighing up the standard.

The Starting Point: A Model That Works, A Governance Gap That Doesn't

A mid-sized financial institution rolled out an AI model to speed up fraud detection and loan approvals. It worked; processing times dropped from days to minutes. But two problems slipped through the initial rollout unnoticed:

  • Explainability was thin. Loan officers couldn't always say, in terms a customer or regulator would accept, why a specific application got declined.
  • Fairness was assumed, not verified. Internal reviewers had a hunch that approval rates varied across applicant groups, but there was no formal process to actually test for it.

Neither issue showed up on a performance dashboard. Both became real the moment a regulator asked a direct question the institution couldn't answer with confidence. That's usually the moment an organization discovers "the model performs well" and "the model is governed" are two different claims.

full picture of robot holding hands with a human in the sunset

What an AIMS Actually Adds

Getting the AI program aligned with ISO/IEC 42001 didn't mean rebuilding the model. It meant the institution's own compliance and risk teams building the governance structure that should have surrounded it from the start:

  • A full AI use-case inventory. The compliance team mapped every AI system in active use, including several that individual business units had adopted informally and never logged centrally. This step is easy to underestimate, and it's usually where the biggest surprises turn up.
  • Fairness testing that doesn't stop. The risk team turned bias checks on loan outcomes into a recurring review instead of a one-off box ticked at launch.
  • Explainability that's actually documented. The data science team put decision logic into a form an auditor, a regulator, or a customer could review after the fact, rather than something only they understood internally.
  • Clear rules for human oversight. Management defined specific thresholds for which decisions need a human sign-off before they're final.
  • Monitoring built into the calendar, not left to memory. The institution folded monitoring into its own operating rhythm, a certificate only means something if the management system keeps running after the audit team leaves.

What This Means If You're Considering ISO/IEC 42001

If your organization already runs another ISO management system, ISO 27001 or ISO 9001, say - the transition is usually more manageable than it looks at first, because the underlying framework (risk assessment, documented objectives, continual improvement) carries over. Without that foundation, expect the scoping phase to take longer, especially the part where you try to identify every AI system that's actually in use.

A few things worth keeping in mind going in:

  • Start with inventory, not controls. You can't govern what you haven't identified, and informally adopted tools are the most common blind spot.
  • Treat fairness and explainability as ongoing processes, not something you check off once at launch.
  • Assign clear ownership for each control across legal, data science, security, and compliance. Most drift happens in the gaps between teams.
  • Plan for what comes after certification. Surveillance audits and internal reviews keep going; the certificate is the start of the operation, not the finish line.

Frequently Asked Questions About ISO/IEC 42001

How long does implementation typically take?

It depends on how many AI systems are in scope and how mature your existing governance already is. Organisations with a handful of well-documented use cases tend to move faster than those who discover, partway through, just how many informal AI tools have quietly crept into use.

Is certification a one-time achievement?

No - like other ISO certifications, it comes with periodic surveillance audits and an expectation that the management system keeps operating, not just sits on a shelf somewhere.

Where to Go From Here

Organizations that can explain and stand behind the decisions their AI systems make are in a noticeably stronger position than those that can only point to a performance metric. It's a distinction worth working out well before a regulator or a customer forces the question.

If you're weighing up what an AI Management System would mean for your organisation, our ISO/IEC 42001 certification page walks through the requirements and assessment process or get in touch with our team directly to talk through what's relevant to you.

Author

Dipan Sengupta

Dipan Sengupta is a technology and digital transformation leader with 35 years of industry experience, including 20 years in the automotive sector and 15 years in senior CIO/IT leadership roles across Tata Motors, Tata Steel and PCBL in India and Europe. His expertise includes IT-OT integration, Industry 4.0, Smart Factory, automation, SAP, cloud transformation, cybersecurity, and digital transformation.

At DQS, he provides technical expertise in ISMS (ISO 27001), AIMS (ISO 42001), and TISAX, backed by hands-on experience in information security, AI, IT/OT security, and data protection. He has also led ISO 27001:2022 implementation and certification as a CISO and is a certified ISO 27001 Lead Assessor.

You Might Also Enjoy These Reads

Discover more articles that dive deep into related themes and ideas.
Blog

Legal Risks for Personal Background Screening Process in HK

Read more
Blog

Data Breach Costs Just Hit a Record High

Read more
Blog

What Actually Drives the Cost of a Data Breach in 2026

Read more