1. Does ISO 42001 apply if we only use AI SaaS?

Yes. If you use AI systems, ISO 42001 governance still applies. Scope and controls will differ, but accountability, risk, vendor oversight, and monitoring remain required.

2. What is the difference between AISIA and AI risk assessment?

AISIA focuses on impact and consequences. Risk assessment focuses on likelihood, control effectiveness, and treatment. AISIA typically informs the risk assessment.

5. How long does ISO 42001 implementation take?

Typically 10–16 weeks depending on number of AI systems, vendor footprint, and governance maturity.

6. Does ISO 42001 cover GenAI and RAG systems?

Yes. The standard focuses on governance and lifecycle management. GenAI adds specific risks such as hallucination, leakage, and misuse that must be addressed through AISIA and controls.

8. How does ISO 42001 relate to the EU AI Act?

ISO 42001 provides management system structure. The EU AI Act provides legal obligations based on risk classification. We help define what is covered by AIMS governance and what must be addressed through regulatory compliance controls.

9. What artefacts will we have at the end?

Typical outputs include scope, policy, objectives, RACI, AISIA reports, risk register, SoA, lifecycle procedures, vendor governance artefacts, internal audit records, and management review pack.

ISO/IEC 42001 Consulting and AIMS Certification Readiness

Q: 3. Can we implement ISO 42001 without seeking certification?

Yes. Many organisations implement for governance maturity and customer assurance. Certification is optional.

Q: 4. What do auditors look for in ISO 42001?

Clear scope. Control applicability logic. Evidence that controls operate. Traceability across the AIMS. Management oversight. Internal audit and management review records.

Q: 7. How do you assess AI vendors under ISO 42001?

Using AI-specific due diligence, contract clauses, shared responsibility mapping, integration oversight, and periodic review. Evidence is key.

Q: 8. Can ISO 42001 integrate with ISO 27001 and ISO 27701?

Yes. It aligns well with existing management systems. Many controls can reuse ISMS/PIMS mechanisms (policy, risk, supplier controls, audits).

AI governance, AI system impact assessment, vendor oversight and audit ready evidence, from a team that has taken a client to certification.

Pricoris provides ISO/IEC 42001 consulting for organisations that use, buy, integrate or develop AI. That includes GenAI tools, internal AI platforms and AI enabled SaaS products. We help you implement an AI management system (AIMS) aligned to ISO/IEC 42001:2023. The focus is operational, the output is evidence, and the goal is governance that stands up to audit and client scrutiny.

Our ISO/IEC 42001 implementation for KPMG in India was certified by SGS in December 2025, about seven weeks after work started. Read the KPMG case study. For on site work in Delhi, Noida and Gurugram, see ISO 42001 consulting in Delhi NCR.

Talk to an ISO/IEC 42001 consultant

Leave your details and we will call you back to discuss your scope. No obligation.

Name

Phone Number

Organisation

Interested in

Message

Our ISO/IEC 42001 consulting services

Gap assessment. Your AI systems, data flows and governance checked against every clause and Annex A control. About the gap assessment, or try the free 15 minute gap check.
AIMS design and implementation. Scope, AI policy, objectives, roles and the procedures your teams will actually follow, built into your ISMS where you have one.
AI system impact assessment and AI risk assessment. Clauses 6.1.2 to 6.1.4 and Annex A.5, run system by system, covering bias, misuse, drift and AI security threats.
AI security under ISO/IEC 27090. The nine AI attacks, from data poisoning to prompt injection, linked to practical mitigations and your Annex A controls. See our ISO/IEC 27090 map.
Vendor and AI SaaS oversight. Due diligence, contract clauses and monitoring for the models and tools you buy, under Annex A.10.
Internal audit and certification support. Internal audit, management review and support through the stage 1 and stage 2 audits with the accredited certification body you choose.

What you will have at the end

Area	Outputs
Governance	AIMS scope and context, AI policy and objectives, roles, RACI and governance forums
AI systems	AI system inventory covering what you build, buy and extend, with owners and risk tiers
Assessments	AI system impact assessment per system, AI risk register and risk treatment plan
Controls	Statement of Applicability with a justification for every Annex A control, and AI life cycle procedures
Third parties	Vendor and AI SaaS classification, due diligence records and contract clauses
Assurance	AIMS metrics, internal audit records, management review pack and an evidence index for the auditor

We keep documentation to what the standard requires and reuse the records you already have. See ISO 42001 documents required.

AI system impact assessment

The AI system impact assessment is where AI governance becomes real, and where many organisations struggle. We run it so that it supports decisions and stands up in an audit. It typically records the following.

Intended use and prohibited use.
Material impact on individuals, groups and other stakeholders.
Model and data risks such as bias, hallucination and drift.
Operational risks such as misuse, outages and integration errors.
Third party exposure through AI SaaS, sub processors and training use.
The controls, monitoring and reassessment triggers each system needs.

The outputs feed straight into the risk register and the Statement of Applicability.

Vendor and AI SaaS governance

ISO/IEC 42001 applies when you only use AI built by others. You cannot inspect a vendor’s model, so the evidence sits in how you choose, contract and watch the vendor. Our vendor model covers classification and risk tiering, AI specific due diligence, contract clauses on transparency, incident notification and change disclosure, integration oversight, and periodic review. Most AI risks are shared with the vendor, but accountability stays with you.

From controls to evidence

AI systems fail in predictable ways: prompt injection, RAG poisoning, copilots that see more data than they should, unsafe agent actions, leakage through logs and drift in production. Policies alone do not stop these. We help you test controls and keep the evidence, through guardrail testing, AI red teaming and AIMS metrics that feed management review. Read more on AI guardrail testing and AI security risks and ISO/IEC 27090.

Fees and timeline

Our consulting fees range from INR 5 lakh for a limited scope to INR 20 lakh for a complex scope. Certification body fees come on top. Most organisations reach audit readiness in three to eight months, and KPMG in India took about seven weeks. See what drives the cost and the timeline, and which certification bodies are accredited in India.

Who we work with

Organisations deploying GenAI and copilots internally.
Software, SaaS and IT services firms whose clients ask for ISO/IEC 42001.
Global capability centres, BFSI and health organisations with documented risk expectations.
Firms selling AI into Europe that want a head start on the EU AI Act.

Why Pricoris

Proven. Our implementation for KPMG in India was certified by SGS.
Qualified. Six ISO/IEC 42001 Lead Auditors and Lead Implementers on our bench.
Experienced in training. More than 2,000 professionals trained on ISO/IEC 42001, with Exemplar Global approved certificates. See ISO 42001 training.
Practical. We build on your ISMS and existing records, and we do not sell certificates.

Frequently asked questions

Does ISO 42001 apply if we only use AI SaaS?

Yes. If you use AI systems, ISO/IEC 42001 governance still applies. Scope and controls differ, but accountability, risk, vendor oversight and monitoring remain required.

What is the difference between an AI system impact assessment and an AI risk assessment?

The impact assessment looks at consequences for people and society. The risk assessment looks at likelihood, control effectiveness and treatment. The impact assessment usually feeds the risk assessment.

Can we implement ISO 42001 without seeking certification?

Yes. Many organisations implement it for governance maturity and client assurance. Certification is optional.

What do auditors look for in ISO 42001?

A clear scope, the logic behind control applicability, evidence that controls operate, traceability across the AIMS, management oversight, and internal audit and management review records.

How long does ISO 42001 implementation take?

Most organisations reach audit readiness in three to eight months. The number of AI systems, the vendor footprint and governance maturity decide where you fall in that range.

Does ISO 42001 cover GenAI and RAG systems?

Yes. The standard covers governance and the life cycle of any AI system. GenAI adds risks such as hallucination, leakage and misuse, which the impact assessment and controls must address.

How do you assess AI vendors under ISO 42001?

Through AI specific due diligence, contract clauses, shared responsibility mapping, integration oversight and periodic review. Evidence is the key.

How does ISO 42001 relate to the EU AI Act?

ISO/IEC 42001 gives you a management system. The EU AI Act sets legal obligations based on risk classification. We help you define what the AIMS covers and what needs separate regulatory controls.

Can ISO 42001 integrate with ISO 27001 and ISO 27701?

Yes. Many processes can be reused from your ISMS or PIMS, such as policy, risk, supplier controls and audits.

Who needs ISO 42001 certification?

Any organisation that builds, buys or uses AI can use ISO/IEC 42001. Certification matters most when clients ask for proof of AI governance in contracts or due diligence.

How much does ISO 42001 consulting cost?

Our consulting fees range from INR 5 lakh for a limited scope to INR 20 lakh for a complex scope. Certification body fees come on top.

Is ISO 42001 recognised in India?

Yes. The Bureau of Indian Standards adopted it as IS/ISO/IEC 42001:2023. NABCB, the national accreditation board, has accredited four AIMS certification bodies. See which ones. The CERT-In AI Security Auditing Guidelines also name ISO/IEC 42001 as their primary alignment standard.

Ready to talk?

Discuss your AIMS scope, see sample impact assessment outputs, and plan your certification readiness. Request a call back, write to sandhya@pricoris.in or call +91 120 432 3179.