ISO 42001 Certification &
AI Governance Services
Your team is already using AI. ISO/IEC 42001 is the international standard that proves you have it under control – documented, monitored, and accountable. We build the AI management system for Central Florida businesses, then stand next to you through the certification audit.
What Is ISO 42001 and Why Does It Matter Now?
ISO/IEC 42001:2023 is the first international standard for artificial intelligence management systems. Think of it as ISO 27001, but for how your organization builds, buys, and uses AI.
Most businesses did not decide to adopt AI. It arrived. Someone pasted a client contract into a chatbot to summarize it. Someone else wired an AI note-taker into every meeting. A vendor shipped an AI feature inside software you already pay for. None of it went through review, and nobody can tell you today which systems touch your customer data.
That is the gap ISO 42001 closes. It gives you a defensible answer to the question your biggest customer, your insurance carrier, or your regulator is about to ask: how do you govern AI? The standard requires you to inventory your AI systems, assess their risks and impacts, assign human accountability, control your data, and prove all of it operates on an ongoing basis.
It is a certifiable standard, which is the part that matters commercially. Unlike a voluntary framework you can claim adherence to, an accredited certification body audits you and issues a certificate. That certificate is what shortens a security questionnaire from six weeks to six days.
Human Accountability
Somebody by name owns each AI system and the decisions it influences. The standard does not accept “the model decided” as an answer, and neither will a plaintiff’s attorney.
Data Provenance
You document what data trains, tunes, and prompts each system, where it came from, and whether you had the right to use it that way. This is where most AI programs fail on first review.
AI Impact Assessment
Before deployment, you evaluate what happens to the people affected if the system is wrong, biased, or unavailable. Documented, dated, and revisited when the system changes.
Third-Party AI Controls
Most of your AI risk is not your model – it is your vendors’ models. The standard pushes governance into your supplier contracts and your software selection process.
Monitoring & Measurement
Certification is not a one-time event. You measure whether the controls actually work, log incidents, and feed the findings back into the system. Surveillance audits check this annually.
Documented Information
Policies, procedures, records, and evidence. Auditors do not grade intentions. We build the documentation set as a working system, not a binder nobody opens.
What Does Ungoverned AI Actually Cost You?
The damage rarely shows up as a fine. It shows up as a deal you did not win and an exposure nobody logged.
Shadow AI You Cannot Inventory
Staff use free consumer AI tools with client data because nobody gave them an approved alternative. You find out during an incident, not before.
Failed Enterprise Security Reviews
AI governance questions are now standard in vendor questionnaires. “We do not have a formal program” stalls the deal while your competitor answers with a certificate number.
Confidential Data in Training Sets
Consumer AI tiers can retain and train on what you submit. Once client PHI, contract terms, or source code goes in under the wrong terms, you cannot pull it back out.
Compliance Conflicts You Did Not See
An AI tool that touches PHI drags HIPAA into scope. One that touches cardholder data drags in PCI DSS. Governance gaps do not stay contained to AI.
Insurance Exclusions
Cyber carriers are adding AI-related questions and exclusions at renewal. Answering them honestly without a program is getting expensive.
Wasted AI Spend
Without an inventory you pay for overlapping tools, and without impact assessment you scale the pilots that should have been killed. Governance pays for itself here first.
Not Sure If You Need Certification Yet?
Start with the free AI readiness assessment. It tells you what AI is already in your environment and where your governance gaps are – before you spend a dollar on an auditor.
How Does iTech Plus Get You to ISO 42001 Certification?
Six phases from first conversation to certificate. We do the build; the accredited certification body does the audit. Those are deliberately separate parties.
AI System Inventory & Scope
We find every AI system actually in use – sanctioned, embedded in vendor software, and shadow. Then we define the certification scope, because certifying your entire company when only one product line needs it is how budgets get wasted.
Gap Assessment Against Annex A
Every control in the standard is scored against your current state, weighted by risk and remediation effort. You get a prioritized findings report showing exactly what stands between you and a clean audit – and roughly what each gap costs to close.
Build the AI Management System
AI policy, acceptable use, risk methodology, impact assessment procedure, supplier requirements, incident handling, and the roles that own each one. Written for how your business actually runs, mapped against your existing compliance frameworks so you implement each control once.
Technical Controls & Approved Tooling
We deploy the governed alternative to shadow AI: enterprise tenants with data-retention controls, identity and access management, logging, and DLP on the paths where AI touches your data. Usually built on the Microsoft 365 stack you already own.
Internal Audit & Management Review
The standard requires both before a certification body will audit you. We run the internal audit, document the nonconformities, close them, and prepare the management review record your auditor will ask for by name.
Stage 1 & Stage 2 Audit Support
Stage 1 reviews your documentation; Stage 2 tests whether the system operates. We sit in both, produce evidence on demand, and handle findings in real time. After certification, surveillance audits follow annually with recertification in year three – we run that cycle for you.
What Does ISO 42001 Certification Cost?
Two separate budgets: what you pay to get ready, and what you pay the accredited certification body. Anyone quoting one number is hiding the other.
| Organization Size | Readiness & Implementation | Certification Body Audit | Typical Timeline |
|---|---|---|---|
| Under 25 staff, single AI use case | $12,000 – $28,000 | $9,000 – $18,000 | 4 – 6 months |
| 25 – 100 staff, several systems | $28,000 – $65,000 | $15,000 – $30,000 | 6 – 9 months |
| 100+ staff or AI in the product | $65,000 – $150,000+ | $25,000 – $50,000+ | 9 – 14 months |
| Annual surveillance (years 2 & 3) | Included in managed compliance | ~40% of initial audit fee | Annual |
Ranges reflect current market pricing across accredited certification bodies and implementation partners, not an iTech Plus quote. We price readiness work as a fixed fee after the gap assessment, so you know the number before you commit. Certification body fees are paid directly to the auditor – we do not mark them up, and we cannot audit a system we built.
Why Choose iTech Plus for AI Governance?
Most compliance consultants write you a policy and leave. We are the managed IT provider that then has to operate it.
We Implement, Not Just Advise
The gap between a written AI policy and an enforced one is technical controls. We deploy them, because we already run your identity, endpoints, and Microsoft 365 tenant.
Controls Mapped Across Frameworks
If you already carry HIPAA or FTC Safeguards obligations, most of your ISO 42001 evidence base already exists. We map it once and satisfy both.
Central Florida, On Site
Internal audits and staff interviews go faster in person. We are in Davenport, and we cover Orlando, Lakeland, Kissimmee, and the I-4 corridor without a travel line item.
We Run the Ongoing Cycle
Certification is year one. Surveillance audits, control monitoring, and impact reassessments run forever. That is managed services, which is what we already do.
ISO 42001 Certification – Common Questions
ISO 27001 governs information security – keeping data confidential, available, and intact. ISO 42001 governs artificial intelligence management – how AI systems are selected, assessed for impact, supervised by humans, and monitored over time. They share the same management-system structure, so if you already hold ISO 27001 the ISO 42001 build is substantially shorter. They do not replace each other: an AI system can be perfectly secure and still produce biased or unaccountable outputs.
Certification is not required by law in the United States today. The businesses that pursue it are the ones selling into enterprises, healthcare systems, government, or financial services – where the buyer’s security questionnaire now includes AI governance questions. If you are a 15-person firm using AI internally and not being asked those questions, you likely need the governance program without the certificate. We will tell you which situation you are in during the assessment rather than selling you an audit you do not need.
The NIST AI RMF is a voluntary framework you self-attest to; ISO 42001 is a certifiable standard a third party audits. They overlap heavily – NIST’s Govern, Map, Measure, and Manage functions align closely with ISO 42001’s clauses. Many organizations start with NIST AI RMF because it is free and fast, then convert that work into ISO 42001 when a customer demands proof. We build toward both so the first effort is not wasted. See our full compliance services →
For a small organization with a narrow scope and reasonable IT hygiene, four to six months from kickoff to certificate is realistic. Mid-sized organizations with multiple AI systems and vendor dependencies typically run six to nine months. The pacing constraint is usually not the technical work – it is that the standard requires your management system to have actually operated for a period before the Stage 2 audit can test it. You cannot compress evidence you have not generated yet.
No, and neither can any other consultant – that is by design. Certification must come from an accredited certification body that is independent of whoever built your management system. We do the readiness work, run your internal audit, help you select an appropriate certification body, and sit with you through Stage 1 and Stage 2. Be skeptical of any firm that offers to both build and certify.
Most survive with changes to how they are configured and contracted, not by being ripped out. The common moves are migrating from a consumer tier to a business tier with data-retention controls, adding a signed data processing agreement, restricting which staff and data classes can use each tool, and turning on logging. Occasionally a tool has to go because the vendor cannot answer basic questions about what happens to your data. That is worth knowing now rather than during an incident.
Find Out What AI Is
Already in Your Business
The free AI readiness assessment inventories the AI already touching your data, scores your governance gaps, and tells you whether you need a program, a certificate, or just better guardrails.
Serving Davenport, Orlando, Lakeland, Kissimmee, Winter Haven, Celebration, and Central Florida.