Module 125 minutes
Structure and the Link to ISO 27001
Clauses, Annex A and what carries over.
The question: How is ISO 42001 built, and how much of ISO 27001 can we reuse?
You keep: Reuse map
Specialist programmeISO 42001 Implementation
Build an AI management system an auditor will certify. Scope it, assess it and evidence it, starting from what you already run for ISO 27001.
- 6 modules
- About 2 hours 40 minutes
- 6 artefacts you keep
- 30-day plan
Who it is for
For teams who already know ISO 27001.
Compliance managers, ISO 27001 practitioners extending into AI, and consultants preparing clients for certification.
The problem
ISO/IEC 42001:2023 is the first certifiable AI management system standard. Teams understand ISO 27001 but struggle to turn ISO 42001 into AI-specific controls and evidence an auditor will accept.
You leave with a scoped AI management system, a statement of applicability and a risk register.
Outcomes
By the end, you can
- Map ISO 42001 clauses to your ISO 27001 system and decide what to reuse, extend or build new.
- Draw a defensible scope, with named exclusions, a signed AI policy and accountable roles.
- Run AI risk and impact assessments that cover people and society as well as the business.
- Select, justify and implement Annex A controls with evidence that they operate.
- Build a statement of applicability that points every control to a real record.
- Rehearse certification with an internal audit, a management review and a dated readiness plan.
Outline
Six modules. Each ends with something you keep.
Every module answers one question, then you apply it in a timed exercise on a fictional case and complete the artefact before you move on.
Module 225 minutes
Scope, Policy and Roles
Define the boundary and who is accountable.
The question: What is in the system, who owns it, and what do we promise?
You keep: Scope statement and AI policy
Module 330 minutes
AI Risk and Impact Assessment
Risks to the business and to people.
The question: What could go wrong, and for whom?
You keep: AI risk register and impact assessment
Module 430 minutes
Annex A Controls in Practice
Select, justify and implement.
The question: Which controls apply to us, and what does each look like in real life?
You keep: Control implementation cards
Module 525 minutes
Documentation and Evidence
The statement of applicability and what an auditor requests.
The question: What documents and records must exist before the audit?
You keep: Statement of applicability, first ten controls
Module 625 minutes
Audit, Review and Certification
Internal audit, management review and readiness.
The question: How do we know we are ready, and what happens on audit day?
You keep: Readiness plan and internal audit programme
CapstoneThen a 30-day plan
Apply it to your own organisation
A scoped AI management system with a statement of applicability and a risk register.
- Week 1. Draft the scope statement and AI policy. Name the management representative.
- Week 2. Build the AI system inventory and run risk and impact assessments for the top three.
- Week 3. Complete the statement of applicability with justifications and evidence references.
- Week 4. Run an internal audit on one clause set and schedule the management review.
What you produce
Six artefacts, one binder.
The skeleton of a management system you can certify.
- Module 1Reuse map
- Module 2Scope statement and AI policy
- Module 3AI risk register and impact assessment
- Module 4Control implementation cards
- Module 5Statement of applicability, first ten controls
- Module 6Readiness plan and internal audit programme
Capstone: A scoped AI management system with a statement of applicability and a risk register.