Governance, Risk & Compliance
An ISO 42001 consultant in India is being asked, more and more, by organisations that put a model into production before anyone agreed who owned its output. ISO/IEC 42001:2023 is the first certifiable management system standard for artificial intelligence, and its central demand is unglamorous: name the accountable person, write down what the system is for, and assess what happens to the people affected when it gets something wrong.
It is built on the same Annex SL structure as ISO 27001, so if you already run an information security management system the clauses will look familiar and the two can share governance, internal audit and management review. What is genuinely new is Annex A: thirty-eight controls across nine objectives, covering AI policy, internal organisation, resources, impact assessment, the system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party relationships.
Certification is not the only reason to do this. The EU AI Act, procurement questionnaires and enterprise customers are all converging on the same questions, and an AI management system answers most of them once. Where the underlying data also falls under ISO 27701 or the DPDP Act, the privacy and AI programmes should be designed together rather than sequentially.
Why you need it
01 / 06The first deliverable of almost every engagement is an inventory, and it is almost always longer than the organisation expected. Models embedded in SaaS products, a team’s own fine-tune, and a vendor feature switched on by default all count, and all carry obligations you have not yet accepted.
The standard requires you to assess consequences for individuals and groups affected by an AI system, not only risk to the organisation. That inversion is the point of the standard, and it is the part that most existing risk processes do not cover at all.
Enterprise procurement has started asking how AI is governed, and there has not been a good answer to give. A certified AIMS is currently the most recognised one available, and it maps usefully onto EU AI Act obligations for organisations in scope.
Shared Annex SL clauses mean scope, leadership, planning, support, operation, evaluation and improvement can be operated once across ISO 27001 and ISO 42001, with one internal audit programme and one management review rather than two.
Instrument
02 / 06Where ISO 42001 overlaps the management system you may already be running, and where it genuinely asks for something new.
What we deliver
03 / 06Every AI system in use, built or embedded, with its purpose, its owner, the data it consumes and the decisions it influences. Then an honest scope statement for the management system, because certifying everything at once rarely survives contact with a budget.
Clauses 4 to 10 and all thirty-eight Annex A controls assessed as met, partially met or not met, with a Statement of Applicability that justifies every exclusion rather than quietly dropping it.
A repeatable process for assessing consequences to individuals and groups, proportionate to the system, that your teams can actually run on the next model without calling us back.
AI policy, accountable roles and authorities, and the life-cycle controls the standard expects: objectives for design, verification and validation, deployment, operation and monitoring, with the records each stage produces.
Provenance, quality, preparation and the acquisition controls in Annex A, including the uncomfortable questions about training data rights and about what your providers do with prompts and outputs.
Internal audit, management review, and support through Stage 1 and Stage 2 with an accredited certification body. We do not issue the certificate; we make sure the auditor finds a working system.
How we run it
04 / 06Find every AI system, including the embedded ones nobody classifies as AI, and agree what the management system covers.
Weeks 1-3Assess against Clauses 4-10 and Annex A, and draft the Statement of Applicability with a justification for each decision.
Weeks 3-6Policy, roles, risk and impact assessment method, objectives, and the life-cycle and data controls. Written to be operated, not to be read once.
Months 2-4Operate the system long enough to generate real records: impact assessments completed, changes reviewed, incidents handled. An auditor needs evidence of operation, not of intent.
Months 4-7Audit the system against the standard, correct what the audit finds, and hold a documented management review with the accountable leadership.
Month 7-8Stage 1 documentation review, then Stage 2 with the certification body, then the surveillance rhythm that keeps it alive.
Month 8-10, then annuallyKey benefits
05 / 06The inventory alone changes decisions. It routinely surfaces systems making or shaping consequential decisions that nobody had assessed, and it gives each one a named owner for the first time.
Where AI governance questions currently produce an improvised response, a certified management system produces a certificate, a scope statement and a Statement of Applicability, which is what enterprise buyers are actually asking for.
Shared clauses with ISO 27001 and ISO 27701 mean one internal audit programme, one management review and one improvement cycle, which is the difference between a system that is maintained and one that lapses.
Tools we use
06 / 06No “latest tech tools”. These are the ones your report will cite, alongside the manual work that a tool cannot do for you.
Standards
Assessment
Adjacent obligations
Evidence
Mapping
Why Aphelion
SharedDarshap Nayak, formerly of KPMG, holds a master’s degree in cybersecurity and more than seven years in security operations. Jaimin Somani brings fifteen-plus years of academic and hands-on VAPT. Hemang Desai is an ICT network specialist from Australia. You will meet them, not a logo.
Meet the teamEvery finding arrives with the reproduction steps, the affected asset and the fix, ranked by what it actually reaches in your environment, not by a CVSS number copied from a scanner. You get the report and the raw output, not a summary of a summary.
See how we testAhmedabad and Sharjah, working the same methodology on the same tooling. Indian data-residency requirements and UAE delivery are both ordinary here, and the AphelioNYX AD Pen-Test module runs entirely inside your perimeter when regulation says it must.
The platformInvent a statistic to make a slide land. Publish your name as a client without written permission. Print an award badge nobody awarded. Founded in 2024. We say so, and we attribute experience to the people who have it.
Ask us anythingAcross the globe, and across eight industries. We name a client only with their written permission.
AphelioNYX is SOC 2, ISO and GDPR compliant; attestations are available on request under NDA. We would rather hand you the report than print a badge.
Questions
FAQNext door
RelatedA personalised walkthrough and a free readiness assessment against the frameworks you are actually being asked for. Pick a time that suits you, or write to us. We reply within one business day.