AI Governance and ISO/IEC 42001 Readiness Assessment

It is a 4-week consulting engagement that inventories your organization's AI use, assesses it against ISO/IEC 42001 — the international AI management system standard — drafts your core AI governance policies, maps your Microsoft security and compliance stack to the standard's controls, and delivers a prioritized roadmap to certification readiness. It prepares you for a certification audit performed by an accredited third party; it is not the audit itself.

ISO/IEC 42001:2023 is the first international management-system standard for artificial intelligence. Like ISO 27001 for information security, it defines requirements for how an organization governs AI — leadership, policy, risk and impact assessment, lifecycle management, data governance, and continual improvement — supported by an Annex A catalog of controls covering areas from AI policy through third-party relationships. Organizations can be certified against it by accredited certification bodies.

No, and we say this plainly because it matters: certification audits and certificates come only from certification bodies accredited for the standard. IT Partner is a readiness consultant. We get you to the point where engaging an accredited body is a sensible next step rather than an expensive discovery exercise — the same separation of duties our ISO 27001 pre-audit service maintains.

Organizations getting AI governance questions they cannot yet answer well: enterprise customers adding AI sections to vendor questionnaires and RFPs, boards asking who owns AI risk, regulators and frameworks like the EU AI Act creating exposure, or leadership targeting ISO/IEC 42001 certification and needing to know how far away it is. If you use Microsoft 365 Copilot or agents in production, you already have an AI footprint worth governing.

Pricing starts at $7,500 and grows with what we actually have to assess: how many AI systems and business units are in scope, whether you develop AI or only use it, and the size of the Microsoft 365 estate for the control mapping. After the scoping conversation you receive a fixed quote in writing before any work begins, and you pay after you approve delivery.

Both layers of the standard: the management-system requirements (context, leadership, planning, support, operation, performance evaluation, and improvement) and the Annex A controls, which span AI policy and governance, impact assessment, the AI system lifecycle, data for AI systems, information for interested parties, and use of and third-party relationships around AI systems. Every applicable item gets a documented finding — met, partially met, not met, or not applicable with rationale.

Three core documents, delivered in editable form and workshopped with their future owners: an AI acceptable-use policy for the workforce, an AI risk and impact assessment methodology, and a human oversight and accountability policy defining who is answerable for AI-assisted decisions. These are the backbone documents an AI management system — and most customer questionnaires — expect to see.

Heavily, if Copilot and agents are part of your AI footprint. Much of the evidence an auditor or customer wants — data classification, DLP, audit trails, access governance, threat protection — maps to Microsoft Purview, Defender, and Entra capabilities you may already license. The assessment maps those capabilities to the standard's controls for your Copilot and agent scenarios and identifies exactly where configuration or licensing gaps remain.

No — ISO/IEC 42001 stands on its own. But the standards share the same management-system architecture, so an existing ISMS accelerates readiness considerably: risk processes, document control, and internal audit muscles transfer directly. If you are weighing both, we can sequence them; IT Partner also offers an ISO 27001 pre-audit readiness assessment.

The EU AI Act creates obligations that phase in over several years, and an AI management system is a practical way to organize your response: the inventory tells you what you run, the impact-assessment methodology gives you a repeatable classification process, and the policy set establishes oversight. To be precise about the boundary, though: this engagement is not legal advice, and questions of legal classification or exposure under the Act belong with your counsel. We provide the governance machinery; your lawyers provide the legal conclusions.

Four weeks is the standard schedule for a typical mid-size footprint: scoping and inventory in the first half, gap assessment, policy drafting, and control mapping in the second, closing with the roadmap and executive readout. Very large or multi-entity footprints are scoped honestly at quote time rather than squeezed into the standard window.

Three paths, usually in sequence: remediate the prioritized gaps (your team, IT Partner under separate scope, or a mix), operate the governance rhythm the policies define — the vCISO service is the ongoing model for organizations without a security leader to own it — and, when the roadmap says you are ready, engage an accredited certification body for the Stage 1 and Stage 2 audits. We can support you through remediation and audit preparation, but the certification decision is always the auditor's.

Yes — that is much of its value. Copilot Studio agents, AI features switched on inside SaaS products, and the unsanctioned browser-tab AI your teams already use all carry governance obligations under the standard. The discovery combines tenant-side signals with structured stakeholder interviews, because shadow AI by definition does not show up in an asset database.

They are built with that use in mind: the inventory, policy set, Statement of Applicability starter, and executive readout give you documented, honest answers to the AI sections now appearing in vendor assessments — including the accurate answer that you are executing a roadmap toward ISO/IEC 42001 readiness, which lands far better than improvisation.

No. Certification depends on the remediation you complete and on the judgment of an independent accredited auditor, and no honest readiness consultant guarantees another party's decision. What we commit to is a rigorous, standard-grounded assessment, usable policy drafts, an accurate map of your Microsoft control coverage, and a roadmap that tells you the real distance to ready.

The engagement runs under NDA, access is read-only or executed by your administrators with our guidance, and IT Partner carries cyber insurance with third-party verification available. You can verify our operating claims — response SLAs, insurance, Microsoft partnership history — on our public verification page.