vCAIO-led · EU AI Act & ISO 42001 : Govern your AI before the regulator asks you to.
The EU AI Act and ISO 42001 have turned “responsible AI” from a slogan into a control set: AI inventories, risk classification, human oversight, technical documentation, and logging that proves how your systems behave over time.
From slogan to control set
- Inventory and classify every AI system and use case
- Stand up an ISO 42001-aligned AI Management System
- Map EU AI Act obligations to your role (provider vs. deployer) and risk tier
- Align to the NIST AI RMF for US-oriented buyers and partners
- Implement human-oversight, transparency, and record-keeping controls
- Generate the logging and traceability evidence the standards require
Why it’s urgent even with the timeline shift.
The EU AI Act’s high-risk obligations moved out, but the hard part — finding, classifying, and continuously documenting your AI — doesn’t get easier with time, and ISO 42001 is already appearing in enterprise RFPs as table stakes.
Frequently asked questions
ISO 42001 vs. the EU AI Act — what is the difference? +
ISO 42001 is a certifiable management-system standard for governing AI (an AIMS), much like ISO 27001 is for security. The EU AI Act is law: it classifies AI systems by risk and imposes obligations on providers and deployers. ISO 42001 gives you the management system that helps you meet EU AI Act obligations; we get you ready for both.
The EU AI Act timeline shifted — why act now? +
The high-risk obligations moved out, but the hard part — finding, classifying, and continuously documenting your AI — doesn’t get easier with time, and ISO 42001 is already appearing in enterprise RFPs as table stakes.
Are we a “provider” or a “deployer”? +
It depends on whether you build/place an AI system on the market or use one in your operations — and you can be both for different systems. We map each AI use case to your role and its EU AI Act risk tier as part of the assessment.
The 5-step AI governance programme
System & Intake Mapping
Inventory every AI system, data input, and output in scope. Define the AI system boundary and relevant stakeholders.
Risk Classification
Classify each system against ISO 42001 risk criteria and EU AI Act risk bands. Identify high-risk obligations.
Control Architecture Design
Design the AIMS controls, policies, logging requirements, and human oversight gates that map to your risk profile.
Policy & Pipeline Instrumentation
Write the policies. Instrument the monitoring. Build audit trails into the AI pipeline — not as an afterthought.
Audit & Production Sign-off
Prepare and coordinate the certifying body audit. Deliver the evidence pack. Support the audit.
Know where your AI sits before the regulator asks.
Bring your AI inventory, or the lack of one. Leave with risk tiers, the gaps, and the first controls.