Support
ENSV

ISO 42001: leadership takes responsibility for AI

An AI management system is your agreed rules, responsibilities and follow-up for the AI you use or provide, not the software itself. Leadership makes decisions and reviews what happens.

Confidential customer information can be shared with the wrong AI service, and AI agents can act beyond their remit. You need clear limits and owners, and to assess which AI Act requirements apply to you.

Book a callHow certification works

The path to ISO 42001 certification

Tailor your preparation to your role and use. A business buying AI services needs different practices from one developing them.

  1. 01

    Setup

    Identify the AI services you buy or develop and what they are used for. Decide the scope, responsibilities and objectives. Set up AmpliFlow yourselves or choose implementation help.

  2. 02

    Work in AmpliFlow

    Assess risks and impacts on people and society. Decide, for example, what information may be sent to an AI service and when a person must review its output. Document and test your decisions.

  3. 03

    Internal audit

    Audit how AI is used in practice. Management reviews objectives, assessments and what has not worked, then decides what needs to change.

  4. 04

    External audit

    An independent certification body audits your AI management system. The external audit costs extra.

  5. 05

    Certificate

    After a successful external audit and the certification body's decision, you receive your ISO 42001 certificate. Keep reviewing new uses and changes to your AI services.

Keep track of your AI decisions

Start with one use, such as AI drafts of customer replies. Describe the purpose, the information used and who approves the reply. Your team makes the assessments. Register entries are not automatically linked to risks or controls.

  • Which AI do you use?Build a register with custom lists for purpose, data, supplier and owner. Your team identifies which systems to include.
  • What can staff use it for?Describe permitted use and who reviews outputs in your AI policy. Save impact assessments as pages or files and document risks in the risk tool.
  • What does management need to review?Assign control owners and tasks, and attach evidence. Record nonconformities and follow up actions when, for example, someone uses an AI output without the agreed review.

See the software you will use

The images show projects, risk assessments, pages and competence records. Some example content is in Swedish.

See all tools →
Views of AmpliFlow tools for AI management 1Open full-size image (new tab)
Views of AmpliFlow tools for AI management 2Open full-size image (new tab)
Views of AmpliFlow tools for AI management 3Open full-size image (new tab)
Views of AmpliFlow tools for AI management 4Open full-size image (new tab)
Views of AmpliFlow tools for AI management 5Open full-size image (new tab)

Select controls and keep evidence

Review the 38 Annex A controls against your risks and requirements. Justify inclusions and exclusions in your Statement of Applicability (SoA). Add custom controls if needed.

Export the control register as PDF input for your SoA. Your organisation must make sure the statement covers necessary controls and their justifications.

Annex A contains

38

controls to assess against your risks and requirements.

Do you need human expert help?

Use the software to build your management system yourselves, or get help with setup and implementation. We agree the scope of that help before you decide.

  • Software only

    your team sets up and leads the work.

  • Implementation support

    Mini includes Swedish-speaking software support and introductory training. Midi provides project leadership, and with Maxi we build the management system with you. Midi and Maxi include migration of files at no extra migration charge.

Your team still coordinates its part of the work, and management makes the business decisions.

AI help and human expertise

Optional AI help lets you write and edit drafts that you review yourselves. Our human experts can help with assessments, priorities and questions where you need experience.

See what the optional AI can help with

Compare pricing and our Mini/Midi/Maxi support levels.

See prices and support

Questions about ISO 42001

Is ISO 42001 relevant if we only use AI?
Yes. Purchased AI services also need to be managed according to how you use them. ISO 42001 covers both users and organisations that develop or provide AI. You do not need an in-house IT team, but you need the right expertise to assess your use and know when to involve a supplier or specialist. Your AI management system is your practices, responsibilities and follow-up. AmpliFlow supports this, but does not assess AI services for you.
Does ISO 42001 certification mean we comply with the AI Act?

No. Certification covers your AI management system, not approval of every AI product or proof of legal compliance. You need a separate assessment of the legal requirements that apply to your role and use.

Do we have to use the AI features in AmpliFlow?

No. AI assistance is optional and can draft control descriptions. A responsible person reviews and adapts the text before use. AI and data processing.

Can we bring files from our current system?
Yes, if they can be exported. In Midi and Maxi, migration of agreed files is included at no extra migration charge. With software only, you export and upload the files yourselves. Your entire old system is not migrated automatically.
Do we need to buy the ISO 42001 standard itself?

We recommend having access to the standard, either by purchasing it or through a subscription. This lets you read the original requirements, look up questions and make your own assessments.

If you would like support, our experts can help you understand the requirements and apply them in your organisation.

Find your national standards body

Can we combine ISO 42001 with other standards?
Yes. You can reuse shared practices for documents, responsibilities and improvements. Also review each standard's own requirements, including AI risks and impact assessments.

We'd love to talk to you about ISO!

Tell us which AI services you use and what questions management needs to resolve. You will speak with a person about responsibilities, assessments and certification preparation. We show you how to record and follow up decisions in AmpliFlow and discuss the help you want.