AI services
ISO 42001 readiness and an
AI governance program you can show.
Customers, contracts and boards are starting to ask how your business governs AI. We help you answer with an inventory, a risk assessment, a policy, named owners, working controls and the evidence behind them. Readiness only: an accredited certification body issues the certificate, and your counsel interprets the law.
ISO 42001 readiness, at Pro IT NW, a Seattle-based consultancy, is the hands-on work of building an AI governance program that an auditor, customer or board can examine. That means an inventory of AI in use, a risk assessment, policy, named roles, controls and evidence. It is for businesses being asked how they govern AI. We do readiness only: we never certify, and we give no legal advice.
What does an AI governance program include?
An AI governance program is how a business decides, records and checks the way it uses AI.
- An inventory of AI in use: staff tools, AI features inside existing software, and anything you build
- An AI risk assessment, with each risk given an owner and a treatment
- An AI policy and an acceptable-use policy for staff
- Named roles: who approves a new AI tool, who owns AI risk, who reports to leadership
- Controls that enforce the policy, in Microsoft 365, Entra ID and the AI tools themselves
- Evidence: records showing the controls run, kept where an auditor can find them
Where does the NIST AI RMF fit?
The NIST AI Risk Management Framework is a common vocabulary for AI risk that we map your controls to where it helps.
NIST describes the framework as "intended for voluntary use". It is organized around four functions: Govern, Map, Measure and Manage. Mapping to it gives auditors, customers and boards a structure they recognize. It is optional, and it is not a substitute for a certification audit.
How it runs
How does ISO/IEC 42001 readiness work?
Readiness runs as a scoped engagement in a fixed order, ending with a program your own people can operate.
-
Step 01
Scope and goal
Are you preparing for a certification audit, answering a customer questionnaire, or building an internal program? The goal sets the depth.
-
Step 02
Inventory and gap assessment
What AI is in use, what governance already exists, and where the gaps are against your chosen goal.
-
Step 03
Build the program
Risk assessment, policies, roles and the technical controls that enforce them, configured in your own environment.
-
Step 04
Evidence and handover
Evidence organized for review, and training for your staff so the program keeps running after we leave.
What do we get at the end?
You get a documented AI governance program, working controls, and evidence you own.
- An AI inventory and a written AI risk assessment
- AI policy, acceptable-use policy and a roles document
- A control map, cross-referenced to the NIST AI RMF where useful
- An evidence set, and a gap list showing what remains before a certification audit
What is this not?
This is readiness and operational work, never certification and never legal advice.
- Not certification: an accredited certification body issues ISO/IEC 42001 certificates
- Not legal advice: whether the EU AI Act or a state AI law applies to you is for your counsel; we help with the operational controls
- Not a resale channel: we sell no software or licenses, and you buy any tool from the vendor of your choice
- Not a permanent dependency: your staff run the program, and we train them to
Who is AI governance readiness for?
It is for businesses that need to show, not just say, how they govern AI. That is often an owner or CFO facing a customer security questionnaire that now asks about AI, a practice manager answering a board, or an IT manager asked to make a policy enforceable. If staff AI tools are not yet under control, start with secure AI for business or the narrower AI usage review; governance builds on that foundation.
Related
- → Virtual CISO & fractional CIO: senior security leadership, AI risk included, as a fixed-scope engagement.
- → Microsoft Purview data governance: the data controls many AI policies depend on.
- → Modern Workplace + AI
- → Who owns AI risk when you don't have a CISO?
FAQ
Common questions about ISO 42001 readiness and AI governance.
Does Pro IT NW certify organizations to ISO/IEC 42001?
No. Pro IT NW does readiness work only. ISO/IEC 42001 certificates are issued by an accredited certification body after its own audit. We help you build the AI governance program, the controls and the evidence that a certification audit will examine, and we never certify, audit or issue an opinion ourselves.
What is an AI governance program?
An AI governance program is the set of decisions, roles, policies and controls an organization uses to manage how AI is chosen, used and monitored. In practice it includes an inventory of AI in use, an AI risk assessment, an acceptable-use policy, named owners for AI risk, controls that enforce the policy, and records that show the controls are working.
Is this legal advice about the EU AI Act or state AI laws?
No. Pro IT NW provides operational and technical work: inventories, risk assessments, policies, controls and evidence. Whether a law such as the EU AI Act or a US state AI law applies to you, and what it requires, is a question for your counsel. We help put in place the operational controls your counsel decides you need.
How does the NIST AI Risk Management Framework relate to this work?
The NIST AI Risk Management Framework is a voluntary framework from the US National Institute of Standards and Technology for managing AI risk. Where it helps, Pro IT NW maps your AI controls to it so your program uses a vocabulary that auditors, customers and boards recognize. Using it is optional and does not replace a certification audit.
Do we need ISO/IEC 42001 certification?
Not necessarily. Some organizations pursue certification because a customer, contract or board asks for it. Others only need a working AI governance program they can explain and show evidence for. A readiness engagement with Pro IT NW tells you how far you are from either goal, and the decision to seek certification stays with you.
How much does ISO/IEC 42001 readiness cost?
It is scoped on a call. The effort depends on how many AI tools and AI-enabled systems are in use, whether you build or customize AI yourself, what governance documents already exist, and whether you are aiming for a certification audit or an internal program. You get the scope before any work starts.
Show how your business governs AI.
Tell us what is asking the question (a customer, a contract, a board or an audit), roughly which AI tools are in use, and whether you build any AI yourselves. We'll come back with scope.