ISO/IEC 42001 explained: what SMEs actually need to know

What ISO/IEC 42001 actually is

ISO/IEC 42001 is the first international standard for an AI management system - the set of processes an organisation uses to govern how it develops, deploys and uses AI. It sits alongside standards you may already know, like ISO 27001 for information security, but it's aimed squarely at AI-specific risks: biased outputs, opaque decision-making, poor data quality, missing human oversight, and the downstream impact an AI system has on the people it touches.

Structurally, it looks like most modern management-system standards. There are clauses covering context (why you're doing this and who's affected), leadership, planning, support, operation, performance evaluation and improvement. Then there's Annex A - a list of specific controls, things like maintaining an AI policy, assessing the impact of a system before you roll it out, documenting where your training or input data comes from, checking how AI-enabled suppliers are managed, and having an incident process for when a system does something it shouldn't.

None of this is exotic. It's the kind of thing a careful adopter would want to do anyway. The standard's contribution is putting a name and a shape around it, so you're not inventing the checklist from scratch.

Do you actually need to get certified?

For most SMEs, no - not yet. Certification means external audits, ongoing evidence collection, and a management review cycle that runs indefinitely, not once. It's worth the cost mainly when a buyer's procurement team asks for it by name - which happens increasingly in enterprise, government, and regulated-sector deals, but is still the exception rather than the rule for smaller companies.

What's worth adopting now, certificate or not, is the underlying discipline. The standard is really a set of questions a responsible AI adopter should be able to answer: who owns this system, what data feeds it, have we checked it for bias against any group of customers or staff, and what happens if it goes wrong. You can answer those questions without ever booking an audit.

A worked example

Take a 20-person recruitment agency using an AI tool to screen CVs. Nobody there is thinking about ISO 42001 - they just want to save time on first-pass filtering. Borrowing the standard's structure without certifying looks like this: list the AI system (the screening tool, plus whatever's built into their ATS), write one paragraph on what data it uses and where that data comes from, spend twenty minutes asking whether the tool could systematically disadvantage any group of candidates (age, background, non-native English CVs), and name one person who checks the tool's decisions monthly and owns the fix if something looks off. That's four artefacts, half a day's work, and it directly answers the questions a nervous client or insurer would ask if this ever became a problem. It's not a management system. It's the shape of one, scaled down to fit.

The bit most SMEs get wrong

There are two failure modes, and they're mirror images of each other. The first is ignoring it entirely - "we're too small for this," which usually means nobody has written down which AI tools are in use, so nobody can answer a straightforward question about them when a client or regulator asks. The second is over-engineering it - drafting a forty-page AI policy before anyone in the business has touched an AI tool in anger, which produces a document nobody reads and nobody updates.

The organisations that get value from this treat it as a living checklist, revisited each time they adopt a new AI system, not a one-off compliance exercise bolted on at the end of the year. If your AI policy hasn't changed since you wrote it, it's probably already out of date with what you're actually using.

Where to start

1. List what you actually use. Most companies are surprised by the length of this list once they include the AI features buried inside existing tools, not just the standalone products.
2. Assess impact, not just function. For each system, ask whether it could unfairly affect a customer, candidate or employee - not just whether it works.
3. Name an owner. Someone specific, not "the team," who is responsible for checking outcomes and fixing problems.
4. Revisit it when you add anything new. A checklist reviewed quarterly beats a policy written once and filed away.

That covers most of the value, well before anyone needs to think about a formal audit.

Where Florence helps

Florence's Assessment step includes an optional ISO/IEC 42001 readiness checklist, organised the same way the standard is: policy, roles, resources, impact assessment, data, suppliers, lifecycle, incidents, and use. Rate where you stand on each control, add evidence notes as you go, and the gaps you flag feed straight into your AI strategy and project briefs - so closing them becomes part of your roadmap, not a separate compliance project you never get round to.